Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Jun 2013 00:05:14 +0400
From: Alexander Cherepanov <cherepan@...me.ru>
To: oss-security@...ts.openwall.com
CC: john-users@...ts.openwall.com
Subject: Re: CVE request: WordPress 3.5.1 denial of service
 vulnerability

On 2013-06-12 17:11, Solar Designer wrote:
> Arguably, library code should reject the most insane parameter values.
> For example, musl libc - http://www.musl-libc.org - version 0.9.10
> rejects bcrypt's log2(cost)>  19 and limits SHA-crypt's rounds count
> to<  10M for this reason (original SHA-crypt limits to<  1 billion).

On a related note: shouldn't John the Ripper also reject hashes with 
insane run-time or memory cost parameters?

-- 
Alexander Cherepanov

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.