NAME

       Authen::Passphrase::BigCrypt - passphrases using bigcrypt algorithm

SYNOPSIS

               use Authen::Passphrase::BigCrypt;

               $ppr = Authen::Passphrase::BigCrypt->new(
                       salt_base64 => "qi",
                       hash_base64 => "yh4XPJGsOZ2MEAyLkfWqeQ");

               $ppr = Authen::Passphrase::BigCrypt->new(
                       salt_random => 12,
                       passphrase => "passphrase");

               $salt = $ppr->salt;
               $salt_base64 = $ppr->salt_base64_2;
               $hash = $ppr->hash;
               $hash_base64 = $ppr->hash_base64;

               $pprs = $ppr->sections;

               if($ppr->match($passphrase)) { ...

DESCRIPTION

       An object of this class encapsulates a passphrase hashed using the "bigcrypt" hash
       function found in HP-UX, Digital Unix, OSF/1, and some other flavours of Unix.  Do not
       confuse this with the "crypt16" found on Ultrix and Tru64 (for which see
       Authen::Passphrase::Crypt16).  This is a subclass of Authen::Passphrase, and this document
       assumes that the reader is familiar with the documentation for that class.

       This is a derivation of the original DES-based crypt function found on all Unices (see
       Authen::Passphrase::DESCrypt).  The first eight bytes of the passphrase are used as a DES
       key to encrypt the all-bits-zero block through 25 rounds of (12-bit) salted DES, just like
       the original crypt.  Then, if the passphrase is longer than eight bytes, the next eight
       bytes are used as a DES key to encrypt the all-bits-zero block through 25 rounds of salted
       DES, using as salt the first 12 bits of the hash of the first section.  Then, if the
       passphrase is longer than sixteen bytes, the next eight bytes are used, with salt
       consisting of the first 12 bits of the hash of the second section.  This repeats until the
       entire passphrase has been used.  The hashes of all the sections are concatenated to form
       the final hash.

       A password hash of this scheme is conventionally represented in ASCII using the base 64
       encoding of the underlying DES-based crypt function.  The first two characters give the
       salt for the first section, the next eleven give the hash of the first section, the next
       eleven give the hash of the second section, and so on.  A hash thus encoded is used as a
       crypt string, on those systems where the bigcrypt algorithm is part of crypt(), but the
       syntax clashes with that of crypt16.  This module does not treat it as a crypt string
       syntax.

       Because the sections of the passphrase are hashed separately, it is possible to manipulate
       (e.g., crack) a section hash in isolation.  See Authen::Passphrase::DESCrypt for handling
       of a single section.

       Warning: This is a fatally flawed design, often providing less security than the plain DES
       scheme alone.  Do not use seriously.

CONSTRUCTOR

       Authen::Passphrase::BigCrypt->new(ATTR => VALUE, ...)
           Generates a new passphrase recogniser object using the bigcrypt hash algorithm.  The
           following attributes may be given:

           salt
               The salt for the first section, as an integer in the range [0, 4096).

           salt_base64
               The salt for the first section, as a string of two base 64 digits.

           salt_random
               Causes salt for the first section to be generated randomly.  The value given for
               this attribute must be 12, indicating generation of 12 bits of salt.  The source
               of randomness may be controlled by the facility described in Data::Entropy.

           hash
               The hash, as a string of bytes.

           hash_base64
               The hash, as a string of base 64 digits.

           passphrase
               A passphrase that will be accepted.

           The salt for the first section must be given, and either the hash or the passphrase.

METHODS

       $ppr->salt
           Returns the salt for the first section, as a Perl integer.

       $ppr->salt_base64_2
           Returns the salt for the first section, as a string of two base 64 digits.

       $ppr->hash
           Returns the hash value, as a string of bytes.

       $ppr->hash_base64
           Returns the hash value, as a string of base 64 digits.  This is the concatenation of
           the base 64 encodings of the section hashes, rather than a base64 encoding of the
           combined hash.

       $ppr->sections
           Returns a reference to an array of Authen::Passphrase::DESCrypt passphrase recognisers
           for the sections of the passphrase.

       $ppr->match(PASSPHRASE)
           This method is part of the standard Authen::Passphrase interface.

SEE ALSO

       Authen::Passphrase, Authen::Passphrase::DESCrypt

AUTHOR

       Andrew Main (Zefram) <zefram@fysh.org>

COPYRIGHT

       Copyright (C) 2006, 2007, 2009, 2010, 2012 Andrew Main (Zefram) <zefram@fysh.org>

LICENSE

       This module is free software; you can redistribute it and/or modify it under the same
       terms as Perl itself.