Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 20 Aug 2012 03:35:02 +0200
From: Szabolcs Nagy <>
Subject: Re: Help-wanted tasks for musl

* Rich Felker <> [2012-08-19 20:51:28 -0400]:
> The characters '=', '-', and '$' are not valid in salt, are they?
> My preference would be to reject anything that looks like a setting
> but actually gets treated as salt, rather than hashing it in some
> implementation-specific way that leads to buggy, non-portable password
> hashes.

it's not clear what the acceptable characters are..
originally the [a-zA-Z0-9./] is the base64 set used

but the implementations tend to accept anything for salt
(it will go through some hash or encryption function
anyway, the only exception is '$' which is a separator
around the salt and maybe the characters used by the
passwd file format)

otherwise i'd rather be more strict with the input than
deal with weird corner cases, but i don't know what are
the practices (ie rejecting '=' or '-' is reasonable or not)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.