[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aviHNTRD7-kkK8fB@metallschleim.local>
Date: Sat, 14 Nov 2026 17:07:17 +0100
From: Alexander Strasser <eclipse7@....net>
To: musl@...ts.openwall.com
Subject: Re: [PATCH] [RFC] Harden against misuse of crypt
Hi Rich!
On 2026-11-06 16:54 -0500, Rich Felker wrote:
> This patch changes crypt to return "*0" instead of "*" as the "failure
> token" that will not match any password.
>
> Likewise, "*1" is used in place of "x" if the failure token would be
> identical to the input salt, but this case is presently unreachable.
> Since the existing DES path interprets characters outside the portable
> range as valid DES salt, passing a setting of "*0" will not produce
> "*1" but instead a DES-hashed password with "*0" as the salt. I don't
> see any problem with this -- "*0" should never appear in the
> passwd/shadow db anyway, and if it somehow did, crypt(pass,"*0") would
> still return something not-equal to "*0": "*0" followed by 11
> characters of DES hash.
A bit of mixed feelings about the prefix still matchting the
failure token. Your other patch[1] would prevent this from happening,
or am I just confused?
> In any case, I put the "*1" code path in there in case anything ever
> changes with how we handle DES, to be sure crypt(pass,"*0") can never
> return "*0".
I think the changes bring the behaviour more in line with how other
crypt implementations handle failure conditions.
I have checked your changes against the musl sources and they seem
correct and complete, but I think some amount of run-time tests
should be done to confirm there are no surprises.
Best regards,
Alexander
1. Subject: [PATCH] crypt: drop support for non-strict des salts in new hashes
> diff --git a/src/crypt/crypt_blowfish.c b/src/crypt/crypt_blowfish.c
> index d722607b..0bb82360 100644
> --- a/src/crypt/crypt_blowfish.c
> +++ b/src/crypt/crypt_blowfish.c
> @@ -802,5 +802,5 @@ char *__crypt_blowfish(const char *key, const char *setting, char *output)
> if (ok && retval)
> return retval;
>
> - return "*";
> + return "*0";
> }
> diff --git a/src/crypt/crypt_des.c b/src/crypt/crypt_des.c
> index 338a8f37..38e63395 100644
> --- a/src/crypt/crypt_des.c
> +++ b/src/crypt/crypt_des.c
> @@ -1012,5 +1012,5 @@ char *__crypt_des(const char *key, const char *setting, char *output)
> if (p && !strcmp(p, test_hash) && retval)
> return retval;
>
> - return (setting[0]=='*') ? "x" : "*";
> + return (setting[0]!='*' || setting[1]!='0') ? "*0" : "*1";
> }
> diff --git a/src/crypt/crypt_md5.c b/src/crypt/crypt_md5.c
> index 6e75b36c..e8c609f1 100644
> --- a/src/crypt/crypt_md5.c
> +++ b/src/crypt/crypt_md5.c
> @@ -4,7 +4,7 @@
> * original md5 crypt design is from Poul-Henning Kamp
> * this implementation was created based on the code in freebsd
> * at least 32bit int is assumed, key is limited and $1$ prefix is mandatory,
> - * on error "*" is returned
> + * on error "*0" is returned
> */
> #include <string.h>
> #include <stdint.h>
> @@ -280,6 +280,6 @@ char *__crypt_md5(const char *key, const char *setting, char *output)
> /* self test and stack cleanup */
> q = md5crypt(testkey, testsetting, testbuf);
> if (!p || q != testbuf || memcmp(testbuf, testhash, sizeof testhash))
> - return "*";
> + return "*0";
> return p;
> }
> diff --git a/src/crypt/crypt_sha256.c b/src/crypt/crypt_sha256.c
> index e885dc68..8d9c7e73 100644
> --- a/src/crypt/crypt_sha256.c
> +++ b/src/crypt/crypt_sha256.c
> @@ -5,7 +5,7 @@
> * in this implementation at least 32bit int is assumed,
> * key length is limited, the $5$ prefix is mandatory, '\n' and ':' is rejected
> * in the salt and rounds= setting must contain a valid iteration count,
> - * on error "*" is returned.
> + * on error "*0" is returned.
> */
> #include <ctype.h>
> #include <stdlib.h>
> @@ -317,6 +317,6 @@ char *__crypt_sha256(const char *key, const char *setting, char *output)
> /* self test and stack cleanup */
> q = sha256crypt(testkey, testsetting, testbuf);
> if (!p || q != testbuf || memcmp(testbuf, testhash, sizeof testhash))
> - return "*";
> + return "*0";
> return p;
> }
> diff --git a/src/crypt/crypt_sha512.c b/src/crypt/crypt_sha512.c
> index 39970caf..c9973f0e 100644
> --- a/src/crypt/crypt_sha512.c
> +++ b/src/crypt/crypt_sha512.c
> @@ -5,7 +5,7 @@
> * in this implementation at least 32bit int is assumed,
> * key length is limited, the $6$ prefix is mandatory, '\n' and ':' is rejected
> * in the salt and rounds= setting must contain a valid iteration count,
> - * on error "*" is returned.
> + * on error "*0" is returned.
> */
> #include <ctype.h>
> #include <stdlib.h>
> @@ -366,6 +366,6 @@ char *__crypt_sha512(const char *key, const char *setting, char *output)
> /* self test and stack cleanup */
> q = sha512crypt(testkey, testsetting, testbuf);
> if (!p || q != testbuf || memcmp(testbuf, testhash, sizeof testhash))
> - return "*";
> + return "*0";
> return p;
> }
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
