From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/1650 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Help-wanted tasks for musl Date: Sun, 19 Aug 2012 20:51:28 -0400 Message-ID: <20120820005128.GB27715@brightrain.aerifal.cx> References: <20120819042611.GA8731@brightrain.aerifal.cx> <20120819114914.GD16602@port70.net> <20120819165652.GE16602@port70.net> <20120819172921.GF16602@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1345423810 1426 80.91.229.3 (20 Aug 2012 00:50:10 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 20 Aug 2012 00:50:10 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-1651-gllmg-musl=m.gmane.org@lists.openwall.com Mon Aug 20 02:50:10 2012 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1T3GC1-0006TM-Tr for gllmg-musl@plane.gmane.org; Mon, 20 Aug 2012 02:50:10 +0200 Original-Received: (qmail 17950 invoked by uid 550); 20 Aug 2012 00:50:08 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 17942 invoked from network); 20 Aug 2012 00:50:08 -0000 Content-Disposition: inline In-Reply-To: <20120819172921.GF16602@port70.net> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:1650 Archived-At: On Sun, Aug 19, 2012 at 07:29:21PM +0200, Szabolcs Nagy wrote: > * Szabolcs Nagy [2012-08-19 18:56:52 +0200]: > > 3)* reference implementation and glibc accepts negative > > rounds in an implementation defined way, ie. > > > > '$5$rounds=-4294965296$' is treated as > > '$5$rounds=2000$' on a 32bit system and as > > '$5$rounds=999999999$' on a 64bit one > > > > (according to spec N is clamped into 1000...999999999 > > so the correct treatment would be '$5$rounds=1000$') > > > > i was wrong here about the correct treatment > > the spec says that N is an unsigned decimal so negative > numbers must not be recognized at all > (so in this case the default rounds should be used and > 'rounds=-4294965296' should be treated as salt) > > but i guess the spec does not matter much in this case, > either we should be bug compatible with glibc or reject > such salts The characters '=', '-', and '$' are not valid in salt, are they? My preference would be to reject anything that looks like a setting but actually gets treated as salt, rather than hashing it in some implementation-specific way that leads to buggy, non-portable password hashes. Rich