yescrypt - Re: yescrypt && mmap(,,,,MAP

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZfvQsmqC4iT36bJp@pureos>
Date: Thu, 21 Mar 2024 07:16:18 +0100
From: Matthias Apitz <guru@...xarea.de>
To: yescrypt@...ts.openwall.com
Subject: Re: yescrypt && mmap(,,,,MAP_HUGETLB) && oom-kill

El día miércoles, marzo 20, 2024 a las 04:48:11 +0100, Solar Designer escribió:

> ...
> 
> The amount of memory needed to compute a hash is a consequence of the
> yescrypt settings encoded along with the hash.  So you can't change it
> for the hashes you already have (except at the moment when you also have
> the plaintext password and can re-hash, such as right upon a user's
> successful log in).
> 
> For newly set passwords, I guess you probably configure it via
> libxcrypt's crypt_gensalt*() function, where for yescrypt the "count"
> parameter is in the range of 1 to 11.  The value 11 results in 1 GiB
> memory usage like you observe.  It also provides the maximum (out of the
> options available via that API) defense against offline attacks, so it's
> not wasted memory, but it is a cost.
> 
> If you can afford 11 on your production servers and with actual and
> anticipated login attempt rate, you may want to continue using it.  If
> you can't afford that, you may choose a value in the range of 5 to 10.
> These use a base-2 logarithmic scale, so e.g. 5 corresponds to 16 MiB.
> 
> Some of this is described in "man 5 crypt" and "man crypt_gensalt" on a
> system with libxcrypt fully installed (the libxcrypt-devel subpackage on
> Red Hat'ish systems, hopefully similar on yours).

Hello Alexander,

We know this parameter and even while creating hashes, we allow to set it
from the server environment:

...
  /* allow external setting of the CPU time cost parameter */
  char *env = getenv("YESCRYPT_CPU_TIME_COST_PARAMETER");
  if (env != NULL)  {
    count = atol(env);
    if (count < 1)
      count = 1;
    if (count > 11)
      count = 11;
  }
  ...

but the name of the env var says YESCRYPT_CPU_TIME_COST_PARAMETER
i.e. CPU time cost, because the man page of crypt_gensalt(3) says
     ...
     count
     controls the CPU time cost of the hash; the valid range for count and the
     exact meaning of “CPU time cost” depends on the hashing method, but
     larger numbers correspond to more costly hashes.
     ...

I'd count this as a documentation bug :-(

I did a short test:

$ export YESCRYPT_CPU_TIME_COST_PARAMETER=5
$ printf bla | strace -o tr yescrypt4IDS
$y$j9T$nhRCrh83AdnfrJHQZLd7E/$BT4bww9LX.5y9K.RaVfPhL622dX9lmm4ZaS5Kgudzw0

$ grep mmap tr
...
mmap(NULL, 16801856, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7181802000

i.e. with count=5 crypt(3) only mmaps 16 MByte. Nice. So we have a
solution for new hashing (when we yescrypt the old existing DES hashes
without knowing the clear PIN) and could also re-hash when the patron
enters the clear text PIN.

Thanks for your help.

	matthias

-- 
Matthias Apitz, ✉ guru@...xarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.