Ldap differences between {crypt} and {CRYPT}

Question

I recently stumbled upon some password entries in LDAP marked with the {crypt} scheme. Since all recent entries are {CRYPT}, I was wondering what the differences between the hash algorithms are.

Answer 1

I suppose that you are talking about an OpenLDAP server. It seems that OpenLDAP follows the format specified in RFC 2307, where we see:

    passwordvalue          = schemeprefix encryptedpassword

    schemeprefix           = "{" scheme "}"
    scheme                 = "crypt" / "md5" / "sha" / altscheme
    altscheme              = "x-" keystring
    encryptedpassword      = encrypted password

which would indicate that the "correct" scheme names are in lowercase, not uppercase. Since existing, deployed servers use uppercase names, it is probable that the name is not case-sensitive. In that sense, "{crypt}" and "{CRYPT}" would be equivalent and designate the same algorithm.

Since RFC 2307 is both old and marked "experimental", there is no guarantee here. I suggest that you try it out by taking one "{crypt}" entry and changing it to "{CRYPT}", and see if the user can still log in.