<p>I'm working with Subversion based on Windows and would like to write an easy utility in .NET for working with the Apache password file.  I understand that it uses a function referred to as MD5Crypt, but I can't seem to find a description of the algorithm beyond that at some point it uses MD5 to create a hash.</p>

<p>Can someone describe the MD5Crypt algorithm and password line format?</p>

[{'answer_id': 23523, 'author': 'Espo', 'author_id': 2257, 'author_profile': 'https://Stackoverflow.com/users/2257', 'pm_score': 2, 'selected': False, 'text': '<p>You can find an implementation of md5crypt in the <a href="http://tcllib.sourceforge.net/doc/md5crypt.html" rel="nofollow noreferrer">tcllib package.</a> Download is available from <a href="http://sourceforge.net/project/showfiles.php?group_id=12883" rel="nofollow noreferrer">sourceforge</a>.</p>\n\n<p>You can also find an example of an apache-compatible md5crypt in the <a href="http://esup-casgeneric.sourceforge.net/api/src-html/md5/MD5Crypt.html#line.220" rel="nofollow noreferrer">source code for the CAS Generic Handler</a></p>\n'}, {'answer_id': 23557, 'author': 'Mark Harrison', 'author_id': 116, 'author_profile': 'https://Stackoverflow.com/users/116', 'pm_score': 2, 'selected': False, 'text': '<p>MD5Crypt is basically a replacement for the old-fashioned unix crypt function.  It was introduced in freebsd, and has been adopted by other groups as well.</p>\n\n<p>The basic idea is this:</p>\n\n<ul>\n<li>a hash is a good way to store a password\n\n<ul>\n<li>you take the user\'s entered password and hash it</li>\n<li>compare it to the stored hash</li>\n<li>if the hash is the same, the passwords match</li>\n</ul></li>\n</ul>\n\n<p>But there\'s a problem:</p>\n\n<ul>\n<li>Suppose you pick the password "jeff" and I also pick the password "jeff".</li>\n<li>Now both of our password hashes are the same.</li>\n<li>So if I see the stored hash codes, I will know your password is the same as mine, "jeff".</li>\n</ul>\n\n<p>So, we can add a "salt" string to the password.</p>\n\n<ul>\n<li>This can be any random thing.</li>\n<li>Suppose for your account it is "zuzu" and for my account it is "rjrj".</li>\n<li>Now we hash the string "jeffzuzu" for your password, and "jeffrjrj" for my password.</li>\n<li>Now we have different hash values for our password.</li>\n<li>We can safely store the salt value with the hashed password, since even knowing the salt value won\'t help to decode the hash.</li>\n</ul>\n\n<p>You mention .net, there\'s a pointer over in another forum to this:</p>\n\n<pre><code>System.Security.Cryptography.MD5CryptoServiceProvider md5 = new\nSystem.Security.Cryptography.MD5CryptoServiceProvider();\n\nstring hash =BitConverter.ToString((md5.ComputeHash(\nSystem.Text.ASCIIEncoding.Default.GetBytes(stringtohash) ) ));\n</code></pre>\n\n<p>HTH!</p>\n'}, {'answer_id': 155696, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 2, 'selected': False, 'text': '<p>The process is rather involved... the salt and the password are hashed together not once, but 1000 times. Also, the base64 encoding uses a different alphabet, and the padding is removed from the end.</p>\n\n<p>The best thing would probably be to find a library to use, like glibc under cygwin.</p>\n\n<p>Since you code against Apache anyway, have a look at <a href="http://svn.apache.org/viewvc/apr/apr/trunk/crypto/apr_md5.c?view=co" rel="nofollow noreferrer">Apache\'s implementation</a> of crypt-md5.</p>\n\n<p>The original algorithm (I think) in C can be found <a href="http://www.freebsd.org/cgi/cvsweb.cgi/~checkout~/src/lib/libcrypt/crypt.c?rev=1.2" rel="nofollow noreferrer">here</a>. It differs from the above implementation only by the different magic number.</p>\n'}, {'answer_id': 5009525, 'author': 'nealmcb', 'author_id': 507544, 'author_profile': 'https://Stackoverflow.com/users/507544', 'pm_score': 3, 'selected': True, 'text': '<p>A precise textual description of the crypt algorithm updated for use with sha256 and sha512 is at <a href="http://www.akkadia.org/drepper/SHA-crypt.txt" rel="nofollow">http://www.akkadia.org/drepper/SHA-crypt.txt</a></p>\n\n<p>It includes contrasts with the MD5 algorithm, so it should give you what you\'re looking for.</p>\n'}]
['https://Stackoverflow.com/questions/23511', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1954/']