1

Situation in perl

$password = 'admin';
$newchal = 'hnfdfhj238478wdehf';

$password2 = unpack "H32", ($password ^ $newchal);

this is very important becuase i'm sending this password to a radius server that needs the right encoding.. This method above is from a standard script.

now in PHP i tried: 

$password2 = unpack("H32", $password.''.$newchal);

I compared the outcoming but it's different.. I can't figure out what the '^' means in perl. Can anyone help me out?

Flimzy
  • 60,850
  • 13
  • 104
  • 147
Tycho
  • 31
  • 5
  • possible duplicate of [Reference - What does this symbol mean in PHP?](http://stackoverflow.com/questions/3737139/reference-what-does-this-symbol-mean-in-php) – John Conde Sep 24 '13 at 13:49

1 Answers1

2

The ^ is the bitwise XOR (exclusive-or) operator in C-derived languages, including Perl and PHP.

For further information, read the docs for PHP and Perl.

A XOR operation is true when exactly one of both operands is true. The truth table is

0 ^ 0 == 0
0 ^ 1 == 1
1 ^ 0 == 1
1 ^ 1 == 0

When the bitwise XOR is used on strings, then each bit of the binary representation is XORed together.

E.g. a is ASCII 0x61, and h is ASCII 0x68. XORed together, they produce a tab:

a  (61): 01100001
h  (68): 01101000
\t (09): 00001001

Bitwise XORs are sometimes used for reversible “encryption”, but this trick is widely known, and quite unsafe. E.g. in your example, passwords with a greater length then the key are not fully XORed, so parts of the plaintext stay visible. If the same key is shared for multiple passwords, cracking is extremely cheap. Such “encryptions” are also highly vulnerable to e.g. plaintext attacks. To store passwords, more sophisticated hashing algorithms should be used. There are special password hashing algorithms like bcrypt or PBKDF2.

amon
  • 54,982
  • 2
  • 82
  • 143
  • Thanks for the help. But the solution was changing the H32 to H* in PHP – Tycho Sep 24 '13 at 14:19
  • @Tycho: that can't be the whole solution to your examples. `$password ^ $newchal` is very different to `$password.''.$newchal` in PHP _AND_ in Perl – cypherabe Sep 24 '13 at 15:13