Date: Thu, 28 Jan 2010 11:39:41 -0800 From: Chris Palmer <chris@noncombatant.org> To: freebsd-security@freebsd.org, Bill Moran <wmoran@collaborativefusion.com> Subject: Re: PHK's MD5 might not be slow enough anymore Message-ID: <20100128193941.GK892@noncombatant.org> In-Reply-To: <20100128135410.7b6fe154.wmoran@collaborativefusion.com> References: <20100128182413.GI892@noncombatant.org> <20100128135410.7b6fe154.wmoran@collaborativefusion.com>
index | next in thread | previous in thread | raw e-mail
Bill Moran writes: > I'm sure someone will correct me if I'm wrong, but you can't do this > without establishing this as an entirely new algorithm. The hashes > generated after your patch will not be compatible with existing password > files, thus anyone who applies this will be unable to log in. Have you > tried it? Yes, which is why I reset my passwords after doing "make install", which worked fine. I suppose I should have mentioned that in the first message. :) People installing the OS fresh won't need to take this step. Note that 1,000 is simply too low -- the security value of PHK's scheme is lost as computers increase in speed. Therefore, taking a minute to update my passwords is acceptable to me. Since there is 0 cost for people installing fresh, there is no reason not to do it. The blowfish algorithm should also be similarly tuned.help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100128193941.GK892>