Re: FreeSec crypt()

[Solar Designer <solar@openwall.com>]

On Wed, Jun 13, 2012 at 08:10:32AM +0200, Szabolcs Nagy wrote:
> static int ascii_to_bin2(int c)
> {
> 	if (c >= 128)
> 		c += -128 + 18;
> 	else if (c >= 97)
> 		c += -97 + 38;
> 	else if (c >= 65)
> 		c += -65 + 12;
> 	else
> 		c += 128 + 18;
> 	return (unsigned)c % 64;
> }

I think we should use a lookup table instead, which would also reduce
the timing leaks we have here.  Salts are not secret (not any more than
the hashes), but they're not supposed to be known to an attacker in
advance (before the hashes are possibly leaked/stolen) and knowing them
(but not yet the hashes) may enable char-by-char timing attacks on
hash encoding comparisons (thereby leaking the hashes after _many_
tries).  This is almost purely theoretical for a number of reasons,
yet if we strive for perfection, we should do the right thing in this
respect as well.

Perhaps the same lookup table should also replace ascii_is_unsafe() by
returning a value outside of the 0 .. 63 range in the unsafe cases.
We'd need to check for such out of range values, then.

Thank you for your comments!

Alexander