[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20261112144349.GO26138@brightrain.aerifal.cx>
Date: Thu, 12 Nov 2026 09:43:49 -0500
From: Rich Felker <dalias@...c.org>
To: Alejandro Colomar <alx+linux-man@...nel.org>
Cc: Vincent Lefevre <vincent@...c17.net>,
Alejandro Colomar <alx@...nel.org>, linux-man@...r.kernel.org,
libc-alpha@...rceware.org, Walter Harms <wharms@....de>,
~hallyn/shadow@...ts.sr.ht, musl@...ts.openwall.com
Subject: Re: Re: [PATCH v1] man/man3/crypt.3: These functions accept
many algorithms, not only DES
On Thu, Nov 12, 2026 at 03:07:14PM +0100, Alejandro Colomar wrote:
> Hi Rich,
>
> > Date: 2026-11-12 08:55:01-0500
> > From: Rich Felker <dalias@...c.org>
> >
> > On Thu, Nov 12, 2026 at 02:45:16PM +0100, Vincent Lefevre wrote:
> > > On 2026-11-12 14:23:08 +0100, Alejandro Colomar wrote:
> > > > Hmm, yeah, I didn't intend to say POSIX is bad; I just wanted to let
> > > > people know that POSIX is irrelevant about crypt(3) these days (as Rich
> > > > said). Perhaps:
> > > >
> > > > The POSIX specification is significantly outdated,
> > > > and all systems extend it significantly.
> > > >
> > > > What do you think?
> > >
> > > OK for me.
> >
> > It's not "outdated". It just does not mandate particular algorithms
> > but leaves these choices up to the implementation. As usual the scope
> > of POSIX is what applications need to know to interface with the
> > system, not administrative policy. This is why POSIX doesn't define
> > things like mount, how init works, etc. either. They are in the scope
> > of things that applications generally don't have to care about; only
> > system components do.
>
> But is the POSIX specification really useful for applications?
Yes. It tells you enough to validate a password for authentication
purposes:
const char *result = crypt(password, hash);
if (result && strcmp(result, hash)==0) {
/* password validated */
}
> An application is probably not interested in knowing that it shall
> pass two characters as the salt from the set './[A-Za-z]'.
Yes, it's less useful to know that, unless you don't care about hash
strength or portability to other systems. In that case you can use it
to make hashes.
> An application should not rely on the specified return value either.
It can rely on it for validating passwords against existing hashes.
That is the more usual application need. Setting new passwords is
usually an administrative task, except for non-system uses like making
.htaccess files.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
