1

I recently stumbled upon some password entries in LDAP marked with the {crypt} scheme. Since all recent entries are {CRYPT}, I was wondering what the differences between the hash algorithms are.

1

I suppose that you are talking about an OpenLDAP server. It seems that OpenLDAP follows the format specified in RFC 2307, where we see:

    passwordvalue          = schemeprefix encryptedpassword
    schemeprefix           = "{" scheme "}"
    scheme                 = "crypt" / "md5" / "sha" / altscheme
    altscheme              = "x-" keystring
    encryptedpassword      = encrypted password

which would indicate that the "correct" scheme names are in lowercase, not uppercase. Since existing, deployed servers use uppercase names, it is probable that the name is not case-sensitive. In that sense, "{crypt}" and "{CRYPT}" would be equivalent and designate the same algorithm.

Since RFC 2307 is both old and marked "experimental", there is no guarantee here. I suggest that you try it out by taking one "{crypt}" entry and changing it to "{CRYPT}", and see if the user can still log in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.