Date: Thu, 20 Jan 2011 02:02:36 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: Plain Text/No-op Password Format On Wed, Jan 19, 2011 at 03:40:44PM -0700, RB wrote: > On Wed, Jan 19, 2011 at 15:23, Solar Designer <solar@...nwall.com> wrote: > > 3. "$plain$" followed by plaintext password with any colons escaped as > > "\c" and any backslashes escaped as "\\". Maybe also support "\n" and > > "\r" escapes for LF/CR chars embedded in passwords. > > My vote would sit here, simply because escapes can be > processed/generated with simple, common tools like sed. Thanks. Actually, hex-encoding is as easy to generate with a Perl one-liner (OK, not with sed). When you process/generate backslash escapes with sed, it may be too easy to inadvertently get this wrong because the shell and sed also use backslash as an escape character. I forgot another option: 4. URL-like %-encoding. That is, always encode chars that need encoding (only the percent and the colon characters), but optionally encode any other characters as well. Maybe this brings us the best of both worlds because it lets us use either the substitution approach (just substitute the two "bad" characters) or the encode-all approach. It also allows for embedded and encoded linefeeds and terminal control characters. The prefix could be "$plain$" or maybe "$percent$" or even "$%$". Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.