Convert passwords from htpasswd to htdigest

Question

On the server, I like to switch from Apache auth_basic to auth_digest for security reasons.

Is there a way to convert the old htdigest file to htdigest format?

Answer 1

htpasswd usually creates encrypted passwords. If you used MD5 , SHA1 , bcrypt or crypt to encrypt passwords, you can hardly restore the original data. These cryptographic functions are called one-way: you can create a hash, but you cannot restore the original value. Its main purpose is one-way functions.

As I know, the so-called area is introduced in the HTTP Digest RFC2617 algorithm, some kind of [unique] line to call. This information is used to hash passwords. It is not possible to reuse a password file because for basic authentication these passwords were hashed without realm information.

Try asking your users to change their passwords after the first authentication.