Complete.Org: Mailing Lists: Archives: freeciv-dev: January 2005:
[Freeciv-Dev] (PR#11971) Use encrypted passwords where possible

[Freeciv-Dev] (PR#11971) Use encrypted passwords where possible

[Top] [All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index] [Thread Index]
Subject: [Freeciv-Dev] (PR#11971) Use encrypted passwords where possible
From: "Ed Overton" <edoverton@xxxxxxxxxx>
Date: Tue, 18 Jan 2005 11:46:18 -0800
Reply-to: bugs@xxxxxxxxxxx

<URL: >

Opening ticket based on part of the discussion in ticket 11851:

In terms of password management, there are (at least) two types of
security that can be applied.  First, there is securing the
communication method.  Second, there is the use of encryption for any
password storage.  This ticket solely deals with the second issue.

The server should keep encrypted passwords in memory and in the user
database.  When the client sends a password, the server first would
encrypt the plaintext and then overwrite the plaintext memory.  At that
point, the server works with (retains / compares / saves) the encrypted

One mechanism to use would be something based on md5, such as what's
done for crypt_md5 in freebsd:

That second file is basically a lift from the RFC for md5 digests:

I can work on the code changes here if folks would like to see it. 
However, I don't know where the changes would be necessary for the
copyright and license notices.


[Prev in Thread] Current Thread [Next in Thread]
  • [Freeciv-Dev] (PR#11971) Use encrypted passwords where possible, Ed Overton <=