crypt(3) - Switch SHA256/512 to the Linux implementation
authorSamuel J. Greear <sjg@thesjg.com>
Fri, 20 Jan 2012 12:24:33 +0000 (05:24 -0700)
committerSamuel J. Greear <sjg@thesjg.com>
Fri, 20 Jan 2012 13:12:21 +0000 (06:12 -0700)
commitd8ee3b5d2d9ba12d8978a47bccb8e3945f96ea08
tree1dfc5882a51a58797229ee658d36e37084a9ac18
parentdad1b17f80c741f99468080a68d8afd209a19fd5
crypt(3) - Switch SHA256/512 to the Linux implementation

* The existing SHA backends have been shown to be more susceptible to brute-
  force attacks than we would prefer --
  http://www.openwall.com/lists/oss-security/2012/01/16/2

* Bring in the reference implementation used in Linux, code is in the public
  domain.

* Add required (standard) functions mempcpy and stpcpy.

* Change default for future installs to SHA512, this is the default on at
  least archlinux and fedora.

* Add some minor hacks to libcrypt/crypt.c to ensure that
  a) All existing passwords continue to work
  b) All future passwords will be more secure with no changes required

* To update passwords to the new format use passwd(1) for each user, and to
  change your default password type to SHA512 (default for new installations)
  change the passwd_format setting under default to "sha512".
14 files changed:
etc/login.conf
include/string.h
lib/libc/string/Makefile.inc
lib/libc/string/memcpy.3
lib/libc/string/mempcpy.c [new file with mode: 0644]
lib/libc/string/stpncpy.c [copied from lib/libcrypt/crypt.h with 59% similarity]
lib/libc/string/strcpy.3
lib/libcrypt/Makefile
lib/libcrypt/crypt-sha256.c
lib/libcrypt/crypt-sha512.c
lib/libcrypt/crypt.c
lib/libcrypt/crypt.h
lib/libcrypt/deprecated-crypt-sha256.c [copied from lib/libcrypt/crypt-sha256.c with 97% similarity]
lib/libcrypt/deprecated-crypt-sha512.c [copied from lib/libcrypt/crypt-sha512.c with 97% similarity]