[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <avS4ybx_EfRvGsw1@devuan>
Date: Wed, 11 Nov 2026 19:55:01 +0100
From: Alejandro Colomar <alx+linux-man@...nel.org>
To: "Serge E. Hallyn" <serge@...lyn.com>
Cc: Alejandro Colomar <alx@...nel.org>, linux-man@...r.kernel.org,
libc-alpha@...rceware.org, Walter Harms <wharms@....de>, Rich Felker <dalias@...c.org>,
~hallyn/shadow@...ts.sr.ht, musl@...ts.openwall.com
Subject: Re: [PATCH v1] man/man3/crypt.3: These functions accept many
algorithms, not only DES
Hi Serge,
> Date: 2026-11-11 09:05:40-0600
> From: "Serge E. Hallyn" <serge@...lyn.com>
>
[...]
> > - salt is a two‐character string chosen from the set
> > - [a-zA-Z0-9./]. This string is used to perturb the algo‐
> > - rithm in one of 4096 different ways.
> > -
> > - By taking the lowest 7 bits of each of the first eight
> > - characters of the key, a 56‐bit key is obtained. This
> > - 56‐bit key is used to encrypt repeatedly a constant string
> > - (usually a string consisting of all zeros). The returned
> > - value points to the hashed password, a series of 13 print‐
> > - able ASCII characters (the first two characters represent
> > - the salt itself). The return value points to static data
> > - whose content is overwritten by each call.
> > -
> > - Warning: the key space consists of 2**56 equal 7.2e16 pos‐
> > - sible values. Exhaustive searches of this key space are
> > - possible using massively parallel computers. Software,
> > - such as crack(1), is available which will search the por‐
> > - tion of this key space that is generally used by humans
> > - for passwords. Hence, password selection should, at mini‐
> > - mum, avoid common words and names. The use of a passwd(1)
> > - program that checks for crackable passwords during the se‐
> > - lection process is recommended.
> > -
> > - The DES algorithm itself has a few quirks which make the
> > - use of the crypt() interface a very poor choice for any‐
> > - thing other than password authentication. If you are
> > - planning on using the crypt() interface for a cryptography
> > - project, don’t do it: get a good book on encryption and
> > - one of the widely available DES libraries.
> > + salt is a string used for determining the hasing algorithm
>
> typo: hashing
Thanks! Fixed.
> > + (possibly including parameters). It is also used to per‐
> > + turb the algorithm.
BTW, I suspect the salt is not used for perturbing the algorithm
anymore. From musl's source code, at least for SHA-512, I _think_ it's
not reading past the third '$', and thus it's not reading any random-ish
bytes.
Should I drop the second sentence?
Have a lovely night!
Alex
> > +
> > + The returned value points to the hashed password. The re‐
> > + turn value points to static data whose content is over‐
> > + written by each call.
--
<https://www.alejandro-colomar.es>
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
