From: "Steve Ramage" <mailinglistsspammedme@sjrx.net>
To: "musl@lists.openwall.com" <musl@lists.openwall.com>
Subject: [musl] Bcrypt workfactor issue (possibly a bug)
Date: Thu, 28 Jan 2021 19:18:46 +0000 [thread overview]
Message-ID: <kcis.9B02C0FF28CD4D5ABCE426E167A03DB0@cantor> (raw)
Hello,
I noticed some odd behavior in PHP where the manual page for crypt states that BCRYPT can support a password cost in the range of 04-31 (https://www.php.net/manual/en/function.crypt.php). While performing some benchmarks of times, I noticed that afte 19 it stopped working.
Some further investigation found that this issue only affects PHP on alpine, using other images based on debian don't have this issue.
I noticed looking at the code (http://git.musl-libc.org/cgit/musl/tree/src/crypt/crypt_blowfish.c#n619), that it seems as though if the cost function is greater than 19, we just return null (line 624 and 625). I can't find anything authoritative but Wikipedia and StackOverflow suggest that most implementations support up to 31. I thought I would report the issue here first to see if a patch would be forth coming, and if not maybe file a bug either with alpine or php or something.
I created a small test case down below (although the last time I did any C was in uni a decade ago, so this might be way off base), that seems on Arch Linux to produce the same behavior, if you change the cost to 19 it works:
cat ./hello.c
#include <stdio.h>
#include <crypt.h>
int main(int argc, char **argv)
{
printf("%s \n", crypt("hello", "$2a$20$usesomesillystringforsalt$"));
}
$ musl-gcc -static -Os hello.c && time ./a.out
*
real 0m0.001s
user 0m0.000s
sys 0m0.000s
$ gcc -lcrypt hello.c && time ./a.out
$2a$20$usesomesillystringforebNr.S22nOsYT4o1Xr6XIOzsYhqGmdmS
real 0m59.021s
user 0m58.413s
sys 0m0.178s
Cheers,
Steve Ramage
reply other threads:[~2021-01-28 19:26 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=kcis.9B02C0FF28CD4D5ABCE426E167A03DB0@cantor \
--to=mailinglistsspammedme@sjrx.net \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).