[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <Z/U2M8GJmMMpjY06@pureos>
Date: Tue, 8 Apr 2025 16:44:03 +0200
From: Matthias Apitz <guru@...xarea.de>
To: yescrypt@...ts.openwall.com
Subject: using a hash pointer returned from crypt(3) for yescrypt
Hello,
I have some code in a server where a pointer returned from crypt(3)
when hashing for yesxrypt is reused later to check the provided
cerdential again. It took me some time and simplifying the problem with
the attached err.c code:
gcc -g err.c -lcrypt
./a.out
errno: 0 salt: $y$j7T$aZbanWIcin9oniT0yKzE01
errno: 0 hash: $y$j7T$aZbanWIcin9oniT0yKzE01$lhscqOW7ITD5.jvYyXHpm8UmZXKOLyncoENctU5SnV4
errno: 22 nhash: *1
errno: 0 nhash: $y$j7T$aZbanWIcin9oniT0yKzE01$lhscqOW7ITD5.jvYyXHpm8UmZXKOLyncoENctU5SnV4
xxxx match
The code in question is:
...
salt = crypt_gensalt(prefix, count, NULL, 0);
printf("errno: %d salt: %s\n", errno, salt);
strcpy(password, "xxxx");
hash = crypt(password, salt);
printf("errno: %d hash: %s\n", errno, hash);
strcpy(savedhash, hash);
nhash = crypt(password, hash);
printf("errno: %d nhash: %s\n", errno, nhash);
printf("%s %s\n", password, strcmp(hash, nhash) == 0 ? "match" : "nomatch");
...
The second call to crypt(3) using directly the pointer 'hash' returned by the
firts call, fails, while using a strcpy of the static area inside
libcrypt.so works fine. I know from the man page of crypt(3) that:
...
crypt places its result in a static storage area, which will be overwrit-
ten by subsequent calls to crypt. It is not safe to call crypt from mul-
tiple threads simultaneously.
...
but I though that this static storage area will be overwritten at the
end of 'crypt(password, hash);' and not invalidated at the beginning.
Maybe the man page could be improved with:
...
It's also not safe to use the pointer returned as an argument for
another call to crypt(3).
Thanks
matthias
--
Matthias Apitz, ✉ guru@...xarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
View attachment "err.c" of type "text/x-csrc" (894 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
