yescrypt - Improving security of old DES hashes with fixed salt with "yescrypt"

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221028142531.GC9@sh4-5.1blu.de>
Date: Fri, 28 Oct 2022 16:25:31 +0200
From: Matthias Apitz <guru@...xarea.de>
To: yescrypt@...ts.openwall.com
Subject: Improving security of old DES hashes with fixed salt with "yescrypt"

Hello,

We run large databases wherein the user credentials of many thousands of
users are crypt'ed with DES (Unix crypt(3) with fixed salt). To improve
the security we implemented a hint "why not just re-encrypt the existing
DES hash with yescrypt". This works fine in all our C-written
application servers.

I have implemented this now in all our C-written application
servers. The clear "PIN" is hashed by:

   hash = MakeCryptYescrypt(MakeCryptDes(PIN), NULL);

and the hash is stored in the database row for the user.

The check if the "PIN" is correct entered is made later on login with
something like this:

   if (strcmp(hash, MakeCryptYescrypt(MakeCryptDes(PIN), hash)) == 0) {
      /* PIN is good */
   }   

This is all fine now.

The last problem to solve is, that also some Java-written application is
doing the same encryption and checks and I can't find any Java
implementation of yescrypt. Before writing a NIF to a C-function, I
wanted to ask the experts.

Thanks in advance

	matthias

-- 
Matthias Apitz, ✉ guru@...xarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.