Re: MD5-based passwords

On Wed, Nov 07, 2001 at 12:27:53AM -0500, Bruce Momjian wrote:
> > Hey folks,
> >
> > I don't see MD5-based password code in the JDBC CVS tree. Is anyone
> > working on this?
> >
> > I'll take a stab, if not.
>
> There is no one working on it. ODBC needs it too. It wasn't on the
> TODO list but I just added it.
>
> I can assist with any questions. See libpq for a sample implementation.

OK, how about this? Someone will have to help me with appropriate exception
behavior and where the bytesToHex util is placed.

I'm not clear on the SendInteger(5 + .. code, seen elsewhere. Why isn't
this (4 + ...?

Index: Connection.java
===================================================================
RCS file: /projects/cvsroot/pgsql/src/interfaces/jdbc/org/postgresql/Connection.java,v
retrieving revision 1.34
diff -r1.34 Connection.java
6a7
> import java.security.*;
65a67
> private static final int AUTH_REQ_MD5 = 5;
183c185
< // Get the password salt if there is one
---
> // Get the crypt password salt if there is one
190c192,204
< DriverManager.println("Salt=" + salt);
---
> DriverManager.println("Crypt salt=" + salt);
> }
>
> // Or get the md5 password salt if there is one
> if (areq == AUTH_REQ_MD5)
> {
> byte[] rst = new byte[4];
> rst[0] = (byte)pg_stream.ReceiveChar();
> rst[1] = (byte)pg_stream.ReceiveChar();
> rst[2] = (byte)pg_stream.ReceiveChar();
> rst[3] = (byte)pg_stream.ReceiveChar();
> salt = new String(rst, 0, 4);
> DriverManager.println("MD5 salt=" + salt);
197,198c211,212
< break;
<
---
> break;
>
223a238,266
> case AUTH_REQ_MD5:
> try {
> MessageDigest md = MessageDigest.getInstance("MD5");
> byte[] temp_digest, pass_digest;
> byte[] hex_digest = new byte[35];
>
> DriverManager.println("postgresql: MD5");
>
> md.update(PG_PASSWORD.getBytes());
> md.update(PG_USER.getBytes());
> temp_digest = md.digest();
>
> bytesToHex(temp_digest, hex_digest, 0);
> md.update(hex_digest, 0, 32);
> md.update(salt.getBytes());
> pass_digest = md.digest();
>
> bytesToHex(pass_digest, hex_digest, 3);
> hex_digest[0] = 'm'; hex_digest[1] = 'd'; hex_digest[2] = '5';
>
> pg_stream.SendInteger(5 + hex_digest.length, 4);
> pg_stream.Send(hex_digest);
> pg_stream.SendInteger(0, 1);
> pg_stream.flush();
> } catch (Exception e) {
> ; // "MessageDigest failure; " + e
> }
> break;
>
310a354,368
>
> private static void bytesToHex(byte[] bytes, byte[] hex, int offset)
> {
> final char lookup[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
> 'a', 'b', 'c', 'd', 'e', 'f' };
>
> int i, c, j, pos = offset;
>
> for (i = 0; i < 16; i++) {
> c = bytes[i] & 0xFF; j = c >> 4;
> hex[pos++] = (byte) lookup[j];
> j = (c & 0xF);
> hex[pos++] = (byte) lookup[j];
> }
> }

-jeremy
_____________________________________________________________________
jeremy wohl ..: http://igmus.org