websecurity password encryption formula

[Ken Tjia]

My web security password key is set as with these value :

12345678

I created test user with different password and seeing these proper encrypted passwords
Being stored inside the web-security users table.

For example :

abcd generate---> 245UfAlry40=
Abcd generate---> qvqWsaqno5E=
1234 generate---> qifGtHDpPII=

Since I moved my web-security users to an sql table scheme as per suggested.
I now have ability to add user on the fly from a web page.

I have no trouble generate the GUID value, however need the proper way to
Generate the encrypted password value.

I attempt to use this a5_encrypt_string function, however not able to generate
The results.

my test codes are as follow:

dim password as c = "abcd"
dim key as c = "12345678"

dim pwd as c = a5_encrypt_string(password,key)

expecting :
' 245UfAlry40� for abcd above, however got something else.

Is there another encryption method used ?

Appreciate comment and guidance.

Thanks

Ken Tjia

[Ken Tjia]

Re: websecurity password encryption formula

well, i read some posts and decided to use a super long password ky
like abcdefgh...xyz0987654321.....

and re fresh my user and let alpha re generate the password string
and turn around use my codes above, bingo, i got a matching password

hmm.. i consider this is working, but not sure what is consider proper lengh
good luck

[Steven P.]

Re: websecurity password encryption formula

I have tried this myself and to my understanding the password is salted with something else that we don't know. It might be possible that for the internal password used to create user's passwords, there is a different algorithm at work. You should use the A5ws_Save_WebUser function for all I know to create users and passwords.

[Ken Tjia]

Re: websecurity password encryption formula

Hi Steven,
Yes you are 100% correct, i spoke too soon,
Last night.. i tested in real use...
the result appears very close on my pop up.
however, did find that newly generated password (encrypted)
not exactly identical.

Now that you gave me the guide to try.
i found such functionality on help file.

will implement it shortly to test out.

thanks

[Ken Tjia]

Re: websecurity password encryption formula

hi Steven,
Once more, my mind is fresh and i re confirmed that
using a longer than 8 characters "keys"

and these codes infact generate the perfect password.
dim password as c = "abcd"
'dim key as c = "12345678" NO GOOD
dim key as c = "abcdefghijklmnopqtrstuvwxyz0987654321"

dim pwd as c = a5_encrypt_string(password,key)

i will however explore the function you told me further.
thanks

[Kamel]

Re: websecurity password encryption formula

Hello Ken,
I have encountered the same issue,
But when I try your suggestion key the passwords start to match !!!
But no any idea why !?!?

did you understand what happened !?!

[Peter.Greulich]

Re: websecurity password encryption formula

Sorry, but I have no idea what you guys are talking about?

I did this:

dim password as c = "abcd"

dim key as c = "12345678"

dim pwd as c = a5_encrypt_string(password,key)
? pwd
= "ZEtlpdKB80s="

?  a5_encrypt_string(password,key)
= "ZEtlpdKB80s="

? a5_encrypt_string(password,key)
= "ZEtlpdKB80s="

? a5_decrypt_string(pwd,key)
= "abcd"

Seems correct to me?

[dahas]

Re: websecurity password encryption formula

Sure it is correct because you miss the subject.
The way to generate same password that is genereate by the "Web Security" => "Users and Groups" A5 interface.
If i use that interface for a same password and key on websecurity_users.dbf is other value than if you use a5w_encript_string function.
I hope you understean.
Now is not working even you have more than 8 char on key.
What i sow for password user 16 characters long you get at end of encripterd string 2 equal sign ("==")
Here is the table with password lenght and encripted string generated
pass encrypt
0-7 12
8-15 24
16-23 32
24-31 44
32-39 56
40> 65
from this point forward a5_encrypt will generate passord who will broke the definition of field password (vchar 60) from websecurity_users table.
I hope i was clear what subject talking about

[bea2701]

Re: websecurity password encryption formula

Expand your length to 254