Node.js MD5 generates different result than htpasswd -m

Question

Node.js MD5 generates different result than htpasswd -m

when generating a password file using htpasswd -m -c file admin with the password admin the result looks like this:

cat file  
admin:$apr1$V.aqW878$JCj8ivmSnFp3BnTCtLAuN.

When I try to authenticate against that using node.js the results are rather different:

Digest Hex: 21232f297a57a5a743894a0e4a801fc3

I've tried following this existing StackOverflow solution:

new Buffer('21232f297a57a5a743894a0e4a801fc3').toString('base64');
MjEyMzJmMjk3YTU3YTVhNzQzODk0YTBlNGE4MDFmYzM=

So the result was still wrong.

When I change the digest to base64 the result would be:

ISMvKXpXpadDiUoOSoAfww==

Bottom line of my problem is that I don't get the same hashes and need help. Any advice would be greatly appreciated.

Thank you Roman

node.js

Answer 1

Alright, I found the answer. htpasswd uses a "salt" which is stored in the middle bit of the password string:

$apr1$V.aqW878$JCj8ivmSnFp3BnTCtLAuN.
Salt: V.aqW878

The node-pass module gave me the right clues. See validate_md5. It uses the native openssl command to generate a salted MD5 hash.

In retrospect this makes sense since MD5 isn't safe anymore. That's the reason I didn't use it for years now and got a bit off track here. In essence, anything marked with $apr1$ is to be treated like this.