Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1082)
Subject: Re: PHP-based SHA1 algorithm?
From: Martin Hewitt <martin@thenoi.se>
In-Reply-To: <AANLkTi=Wo0V7ikOe2RGM9Bkf_koU1QWgO1cXR3qQy=Y3@mail.gmail.com>
Date: Wed, 23 Mar 2011 13:15:41 +0000
Content-Transfer-Encoding: quoted-printable
Message-Id: <D5EC60BC-F278-4331-BE71-01D9F846C9F2@thenoi.se>
References: <1C449572-2BB6-450E-A408-6C7E5CEE3BE4@thenoi.se>
 <AANLkTinnWjw4Sfwuy3S77Hh09aix6931CWh8ozbYkRoZ@mail.gmail.com>
 <338D4FB2-89BB-46E8-905A-1E11E67F2E24@thenoi.se>
 <AANLkTi=Wo0V7ikOe2RGM9Bkf_koU1QWgO1cXR3qQy=Y3@mail.gmail.com>
To: user@couchdb.apache.org

Hi Stefan,

=46rom here: =
http://wiki.apache.org/couchdb/Security_Features_Overview#Authorization

"The salt attribute is the hexadecimal representation of the salt used =
to generate the user's password hash."

Might have gotten the wrong end of the stick though...

Martin=20

On 23 Mar 2011, at 13:13, Stefan Matheis wrote:

> Hey again,
>=20
> just wondering about the following lines
>=20
>> $salt =3D "qwertyuiop";
>> $user['salt'] =3D bin2hex($salt);
>=20
> is that really, what you want to do / what couch requires you to do?
>=20
> $ php -r 'var_dump("qwertyuiop", bin2hex("qwertyuiop"));'
> string(10) "qwertyuiop"
> string(20) "71776572747975696f70"
>=20
> could find no step in any couch-related document about that
> requirement, you're refering to which one Martin?
>=20
> Regards
> Stefan
>=20
> On Wed, Mar 23, 2011 at 1:53 PM, Martin Hewitt <martin@thenoi.se> =
wrote:
>> Hi all,
>>=20
>> Just wondering if anyone has done this successfully in PHP and could =
offer advice?
>>=20
>> My code is currently:
>>=20
>> $user =3D array();
>> $user['_id'] =3D "org.couchdb.user:".$newUser;
>> $user['type'] =3D "user";
>> $user['name'] =3D $newUser;
>> $user['roles'] =3D "numpty";
>>=20
>> $salt =3D "qwertyuiop";
>> $newPassword =3D "test";
>>=20
>> $user['password_sha'] =3D sha1($newPassword.$salt);
>> $user['salt'] =3D bin2hex($salt);
>>=20
>> And I can't login through Futon.
>>=20
>> Any help greatly appreciated!
>>=20
>> Martin
>>=20
>> On 23 Mar 2011, at 08:40, Stefan Matheis wrote:
>>=20
>>> Martin,
>>>=20
>>> based on =
http://wiki.apache.org/couchdb/Security_Features_Overview#Generating_passw=
ord_sha
>>> what's wrong about php's sha1() function?
>>>=20
>>> $ php -r "echo sha1('foobar');"
>>> 8843d7f92416211de9ebb963ff4ce28125932878
>>>=20
>>> it's the same result as stated there for erlang, ruby & python :)
>>>=20
>>> Regards
>>> Stefan
>>>=20
>>> On Wed, Mar 23, 2011 at 4:33 AM, Martin Hewitt <martin@thenoi.se> =
wrote:
>>>> Hi all,
>>>>=20
>>>> I'm writing a build process in Phing, part of which involves =
creating a new CouchDB user. I'm having trouble logging in as the =
created user and have an inkling that it's down to the SHA1 encryption =
of the password and salt, as the Security wiki page is quite specific =
about what SHA1s work and which ones don't.
>>>>=20
>>>> My question is - does anyone know if there's a way to generate a =
CouchDB-friendly SHA1 hash in PHP?
>>>>=20
>>>> Thanks,
>>>>=20
>>>> Martin
>>=20
>>=20