MD5 Encryption

[shan t]

Hi all,

I am writing a demo program in C which sends packets to freeRadius
Server. I am having difficulties in understanding the password
encryption..

I am not sure how the hashing works.. The sample program given in the
ftp site for MD5 hashing takes 2 parameters.. "Key" and "saltstring",
Here the key is the Identifier (16 Byte Arbitrary number) and key is
the shared secret?

The documentation says the procedure is..
-----------------------------------------------------------------------------------------------------------------
The Access-Request packet contains a 16 octet Request Authenticator in
the authenticator field. This Request authenticator is a randomly
chosen 16 octet string.

This packet is completely unprotected, except for the User-Password
attribute, which is protected as follows:

The client and server share a secret. That shared secret followed by
the Request Authenticator is put through an MD5 hash to create a 16
octet value which is XORed with the password entered by the user. If
the user password is greater than 16 octets, additional MD5
calculations are performed, using the previous ciphertext instead of
the Request Authenticator.

More formally:
Call the shared secret S and the pseudo-random 128-bit Request
Authenticator RA. The password is broken into 16-octet blocks p1, p2,
... pn, with the last block padded at the end with '0's to a 16-octet
boundary. The ciphertext blocks are c1, c2... cn.

c1 = p1 XOR MD5(S + RA)
c2 = p2 XOR MD5(S + c1)
.
.
.
cn = pn XOR MD5(S + cn-1)

The User-Password attribute contains c1+c2+...+cn, Where + denotes
concatenation.

------------------------------------------------------------------------------------------

Please let me know if anyonbe has worked on similar stuff..

Regards,
Shan