Re: patch DIGEST-MD5 hashed password

[Simon Josefsson]

"Gazsó Attila" <address@hidden> writes:

> Hello,
>
> I am writing a jabber server and using the GNU SASL library for
> authentication. I didn't want to store plaintext passwords, so I
> created a patch for 0.2.28. I downloaded the tar.gz because I could
> not compile the git repository version because of version dependencies
> to the gettext package.
>
> This patch essentialy add a new callback type (GSASL_HPASSWORD) which
> contains H(username,':',realm,':',password) as a hex string. It can be
> conveniently stored in that form in a flat file or a database, that's
> why I chose this form. Furthermore I added three helper functions to
> digest-md/server.c to make the hex/binary conversion.
>
> I hope that this patch will appear soon in the library, because I
> would like to use it on production servers too.

Hello Attila!  I like the idea.  I think the property should be called
GSASL_HASHED_DIGEST_MD5_PASSWORD instead though, since other mechanism
may use different hashed passwords.

To be able to include your patch, we need a copyright assignment for it.
I'll send it to you separately.

Thanks,
Simon