Date: Mon, 20 Aug 2012 03:35:02 +0200 From: Szabolcs Nagy <nsz@...t70.net> To: musl@...ts.openwall.com Subject: Re: Help-wanted tasks for musl * Rich Felker <dalias@...ifal.cx> [2012-08-19 20:51:28 -0400]: > The characters '=', '-', and '$' are not valid in salt, are they? > My preference would be to reject anything that looks like a setting > but actually gets treated as salt, rather than hashing it in some > implementation-specific way that leads to buggy, non-portable password > hashes. > it's not clear what the acceptable characters are.. originally the [a-zA-Z0-9./] is the base64 set used but the implementations tend to accept anything for salt (it will go through some hash or encryption function anyway, the only exception is '$' which is a separator around the salt and maybe the characters used by the passwd file format) otherwise i'd rather be more strict with the input than deal with weird corner cases, but i don't know what are the practices (ie rejecting '=' or '-' is reasonable or not)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.