Date: Fri, 7 Mar 2014 17:50:50 -0500 From: "A.J. Kehoe IV (Nanoman)" <nanoman@nanoman.ca> To: d@delphij.net Cc: Dag-Erling =?iso-8859-1?Q?Sm=F8rgrav?= <des@des.no>, freebsd-current@freebsd.org, secteam@FreeBSD.org Subject: Re: Feature Proposal: Transparent upgrade of crypt() algorithms Message-ID: <20140307225050.GC50880@nanocomputer.nanoman.ca> In-Reply-To: <531A42F3.5020207@delphij.net> References: <2167732.JmQmEPMV2N@desktop.reztek> <201403070913.30359.jhb@freebsd.org> <5319DE84.3040602@allanjude.com> <20140307161313.GA49137@nanocomputer.nanoman.ca> <531A2CC1.8080802@allanjude.com> <20140307215223.GB49137@nanocomputer.nanoman.ca> <531A42F3.5020207@delphij.net>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Xin Li wrote: >Hi, > >On 03/07/14 13:52, A.J. Kehoe IV (Nanoman) wrote: >> Allan Jude wrote: >>> On 2014-03-07 11:13, A.J. Kehoe IV (Nanoman) wrote: >>>> Allan Jude wrote: >>>> >>>> [...] >>>> >>>>> Honestly, my use case is just silently upgrading the strength >>>>> of the hashing algorithm (when combined with my other feature >>>>> request). Updating my bcrypt hashes from $2a$04$ to $2b$12$ >>>>> or something. Same applies for the default sha512, maybe I >>>>> want to update to rounds=15000 >>>> >>>> Like this? >>>> >>>> http://www.freebsd.org/cgi/query-pr.cgi?pr=182518 >>>> >>>> Request for comments: >>>> >>>> http://docs.freebsd.org/cgi/mid.cgi?20140106205156.GD4903 [...] >Speaking for adding rounds, the only problem that needs to be fixed is >that the proposed patch makes it possible to create conflicting >configuration (passwd_format and passwd_modular can use different >hashing algorithms) and need to be fixed and polished. I like the >idea of making it possible to use more rounds though. This was deliberate for backward compatibility. passwd_format will be used by default if passwd_modular isn't defined. If passwd_modular is defined as "disabled", then passwd_format will be used. What do you think of the idea of putting this into libcrypt instead of pam_unix.c, and then patching pam_unix.c and pw_user.c to reference libcrypt? -- A.J. Kehoe IV (Nanoman) | /"\ ASCII Ribbon Campaign Nanoman's Company | \ / - No HTML/RTF in E-mail E-mail: nanoman@nanoman.ca | X - No proprietary attachments WWW: http://www.nanoman.ca/ | / \ - Respect for open standards [-- Attachment #2 --] 0P *H A0=1 0 + 0 *H 0w0_0 *H 0y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org0 140224170909Z 140823170909Z0=10UCAcert WoT User1!0 *H nanoman@nanoman.ca0"0 *H 0 VDj @[H}K4٪:CJyckXmi ~F6 x1JoeHQL`w& .PH"w}|oѬݘ2r6ڛ? p .yaw Nc^ʽhNmHo$lsB1hXy XU ş kք))RnZg_Îhc$u^SϏdmoA#k>x;As B0>0 U 0 0V `HB IGTo get your own certificate for FREE head over to http://www.CAcert.org0U 0@U %907++ +7 +7 `HB02+&0$0"+0http://ocsp.cacert.org01U *0(0&$" http://crl.cacert.org/revoke.crl0 U 0nanoman@nanoman.ca0 *H h\MDm5K8brO/; >1Sl(,M~P*SC@6,~̞C(hܫcINN& gG͖1+L=)Vj7$`Jr 7w!2G .bF컘0!7sΠqSI[)8kF tyI&֛$S] SDKQI=OvSXҫYJ.Ms&>.ߋFU#<1ɭe4B^KQ@wj*y =3D1^|NS63𠢬 Dse Ґ#7E3WRL{+I~}崋 Jj.BNm{mtMлP7 .|M'q*fkaՊ d @,Ud,E@q(GED;J:hN^ S$pXWR]r %H0=0% 0 *H 0y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org0 030330122949Z 330329122949Z0y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org0"0 *H 0 "F}6(P3@K;f?1k6|Nw6A Fs`n~XdͰE cg ҿ>L5]l!ޞ ٺf27rXɎ^> l[df*zKSy{/ a+~MVڒDA X`efD˔B~ ehQ Wkzr%[ 2H.0B%k?:SHҶ4 zX+[8]fɘמtq r`o34v>$z oE8GAJ. Yתғ}h.KX/ꕧTۋQ"þ,x ӊ/?Qe!eE |ALO)!3 u Qw i" Ṕ1{8h[+~_rLK Wʑ u!7c g>FOp gYͺbA )d)B"xC QKZZqs 00 U 2Ұ:90U #02Ұ:9ѡ}{0y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org 0U 002U +0)0'%#!https://www.cacert.org/revoke.crl00 `HB#!https://www.cacert.org/revoke.crl04 `HB'%http://www.cacert.org/index.php?id=100V `HB IGTo get your own certificate for FREE head over to http://www.cacert.org0 *H (\5 ojhX>ÐZ`CpbgX 06;Htq>+h4b@F;S(fSM];`yi;eƁ\MU 7paj|.T>O!܂EMs<evj7$ NmQďʖmC0e';{CCcCh"{Z>7;N˛͚۲p-JذoEH3<2*T#Gdzq c~/ܟ+H%B>Wiw4 Kʠ ƌ27hs_QIS6 Ly:u pg/y= s og/ ${H5)@`ᖆPzY؏! ς;kV#lH<N/ So.t:c¦D l$pG.Բ d$ ܡ5ԼU.}UZ֓v%sLC1\0X00y10U Root CA1 0 U http://www.cacert.org1"0 UCA Cert Signing Authority1!0 *H support@cacert.org0 + 0 *H 1 *H 0 *H 1 140307225050Z0# *H 1 7ϐ|@b=Q 0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 *H -+Sũ6%C/ǖj Zc? c]&O ɏw:I"pe!;%}CYXv~J*-EJW2@dx 5@8oŻ$/EXM5tpAG:InzZ` {wJ9Ϧf 鼘ٿ>nvp{`FϕDJHӺFꄜ~քxF^繟n;Ahd˼T$lj)}{S+%( -
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140307225050.GC50880>