Re: Help-wanted tasks for musl

[Rich Felker <dalias@aerifal.cx>]

On Mon, Aug 20, 2012 at 03:35:02AM +0200, Szabolcs Nagy wrote:
> * Rich Felker <dalias@aerifal.cx> [2012-08-19 20:51:28 -0400]:
> > The characters '=', '-', and '$' are not valid in salt, are they?
> > My preference would be to reject anything that looks like a setting
> > but actually gets treated as salt, rather than hashing it in some
> > implementation-specific way that leads to buggy, non-portable password
> > hashes.
> > 
> 
> it's not clear what the acceptable characters are..
> originally the [a-zA-Z0-9./] is the base64 set used

In all the other hashes we support, only the used base64 set is
allowed. Anything else is treated as a fatal error. Is this wrong?

> but the implementations tend to accept anything for salt
> (it will go through some hash or encryption function
> anyway, the only exception is '$' which is a separator
> around the salt and maybe the characters used by the
> passwd file format)

I agree it would be nicer to just pass the salt through the encryption
algorithm as part of the input, but in practice they all decode it as
a base64 number and use that number...

> otherwise i'd rather be more strict with the input than
> deal with weird corner cases, but i don't know what are
> the practices (ie rejecting '=' or '-' is reasonable or not)

It's what blowfish does, at least.

Rich