From:	SMTP%"RELAY-INFO-VAX@CRVAX.SRI.COM" 13-MAY-1994 20:30:23.50
To:	EVERHART
CC:	
Subj:	Re: password verification (help)

Date: Fri, 13 May 1994 11:39:40 +0100
From: Arne Vajhoej <ARNE@kopc.hhs.dk>
Subject: Re: password verification (help)
To: sunger@THOR.NOFC.FORESTRY.CA, INFO-VAX@SRI.COM
Message-id: <01HCAF64YUYQ8WW0WP@kopc.hhs.dk>
X-VMS-To: KOPC::IN%"sunger@THOR.NOFC.FORESTRY.CA"
X-VMS-Cc: IN::"INFO-VAX@SRI.COM"
MIME-version: 1.0
Content-type: TEXT/PLAIN; CHARSET=ISO-8859-1
Content-transfer-encoding: 8BIT

> I don't know if this is the right newsgroup for this type of question, but I
> would appreciate redirection to an appropriate newsgroup if not.
> 
> I'm working on a project that involves the following:
>         - program runs of a terminal in a common printer room (in C).
>         - runs off an a JOE_USER account with OPER priv.
>         - program shows all queues and jobs in each queue, etc.
> --->    - Any user can delete or requeue a job in the queue from the JOE_USER
>           account as long as they enter the correct password for their account
>           corresponding to the queued job.
> 
> The problem I'm having is in verifying the typed in password with the
> password belonging to the account linked with the job. Following is some (sort
> of) code that I've done that does not work (crashed). The passed in variable
> is the job id and the job_list of the queue.
> 
>         ...
>   itmlst[0].buflen = 1;
>   itmlst[0].itemcode = UAI$_ENCRYPT;
>   itmlst[0].buffer = &encryption_method;
>   itmlst[0].retlen = 0;
> 
>   itmlst[1].buflen = 8;
>   itmlst[1].itemcode = UAI$_PWD;
>   itmlst[1].buffer = &hashed_password;
>   itmlst[1].retlen = 0;
> 
>   ENDLIST(itmlst);
> 
>   call(sys$getuai(0, 0, &job.user, &itmlst, 0, 0, 0));
> 
>   call(sys$hash_password(&typed_password, &encryption_method, 0, &job.user,
> &comparison_hashed_password));
> 
>   /* Since strcmp() returns 0 if a match, need a NOT to get correct return
>      value. */
>   return(!strcmp(comparison_hashed_password, hashed_password));
> } /* end of routine check_password */

It is a little difficult to check out the above code fragments, but one thing
that do puzzle me is the use of strcmp to compare 2 quadwords !  They are
definatetly not zero-terminated !

I use the following code to do the check:

        .title  chkpw
        $DSCDEF
        $UAIDEF
TRUE=-1
FALSE=0
        .psect  $PDATA quad,pic,con,lcl,shr,noexe,nowrt
items:  .word   2
        .word   UAI$_SALT
        .address salt
        .long   0
        .word   1
        .word   UAI$_ENCRYPT
        .address encryp
        .long   0
        .word   8
        .word   UAI$_PWD
        .address pwd
        .long   0
        .long   0
;hpwddesc:
;        .byte   DSC$K_CLASS_S
;        .byte   DSC$K_DTYPE_Q
;        .word   8
;        .address hpwd
        .psect  $LOCAL quad,pic,con,lcl,noshr,noexe,wrt
argl_getuai:                            ; argumentlist SYS$GETUAI
        .long   7
        .long   0
        .long   0
        .blkl   1                       ; username
        .blkl   1                       ; item-list
        .long   0
        .long   0
        .long   0
;argl_hpwd:                              ; argumentlist LGI$HPWD
;        .long   5
;        .address hpwddesc               ; hashed password
;        .blkl   1                       ; password
;        .blkl   1                       ; encryptation
;        .blkl   1                       ; salt
;        .blkl   1                       ; username
argl_hashpassword:                       ; argumentlist SYS$HASH_PASSWORD
        .long   5
        .blkl   1                       ; password
        .blkl   1                       ; encryptation
        .blkl   1                       ; salt
        .blkl   1                       ; username
        .address hpwd                   ; hashed password
salt:   .blkw   1
encryp: .blkb   1
pwd:    .blkq   1
hpwd:   .blkq   1
        .psect  $CODE quad,pic,con,lcl,shr,exe,nowrt
;***************************************
;
;  CHKPW ( USERNAME , PASSWORD , OK )
;
;  check password
;
;***************************************
        .entry  chkpw,^m<>
        movl    B^4(ap),argl_getuai+12
        moval   items,argl_getuai+16
        callg   argl_getuai,G^SYS$GETUAI
;        movl    B^4(ap),argl_hpwd+20
;        movl    B^8(ap),argl_hpwd+8
;        movl    salt,argl_hpwd+16
;        movb    encryp,argl_hpwd+12
;        callg   argl_hpwd,G^LGI$HPWD
        movl    B^4(ap),argl_hashpassword+16
        movl    B^8(ap),argl_hashpassword+4
        movl    salt,argl_hashpassword+12
        movb    encryp,argl_hashpassword+8
        callg   argl_hashpassword,G^SYS$HASH_PASSWORD
        cmpl    pwd,hpwd
        bneq    100$
        movl    #TRUE,@B^12(ap)
        ret
100$:   movl    #FALSE,@B^12(ap)
        ret
        .end

And a small example program:

      LOGICAL*4 OK
      CALL CHKPW('ARNE','FOOL',OK)
      WRITE(*,*) OK
      END

(returning false BTW !)

It should work from C too.

                                                          Arne

Arne Vajhøj                             local DECNET:  KO::ARNE
Computer Department                     PSI:           PSI%238310013040::ARNE
Business School of Southern Denmark     Internet:      ARNE@KO.HHS.DK


