Re: [musl] [PATCH] crypt: support $2b$ prefix for blowfish

[Tim van der Staaij <git@tim.vanderstaaij.email>]

Hi,

> Wow, I didn't realize we forgot to get this into musl.

Haha yes, what lead me to submitting this patch was an afternoon of
debugging why my nginx, linked with musl, was rejecting correct
passwords with a bcrypt credential file generated with python-passlib.

I figured it was probably just an oversight and it didn't look too
difficult to fix.

> Your patch looks OK to me at first glance, but it'd benefit from
> existing testing and perhaps it'd help further maintenance to merge my
> upstream changes instead of making slightly different (even if smaller)
> changes specific to musl.

I didn't realize that this code had an upstream, should've paid more
attention to the header! Of course I agree that syncing it with your
version would be a better solution.

> This is really subtle, but I recall deliberately avoiding the "!= 'x'"
> comparison as it's more likely to result in a conditional branch, which
> is an additional side-channel leak about the hash sub-type. We accept
> leaks through data cache access patterns, but we avoided branching on
> hash sub-type so far (let alone on anything truly security-sensitive).

> As I recall, this is why I had to move flags_by_subtype to global scope
> in that source file.

I see. I read about this phenomenon before, but actively recognizing and
avoiding such patterns is still quite a bit out my league.

Tim