From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/1652 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Help-wanted tasks for musl Date: Sun, 19 Aug 2012 21:39:50 -0400 Message-ID: <20120820013950.GC27715@brightrain.aerifal.cx> References: <20120819042611.GA8731@brightrain.aerifal.cx> <20120819114914.GD16602@port70.net> <20120819165652.GE16602@port70.net> <20120819172921.GF16602@port70.net> <20120820005128.GB27715@brightrain.aerifal.cx> <20120820013502.GG16602@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1345426711 19005 80.91.229.3 (20 Aug 2012 01:38:31 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 20 Aug 2012 01:38:31 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-1653-gllmg-musl=m.gmane.org@lists.openwall.com Mon Aug 20 03:38:32 2012 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1T3Gwp-0006Jr-R3 for gllmg-musl@plane.gmane.org; Mon, 20 Aug 2012 03:38:31 +0200 Original-Received: (qmail 15448 invoked by uid 550); 20 Aug 2012 01:38:30 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 15437 invoked from network); 20 Aug 2012 01:38:30 -0000 Content-Disposition: inline In-Reply-To: <20120820013502.GG16602@port70.net> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:1652 Archived-At: On Mon, Aug 20, 2012 at 03:35:02AM +0200, Szabolcs Nagy wrote: > * Rich Felker [2012-08-19 20:51:28 -0400]: > > The characters '=', '-', and '$' are not valid in salt, are they? > > My preference would be to reject anything that looks like a setting > > but actually gets treated as salt, rather than hashing it in some > > implementation-specific way that leads to buggy, non-portable password > > hashes. > > > > it's not clear what the acceptable characters are.. > originally the [a-zA-Z0-9./] is the base64 set used In all the other hashes we support, only the used base64 set is allowed. Anything else is treated as a fatal error. Is this wrong? > but the implementations tend to accept anything for salt > (it will go through some hash or encryption function > anyway, the only exception is '$' which is a separator > around the salt and maybe the characters used by the > passwd file format) I agree it would be nicer to just pass the salt through the encryption algorithm as part of the input, but in practice they all decode it as a base64 number and use that number... > otherwise i'd rather be more strict with the input than > deal with weird corner cases, but i don't know what are > the practices (ie rejecting '=' or '-' is reasonable or not) It's what blowfish does, at least. Rich