Authen::Passphrase::SaltedDigest(3pm)			User Contributed Perl Documentation		     Authen::Passphrase::SaltedDigest(3pm)

NAME

       Authen::Passphrase::SaltedDigest - passphrases using the generic salted digest algorithm

SYNOPSIS

	       use Authen::Passphrase::SaltedDigest;

	       $ppr = Authen::Passphrase::SaltedDigest->new(
		       algorithm => "SHA-1",
		       salt_hex => "a9f524b1e819e96d8cc7".
				   "a04d5471e8b10c84e596",
		       hash_hex => "8270d9d1a345d3806ab2".
				   "3b0385702e10f1acc943");

	       $ppr = Authen::Passphrase::SaltedDigest->new(
		       algorithm => "SHA-1", salt_random => 20,
		       passphrase => "passphrase");

	       $ppr = Authen::Passphrase::SaltedDigest->from_rfc2307(
		       "{SSHA}gnDZ0aNF04BqsjsDhXAuEPGsy".
		       "UOp9SSx6BnpbYzHoE1UceixDITllg==");

	       $algorithm = $ppr->algorithm;
	       $salt = $ppr->salt;
	       $salt_hex = $ppr->salt_hex;
	       $hash = $ppr->hash;
	       $hash_hex = $ppr->hash_hex;

	       if($ppr->match($passphrase)) { ...

	       $userPassword = $ppr->as_rfc2307;

DESCRIPTION

       An object of this class encapsulates a passphrase hashed using a generic digest-algorithm-based scheme.	This is a subclass of
       Authen::Passphrase, and this document assumes that the reader is familiar with the documentation for that class.

       The salt is an arbitrary string of bytes.  It is appended to passphrase, and the combined string is passed through a specified message
       digest algorithm.  The output of the message digest algorithm is the passphrase hash.

       The strength depends entirely on the choice of digest algorithm, so choose according to the level of security required.	SHA-1 is suitable
       for most applications, but recent work has revealed weaknesses in the basic structure of MD5, SHA-1, SHA-256, and all similar digest
       algorithms.  A new generation of digest algorithms emerged in 2008, centred around NIST's competition to design SHA-3.  Once these
       algorithms have been subjected to sufficient cryptanalysis, the survivors will be preferred over SHA-1 and its generation.

       Digest algorithms are generally designed to be as efficient to compute as possible for their level of cryptographic strength.  An unbroken
       digest algorithm makes brute force the most efficient way to attack it, but makes no effort to resist a brute force attack.  This is a
       concern in some passphrase-using applications.

       The use of this kind of passphrase scheme is generally recommended for new systems.  Choice of digest algorithm is important: SHA-1 is
       suitable for most applications.	If efficiency of brute force attack is a concern, see Authen::Passphrase::BlowfishCrypt for an algorithm
       designed to be expensive to compute.

CONSTRUCTORS

       Authen::Passphrase::SaltedDigest->new(ATTR => VALUE, ...)
	   Generates a new passphrase recogniser object using the generic salted digest algorithm.  The following attributes may be given:

	   algorithm
	       Specifies the algorithm to use.	If it is a reference to a blessed object, it must be possible to call the "new" method on that
	       object to generate a digest context object.

	       If it is a string containing the subsequence "::" then it specifies a module to use.  A plain package name in bareword syntax,
	       optionally preceded by "::" (so that top-level packages can be recognised as such), is taken as a class name, on which the "new"
	       method will be called to generate a digest context object.  The package name may optionally be followed by "-" to cause automatic
	       loading of the module, and the "-" (if present) may optionally be followed by a version number that will be checked against.  For
	       example, "Digest::MD5-1.99_53" would load the Digest::MD5 module and check that it is at least version 1.99_53 (which is the first
	       version that can be used by this module).

	       A string not containing "::" and which is understood by Digest->new will be passed to that function to generate a digest context
	       object.

	       Any other type of algorithm specifier has undefined behaviour.

	       The digest context objects must support at least the standard "add" and "digest" methods.

	   salt
	       The salt, as a raw string of bytes.  Defaults to the empty string, yielding an unsalted scheme.

	   salt_hex
	       The salt, as a string of hexadecimal digits.  Defaults to the empty string, yielding an unsalted scheme.

	   salt_random
	       Causes salt to be generated randomly.  The value given for this attribute must be a non-negative integer, giving the number of
	       bytes of salt to generate.  (The same length as the hash is recommended.)  The source of randomness may be controlled by the
	       facility described in Data::Entropy.

	   hash
	       The hash, as a string of bytes.

	   hash_hex
	       The hash, as a string of hexadecimal digits.

	   passphrase
	       A passphrase that will be accepted.

	   The digest algorithm must be given, and either the hash or the passphrase.

       Authen::Passphrase::SaltedDigest->from_rfc2307(USERPASSWORD)
	   Generates a salted-digest passphrase recogniser from the supplied RFC2307 encoding.	The scheme identifier gives the digest algorithm
	   and controls whether salt is permitted.  It is followed by a base 64 string, using standard MIME base 64, which encodes the
	   concatenation of the hash and salt.

	   The scheme identifiers accepted are "{MD4}" (unsalted MD4), "{MD5}" (unsalted MD5), "{RMD160}" (unsalted RIPEMD-160), "{SHA}" (unsalted
	   SHA-1), "{SMD5}" (salted MD5), and "{SSHA}" (salted SHA-1).	All scheme identifiers are recognised case-insensitively.

METHODS

       $ppr->algorithm
	   Returns the digest algorithm, in the same form as supplied to the constructor.

       $ppr->salt
	   Returns the salt, in raw form.

       $ppr->salt_hex
	   Returns the salt, as a string of hexadecimal digits.

       $ppr->hash
	   Returns the hash value, in raw form.

       $ppr->hash_hex
	   Returns the hash value, as a string of hexadecimal digits.

       $ppr->match(PASSPHRASE)
       $ppr->as_rfc2307
	   These methods are part of the standard Authen::Passphrase interface.  Only passphrase recognisers using certain well-known digest
	   algorithms can be represented in RFC 2307 form.

SEE ALSO

       Authen::Passphrase, Crypt::SaltedHash

AUTHOR

       Andrew Main (Zefram) <zefram@fysh.org>

COPYRIGHT

       Copyright (C) 2006, 2007, 2009, 2010, 2012 Andrew Main (Zefram) <zefram@fysh.org>

LICENSE

       This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

perl v5.14.2							    2012-02-07				     Authen::Passphrase::SaltedDigest(3pm)