Alterning the form of MD5 encryption used in FirstSpot.

[gsmith]

Can the form of MD5 encryption be changed?

Your documents state that MD5-HMAC encryption is used in FirstSpot. Our user database uses a different variation of MD5 and I cannot change the data. I'm believe it is a standard MD5 hash and have included examples below. Is it possible to make this change to FirstSpot?

Thanks,
Greg Smith

dog
06D80EB0C50B49A509B49F2424E8C805

cat
D077F244DEF8A70E5EA758BD8352FCD8

bird
ABAECF8CA3F98DC13EEECBAC263CD3ED

[alan]

Unfortunately, it is not possible to change the encryption mechanism in FirstSpot at this moment.

Can your user database trigger encrypt_pwd.exe to insert a row to FirstSpot table also (when creating users)?

We might be able to customize FirstSpot so that FirstSpot's encrytion mechanism can be "offloaded". This has some security implication though.
_________________
~ Patronsoft Limited ~

[gsmith]

Although I can generate both hashes from my original "mass add" of students, my goal is to have synchronized passwords. This solution would only work until the user changes his/her password. A password change in our main system would not be reflected in the FirstSpot database. Basically this will result in additional support for my staff as students EXPECT password synchronization.

Question: Are your programmers willing to point me to the PHP code snippets where the encrypt is done? I can probably make the changes myself if pointed to the files and lines regarding the "create encrypted password" and "encrypt and compare passwords".

Since I think the standard form of MD5 encryption is most commonly used, perhaps your code could offer a config option for this and some of the other common HASH routines.

Thanks,
Greg Smith

[kevin]

The password encoding process actually takes place at our C program level as well, in addition to PHP. Therefore, we do have to change at the source-code level to accomdate your needs.

Our team will talk to you directly to see how we can help.

~ Patronsoft Limited ~

[alan]

We implement "Password Offloading" in 2.1 Advanced Edition. For those who are interested in testing 2.1 Beta 1, please send us an email at firstspot@patronsoft.com.
_________________
~ Patronsoft Limited ~