Date: Sun, 19 Aug 2012 21:39:50 -0400 From: Rich Felker <dalias@...ifal.cx> To: musl@...ts.openwall.com Subject: Re: Help-wanted tasks for musl On Mon, Aug 20, 2012 at 03:35:02AM +0200, Szabolcs Nagy wrote: > * Rich Felker <dalias@...ifal.cx> [2012-08-19 20:51:28 -0400]: > > The characters '=', '-', and '$' are not valid in salt, are they? > > My preference would be to reject anything that looks like a setting > > but actually gets treated as salt, rather than hashing it in some > > implementation-specific way that leads to buggy, non-portable password > > hashes. > > > > it's not clear what the acceptable characters are.. > originally the [a-zA-Z0-9./] is the base64 set used In all the other hashes we support, only the used base64 set is allowed. Anything else is treated as a fatal error. Is this wrong? > but the implementations tend to accept anything for salt > (it will go through some hash or encryption function > anyway, the only exception is '$' which is a separator > around the salt and maybe the characters used by the > passwd file format) I agree it would be nicer to just pass the salt through the encryption algorithm as part of the input, but in practice they all decode it as a base64 number and use that number... > otherwise i'd rather be more strict with the input than > deal with weird corner cases, but i don't know what are > the practices (ie rejecting '=' or '-' is reasonable or not) It's what blowfish does, at least. Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.