[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Jun 2013 00:05:14 +0400
From: Alexander Cherepanov <cherepan@...me.ru>
To: oss-security@...ts.openwall.com
CC: john-users@...ts.openwall.com
Subject: Re: [oss-security] CVE request: WordPress 3.5.1 denial of service
vulnerability
On 2013-06-12 17:11, Solar Designer wrote:
> Arguably, library code should reject the most insane parameter values.
> For example, musl libc - http://www.musl-libc.org - version 0.9.10
> rejects bcrypt's log2(cost)> 19 and limits SHA-crypt's rounds count
> to< 10M for this reason (original SHA-crypt limits to< 1 billion).
On a related note: shouldn't John the Ripper also reject hashes with
insane run-time or memory cost parameters?
--
Alexander Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
