Re: Todo for release?

[Solar Designer <solar@openwall.com>]

On Mon, Aug 13, 2012 at 05:53:44PM -0400, Rich Felker wrote:
> On Mon, Aug 13, 2012 at 11:31:54PM +0200, Szabolcs Nagy wrote:
> > md5 based crypt is not recommended anymore
> > http://phk.freebsd.dk/sagas/md5crypt_eol.html
> 
> Indeed. But is it used in existing Linux user databases on any
> significant scale?

It is.

> If not, I agree we can just drop it.

We should support it.

Maybe use my MD5 code, but for md5crypt write new code to avoid the
beerware license (I would be happy to buy phk a beer, but having to
mention another license for a component in musl's license is not nice).

> I'm confused by all the SHA names (1/2/256/512)...

You need sha512crypt and sha256crypt.  SHA-1 is irrelevant (not used in
any common crypt(3) flavor).  SHA-2 is a common name for the
SHA-224/256/384/512 primitives (although these are actually different).

Of sha512crypt and sha256crypt, only the former is commonly used, but
you may choose to support both anyway (systems generally support both).

The high-level structure of md5crypt, sha512crypt, and sha256crypt is
similar, but it'd be tricky/unreasonable to exploit that for reduced
code size as you'd likely increase source code complexity and make the
code slower (important in case of sha512crypt and sha256crypt, which
support variable iteration counts).

Alexander