[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20261107165442.GG23438@brightrain.aerifal.cx>
Date: Sat, 7 Nov 2026 11:54:42 -0500
From: Rich Felker <dalias@...c.org>
To: Seo Suchan <tjtncks@...il.com>
Cc: musl@...ts.openwall.com
Subject: Re: OpenSSH password auth bypass analysis [was: Re:
Advisory for OpenSSH+musl users]
On Sun, Nov 08, 2026 at 01:08:57AM +0900, Seo Suchan wrote:
> I may missing something obvious but why we need max password size
> when caller already allocated memory for full password? After first
> pass it'd be fixed 256/512bits and we hash megabytes of files in
> second even in embedded.
Because the sha256/512-based password 'hashes' (KDFs) are gratuitously
O(n²) in password length, and this can't be fixed without redefining
them incompatibily (which would be useless; you'd just drop them and
use bcrypt then).
Callers generally don't know (and can't be expected to know) that the
KDF in use will take forever with a ridiculously long password
submitted by the party trying to log in (who may be malicious; they
haven't been authenticated yet).
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
