MD4 Hash

[D.Cook]

Any suggestions on how to do an MD4 hash in Progress (platform-independent preferably)?

I'm trying to implement NTLMv2 authentication...

 

[Rob Fitzpatrick]

I assume you mean MD5? If this is an NTLM2 implementation, are you looking for a keyed hash? Search the OpenEdge help for the MD5-DIGEST function. Or if you're using OE 11.0 you can use the new MESSAGE-DIGEST function.

Message digests in OpenEdge 10.2B
Message digests in OpenEdge 11.0

 

[D.Cook]

Thanks Rob, didn't realise MD5 was available in OE now.
Unfortunately it is actually MD4 which is used in NTLMv2..

 

[Rob Fitzpatrick]

Sorry, I was going by Wikipedia, which says NTLMv2 uses MD5. There is no native MD4 implementation in ABL; you're stuck with MD5, SHA1 and Progress' own ENCODE function. You could roll your own function I suppose, but I think that's a lot more trouble than it's worth and at that point you need a general purpose language rather than a business language so ABL isn't really your best bet. Of course, another option is to use an OS crypto library that does have MD4 functions and declare them as external procedures.

 

[D.Cook]

Yeah I thought about rolling my own, and came to the same conclusion. As fun as it would be

I see you're right, however the part that I need to do (because the rest is handled by a third party library) is provide what's labelled on that page as an "NT Hash" of the user's password, which is the password converted to UTF16LE then hashed using MD4.

I guess an OS library is the best option. The windows CryptoAPI functions seem to be what I'm after, but on *nix platforms I'm not so sure where to start, and they're my main target platforms.

Oh well, I guess I'll settle for sending the plain-text password to a PHP script which can easily create the "NT Hash".

 

[Rob Fitzpatrick]

I believe there are crypto shared libraries you can leverage on *nix boxes in a similar way. Tom Bascom did a conference presentation on the subject of shared libraries a while back, I'll see if I can dig up a link. (Or maybe he'll just respond directly. )

 

[TomBascom]

You are looking for this: http://dbappraise.com/ppt/shlib.pptx

 

[D.Cook]

Thanks guys, have tried searching for details about the libcrypt shared library or any shared library with an MD4 implementation and am not having much luck. I'm really not sure what for or where to look..

 

[Rob Fitzpatrick]

When I google "libcrypto md4" I get a bunch of hits for NetBSD. Is there source available there that you can use?