Re: CVE request: crypt_blowfish 8-bit character mishandling

[Ludwig Nussel <ludwig.nussel () suse de>]

Solar Designer wrote:
> On Mon, Jul 11, 2011 at 04:39:08PM +0200, Ludwig Nussel wrote:
> [...]
> > Keep using the buggy
> > algorithm for new passwords and keep storing them as 2a
>
> I'd be unhappy about that, but it's a valid option to provide if you
> want to minimize user annoyance, including for networked systems that
> are not upgraded in sync (but are manually configured for this...)

After more thinking however ... adding any option that influences
how new passwords are generated means we have to patch all
applications that generate passwords to honor that option, ie parse
the config file. On OpenSUSE I've found pam_unix2, pwdutils,
mkpasswd and yast2 so far. Biting the bullet and just hardcoding 2y
would be much easier.

Nevertheless if we miss to patch any package there would be still the
chance of someone generating 2a hashes with a different algorithm than
what the system uses to verify them later though. So implementing your
original idea and have crypt_gensalt change the prefix wouldn't be
that bad after all. That bears the risk to break some programs like
mkpasswd but they would at least fail with an error rather than
generating unusable hashes.

cu
Ludwig

--
 (o_   Ludwig Nussel
 //\
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix 
Imendörffer, HRB 16746 (AG Nürnberg)