Date: Mon, 8 Jul 2013 02:22:57 -0400 From: "A.J. Kehoe IV (Nanoman)" <nanoman@nanoman.ca> To: Garance A Drosehn <gad@FreeBSD.org> Cc: FreeBSD-security@FreeBSD.org Subject: Re: Better Password Hashes Message-ID: <20130708062257.GD21309@nanocomputer.nanoman.ca> In-Reply-To: <51D9CAE8.1080902@FreeBSD.org> References: <20130707173622.GA21102@nanocomputer.nanoman.ca> <51D9CAE8.1080902@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Garance A Drosehn wrote: >On 7/7/13 1:36 PM, A.J. Kehoe IV (Nanoman) wrote: >> I commissioned Derek to come up with a solution by either updating >> Steven's patch or by devising a new method. To paraphrase Derek's comments: >> >> -----BEGIN PARAPHRASIS----- >> I did some research into what other *BSDs are doing. OpenBSD and NetBSD >> use the algorithm name, a comma, and then the number of rounds: >> >> http://www.openbsd.org/cgi-bin/man.cgi?query=login.conf&sektion=5 >> >> localcipher=blowfish,6 >> >> http://netbsd.gw.com/cgi-bin/man-cgi?passwd.conf+5+NetBSD-current >> >> localcipher=blowfish,6 >> >> To me, this isn't a good way to do it because we'd need special >> rules to parse this extra field out of the previously unstructured >> data. This parsing would be algorithm dependant. > >To comment only on this point, I do not think it is a significant >issue. If OpenBSD and NetBSD are already doing this, then whatever >parsing issues are already being addressed by users on those OS's. > >I think there is a significant advantage in using something that >they are already using. Now, if they say "Wow, was this a bad >idea!", then obviously I wouldn't want to add it. But if their >security is better with this feature, and if *they* don't have >major regrets with using it, then I think we should consider it. I don't think the method used by OpenBSD and NetBSD is a bad idea, but there are a couple reasons why I prefer Derek's method: 1. Convention. OpenBSD and NetBSD call it "blowfish", whereas FreeBSD calls it "blf", and others call it "bcrypt". Modular Crypt Format, on the other hand, is pretty consistent across various operating systems, languages, et cetera. 2. Implementation. Derek's method would be a relatively minimal change, whereas the other method would be a more invasive change with more things that could go wrong. >I'd certainly want to consider other ideas too. But I don't think >we should cross this idea off the list just because it would be >too much extra effort *if* we were the only OS which used it. I >run both FreeBSD and OpenBSD systems, and for people like me it >will be more effort if different BSD's use incompatible methods >to achieve better password security. You won't be saving me any >effort, you'll only be adding to the effort I already have. > >[admittedly that isn't much effort. :) ] Maybe our OpenBSD and NetBSD colleagues will prefer Derek's idea too? As Derek has demonstrated, it's fairly simple to implement while maintaining compatibility with the existing method. -- A.J. Kehoe IV (Nanoman) | /"\ ASCII Ribbon Campaign Nanoman's Company | \ / - No HTML/RTF in E-mail E-mail: nanoman@nanoman.ca | X - No proprietary attachments WWW: http://www.nanoman.ca/ | / \ - Respect for open standards [-- Attachment #2 --] 0P *H A0=1 0 + 0 *H 0w0_ 40 *H 0y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org0 130311232326Z 130907232326Z0=10UCAcert WoT User1!0 *H nanoman@nanoman.ca0"0 *H 0 VDj @[H}K4٪:CJyckXmi ~F6 x1JoeHQL`w& .PH"w}|oѬݘ2r6ڛ? p .yaw Nc^ʽhNmHo$lsB1hXy XU ş kք))RnZg_Îhc$u^SϏdmoA#k>x;As B0>0 U 0 0V `HB IGTo get your own certificate for FREE head over to http://www.CAcert.org0U 0@U %907++ +7 +7 `HB02+&0$0"+0http://ocsp.cacert.org01U *0(0&$" http://crl.cacert.org/revoke.crl0 U 0nanoman@nanoman.ca0 *H WUb.xK{xΫ0o%;s!;4 0rx=(Q~/ I'_Y{| %:g<D!#!5a V ږ}ўﳝd[\WPO0H%pC@Vf/} *W(rqfB1tAk۫Ad1el9sA6yJ4w?w 7\aX ]| 1 ܈n 5Ux )Id)J HykpF&B f# |$c*w[PJyoyd1eVy04H'# TX ]9K-?I̓2-Jhmˮ(+Rw 7.V @vL@_I[gta2rQ*v{H7Ѽ,d6ivY. *ˎ3]oN2^4E1Ԟ Y3tEħ T 0=0% 0 *H 0y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org0 030330122949Z 330329122949Z0y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org0"0 *H 0 "F}6(P3@K;f?1k6|Nw6A Fs`n~XdͰE cg ҿ>L5]l!ޞ ٺf27rXɎ^> l[df*zKSy{/ a+~MVڒDA X`efD˔B~ ehQ Wkzr%[ 2H.0B%k?:SHҶ4 zX+[8]fɘמtq r`o34v>$z oE8GAJ. Yתғ}h.KX/ꕧTۋQ"þ,x ӊ/?Qe!eE |ALO)!3 u Qw i" Ṕ1{8h[+~_rLK Wʑ u!7c g>FOp gYͺbA )d)B"xC QKZZqs 00 U 2Ұ:90U #02Ұ:9ѡ}{0y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org 0U 002U +0)0'%#!https://www.cacert.org/revoke.crl00 `HB#!https://www.cacert.org/revoke.crl04 `HB'%http://www.cacert.org/index.php?id=100V `HB IGTo get your own certificate for FREE head over to http://www.cacert.org0 *H (\5 ojhX>ÐZ`CpbgX 06;Htq>+h4b@F;S(fSM];`yi;eƁ\MU 7paj|.T>O!܂EMs<evj7$ NmQďʖmC0e';{CCcCh"{Z>7;N˛͚۲p-JذoEH3<2*T#Gdzq c~/ܟ+H%B>Wiw4 Kʠ ƌ27hs_QIS6 Ly:u pg/y= s og/ ${H5)@`ᖆPzY؏! ς;kV#lH<N/ So.t:c¦D l$pG.Բ d$ ܡ5ԼU.}UZ֓v%sLC1\0X00y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org 40 + 0 *H 1 *H 0 *H 1 130708062257Z0# *H 1%T 0֡BGo0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 *H qYq䍤 kH֔V fחM˛XB| 6 Qe@ 2{puĈg%GUq5v4<Gzm ,۠nր#4"2WFvVHEՂQ䜚 @P'A@D!zsbJbN#GqIMͣJ;:brrYBh6ը*J_ *#E S* ܾۑ*d
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130708062257.GD21309>