Authen::DecHpwd(3pm)

📦
version 2.007 · 8 versions
, in ubuntu stonking

💖 Authen::DecHpwd — DEC VMS password hashing 💖

okay bestie, sit down, hydrate, because we're about to talk about hashing passwords the VMS way. This is Authen::DecHpwd, a chunk of the User Contributed Perl Documentation (the 3pm girlies, you know the vibe), and it's literally the Perl doorway into DEC's ancient-and-iconic password machinery. ✨

🌸 NAME 🌸

Authen::DecHpwd — DEC VMS password hashing. no cap, that's the whole name, she's simple and she slays.

🎀 SYNOPSIS 🎀

use Authen::DecHpwd qw(
        UAI_C_AD_II UAI_C_PURDY UAI_C_PURDY_V UAI_C_PURDY_S
        lgi_hpwd
);

$hash = lgi_hpwd("JRANDOM", "PASSWORD", UAI_C_PURDY_S, 1234);

use Authen::DecHpwd qw(vms_username vms_password);

$username = vms_username($username);
$password = vms_password($password);

like… look at her go 🦋

💅 DESCRIPTION 💅

This module implements the SYS$HASH_PASSWORD password hashing function from VMS — she also answers to the name LGI$HPWD, iykyk — plus a lil family of associated VMS username and password handling functions. 🫶

The password hashing function itself is implemented in XS, with a hideously slow pure Perl backup version for systems that can't handle XS. not me calling my own backup hideous, but fr fr, it is what it is. 😭

🔥 FUNCTIONS 🔥

✨ UAI_C_AD_II, UAI_C_PURDY, UAI_C_PURDY_V, UAI_C_PURDY_S ✨

These constants are the little name tags used to identify the four password hashing algorithms that VMS rocks. In VMS-land they're known as the UAI$C_ constants. 💖

  • UAI_C_AD_II — this one is a 32-bit CRC algorithm. The CRC polynomial used is the IEEE CRC-32 polynomial, the same one Ethernet uses, and in this context she's known as AUTODIN-II. The hash is literally just the CRC of the password. that's it. that's the algorithm. iconic minimalism. ✨
  • UAI_C_PURDY, UAI_C_PURDY_V, and UAI_C_PURDY_S — these are successive refinements of an algorithm based on Purdy polynomials. All three of them use the salt and the username parameters as salt, they use the whole password, and they return an eight-byte (64-bit) hash. The main part of the algorithm, the Purdy polynomial, is identical across all three, periodt. Where they differ is the pre-hashing, especially in how they treat the username parameter. 👑
    • In UAI_C_PURDY, the username is truncated or space-padded to 12 characters before being hashed in.
    • UAI_C_PURDY_V accepts a variable-length username.
    • UAI_C_PURDY_S accepts a variable-length username and also includes the password length in the hash. She additionally does some extra bit rotations when hashing in the username and password strings, so that aliasing doesn't happen. she really said "not today, aliasing". 🚫

🌈 lgi_hpwd(USERNAME, PASSWORD, ALGORITHM, SALT) 🌈

This is the SYS$HASH_PASSWORD function from VMS (also known as LGI$HPWD), except the parameters are in a different order. It hashes the PASSWORD string in a manner determined by the other parameters, and returns the hash as a string of bytes. 💫

  • ALGORITHM determines which hashing algorithm will be used. It must be the value of one of the algorithm constants supplied by this module (peep the section above, bestie 👆).
  • SALT must be an integer in the range [0, 2^16). It modifies the hashing so the same password doesn't always produce the same hash. keeping it spicy. 🌶️
  • USERNAME is a string used as more salt. In VMS it's the username of the account the password controls access to.
real talk: VMS usernames and passwords are constrained in character set and length, and they're case-insensitive. This function does not enforce those restrictions, nor does it perform canonicalisation. If you want restrictions and canonicalisation, you have to apply them separately, yourself, with your own two hands. The functions vms_username and vms_password described below may be useful for exactly that. 🫡

🦋 vms_username(USERNAME) 🦋

Checks whether the USERNAME string matches VMS username syntax, and canonicalises it. VMS username syntax is 1 to 31 characters from case-insensitive alphanumerics, "_", and "$". If the string has correct username syntax then the username is returned in canonical form (uppercase ✨). If the string is not a username then undef is returned. sorry babe, no username for you. 💀

🍓 vms_password(PASSWORD) 🍓

Checks whether the PASSWORD string is an acceptable VMS password, and canonicalises it. VMS password syntax is 1 to 32 characters from case-insensitive alphanumerics, "_", and "$". If the string is an acceptable password then the password is returned in canonical form (uppercase ✨). If the string is not an acceptable password then undef is returned. vibe check: failed. 🙈

👀 SEE ALSO 👀

  • VMS::User

go read that one too, bestie, it's right there. 💜

🫶 AUTHOR 🫶

The original C implementation of LGI$HPWD was written by Shawn Clifford. The code has since been developed by Davide Casale, Mario Ambrogetti, Terence Lee, Jean-loup Gailly, Solar Designer, and Andrew Main (Zefram). a whole collaborative slay. 🔥

Mike McCauley <mikem@open.com.au> created the first version of Authen::DecHpwd, establishing the Perl interface. That one was based on Shawn Clifford's code, without the later developments.

Andrew Main (Zefram) <zefram@fysh.org> created a new Authen::DecHpwd based on the more developed C code presently used, and added the ancillary functions. 🎀

Copyright (C) 2002 Jean-loup Gailly <http://gailly.net>

Based in part on code from John the Ripper, Copyright (C) 1996-2002 Solar Designer

Copyright (C) 2006, 2007, 2009, 2010, 2011, 2017 Andrew Main (Zefram) <zefram@fysh.org>

🧚 LICENSE 🧚

This module is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. 💖

and that's the whole page, bestie!! this one's from perl v5.42.3, dated 2026-08-20, in the Authen::DecHpwd(3pm) manual. go hash something responsibly, mwah 💅✨🎀

📦 where this page comes from