mailing list of musl libc
 help / color / mirror / Atom feed
* [musl] Bcrypt workfactor issue (possibly a bug)
@ 2021-01-28 19:18 Steve Ramage
  0 siblings, 0 replies; only message in thread
From: Steve Ramage @ 2021-01-28 19:18 UTC (permalink / raw)
  To: musl

Hello, 

I noticed some odd behavior in PHP where the manual page for crypt states that BCRYPT can support a password cost in the range of 04-31 (https://www.php.net/manual/en/function.crypt.php). While performing some benchmarks of times, I noticed that afte 19 it stopped working. 

Some further investigation found that this issue only affects PHP on alpine, using other images based on debian don't have this issue.

I noticed looking at the code (http://git.musl-libc.org/cgit/musl/tree/src/crypt/crypt_blowfish.c#n619), that it seems as though if the cost function is greater than 19, we just return null (line 624 and 625). I can't find anything authoritative but Wikipedia and StackOverflow suggest that most implementations support up to 31.  I thought I would report the issue here first to see if a patch would be forth coming, and if not maybe file a bug either with alpine or php or something.

I created a small test case down below (although the last time I did any C was in uni a decade ago, so this might be way off base), that seems on Arch Linux to produce the same behavior, if you change the cost to 19 it works:

cat ./hello.c 
#include <stdio.h>
#include <crypt.h>

int main(int argc, char **argv) 
{ 
        printf("%s \n", crypt("hello", "$2a$20$usesomesillystringforsalt$"));
}
$ musl-gcc -static -Os hello.c  && time ./a.out 
* 

real    0m0.001s
user    0m0.000s
sys     0m0.000s

$ gcc -lcrypt hello.c && time ./a.out 
$2a$20$usesomesillystringforebNr.S22nOsYT4o1Xr6XIOzsYhqGmdmS 

real    0m59.021s
user    0m58.413s
sys     0m0.178s

Cheers,

Steve Ramage


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2021-01-28 19:26 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-28 19:18 [musl] Bcrypt workfactor issue (possibly a bug) Steve Ramage

mailing list of musl libc

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.vuxu.org/musl

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V1 musl musl/ http://inbox.vuxu.org/musl \
		musl@inbox.vuxu.org
	public-inbox-index musl

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.musl


code repositories for the project(s) associated with this inbox:

	https://git.vuxu.org/mirror/musl/

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git