Question

I have an ugly server issue, and i’m trying not to overlook any details on this.

My virtual email users’ passwords are stored with MySQL’s ENCRYPT function. My basic idea was I’ll dump my virtual users’ table from the old machine, then import it in the new one.

Just for double-check I tried to store a string with ENCRYPT then again, and the stored data was different. Does this mean I can’t export/import my users simply as I thought?

Answer 1

What Datajam has already described is correct. Here’s some further explanation.

If you don’t supply a salt to the ENCRYPT() function then a random one will be generated and used to encrypt the string. The salt is just two bytes/characters.

First I’ll demonstrate that if I run ENCRYPT() twice with the same string it’ll give different values (because the random salt differs)

mysql> SELECT ENCRYPT('hello');
+------------------+
| ENCRYPT('hello') |
+------------------+
| 5Q5CiJWj4GItY    | 
+------------------+
1 row in set (0.02 sec)

mysql> SELECT ENCRYPT('hello');
+------------------+
| ENCRYPT('hello') |
+------------------+
| 7QHPY3iSLVdas    | 
+------------------+
1 row in set (0.00 sec)

Now if I use the last entry and attempt to ENCRYPT() again using the value we have already as the salt we’ll get the same result back:

mysql> SELECT ENCRYPT('hello', '7QHPY3iSLVdas');
+-----------------------------------+
| ENCRYPT('hello', '7QHPY3iSLVdas') |
+-----------------------------------+
| 7QHPY3iSLVdas                     | 
+-----------------------------------+
1 row in set (0.00 sec)

Just to prove that if we get the string (password) wrong with the same salt we’ll get a different value. Note that in this example the two first characters (which are just the salt) remain the same.

mysql> SELECT ENCRYPT('helloX', '7QHPY3iSLVdas');
+------------------------------------+
| ENCRYPT('helloX', '7QHPY3iSLVdas') |
+------------------------------------+
| 7QKDSis4DZnCU                      | 
+------------------------------------+
1 row in set (0.01 sec)

Using this information you should try to run the ENCRYPT() function both of the MySQL servers specifying the same salt with both you should get the same result back. If not then the implementation of crypt() likely varies between the two.