Kopano password encryption key

Clickux

Hi all,

do you know where can be found the key and IV used to encrypt user’s passwords in the Kopano DB ?

thx in advance for your answers.

brgds
Clickux

jengelh

There is no key and no (explicit) IV, because the common practice is that passwords are not symmetrically encrypted, but hashed.

Clickux

Thank you for your answer jengelh.

The idea here is to authenticate using DB backend
So then how can I compare the entered password with the hashed value in the DB ? Is there a way to to that ?

fbartels

Hi @Clickux,

@Clickux said in Kopano password encryption key:

The idea here is to authenticate using DB backend

if you want to share passwords between system the better way would be to use the ldap backend. this is also more powerful in the sense that it can for example also manage contacts.

Clickux

Hi Felix,

thanks for your feedback.
I’ll do it this way then.

brgds

jengelh

see DBBase.cpp:DBPlugin::CreateMD5Hash. There is however no guarantee that the method remains the same forever. pam_mapi (external project) has a proper implementation that uses server logon for validation.