[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANY-Wm-rsh-Ee5pRatEx7Aty1NuzfH225TseADnFfO9Gk_DDfg@mail.gmail.com>
Date: Fri, 20 Jan 2012 12:52:26 -0700
From: "Samuel J. Greear" <sjg@...sjg.com>
To: Solar Designer <solar@...nwall.com>
Cc: dillon@...llo.backplane.com, Nolan Lum <nol888@...il.com>,
security@...gonflybsd.org, oss-security@...ts.openwall.com,
magnum <john.magnum@...hmail.com>
Subject: Re: weird crypt-sha* in DragonFly BSD
>
> 2. Instead of:
>>
>> + * The deprecated sha256/512 functions are somehow sensitive to the
>> + * order of this crypt_types array as well as their respective "name"
>> members.
>> + *
>> + * In order to ensure that both existing passwords will continue to work
>> and
>> + * that new passwords will be more secure by using the new algorithms
>> even
>> + * without updating the existing login.conf, this array is now scanned
>> + * backwards. This could be reverted in the future when the deprecated
>> SHA
>> + * functionality is removed.
>>
>> how about using the more reliable approach proposed by magnum here? -
>>
>> http://www.openwall.com/lists/john-dev/2012/01/19/1
>>
>> As you can see, he has even spent time to identify the specific 64-bit
>> magic values. Of course, you'll need to double-check them (such as by
>> applying the patch and testing logins to existing accounts with both
>> sha256 and sha512 on a 64-bit DragonFly system.)
>>
>>
> There isn't a collision issue with $3$ and $4$ on DragonFly, so I don't
> see any obvious need. I intend to rip the old code out after a few
> releases, so the issue (if there is one) will be (relatively) short lived.
>
>
We just realized that we obviously need to do this.
Thanks again,
Sam
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
