[Bug libc/13286] New: RFE: bcrypt support

[Bug libc/13286] New: RFE: bcrypt support

[lsof at nodata dot co.uk]

http://sourceware.org/bugzilla/show_bug.cgi?id=13286

             Bug #: 13286
           Summary: RFE: bcrypt support
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: lsof@nodata.co.uk
    Classification: Unclassified


Please could bcrypt support be added to glibc so that we have a modern, safe
way of storing passwords?

Background and justification is here:
 http://codahale.com/how-to-safely-store-a-password/

Summary of link:
 Modern hardware can crack standard encrypted passwords very fast (even if they
use a salt). bcrypt is a solution to this.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13286] RFE: bcrypt support

[joseph at codesourcery dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13286

--- Comment #1 from joseph at codesourcery dot com <joseph at codesourcery dot com> 2011-10-12 20:11:35 UTC ---
On Wed, 12 Oct 2011, lsof at nodata dot co.uk wrote:

> Please could bcrypt support be added to glibc so that we have a modern, safe
> way of storing passwords?

What's wrong with the SHA-256 and SHA-512 based ways added in 2.7?

> Background and justification is here:
>  http://codahale.com/how-to-safely-store-a-password/

That says nothing about the SHA-256 and SHA-512 based methods.

> Summary of link:
>  Modern hardware can crack standard encrypted passwords very fast (even if they
> use a salt). bcrypt is a solution to this.

So are the methods added in 2.7.

http://www.akkadia.org/drepper/sha-crypt.html

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13286] RFE: bcrypt support

[lsof at nodata dot co.uk]

http://sourceware.org/bugzilla/show_bug.cgi?id=13286

--- Comment #2 from lsof at nodata dot co.uk 2011-10-13 12:08:26 UTC ---
(In reply to comment #1)
> What's wrong with the SHA-256 and SHA-512 based ways added in 2.7?

They're not designed for passwords, they're general purpose hashes.

> That says nothing about the SHA-256 and SHA-512 based methods.

I think it does. One of the headings is "Why Not {MD5, SHA1, SHA256, SHA512,
SHA-3, etc}?"

> So are the methods added in 2.7.
> 
> http://www.akkadia.org/drepper/sha-crypt.html

The Coda Hale article says that salts aren't helpful for preventing dictionary
attacks or brute force attacks.

The Drepper article is from 2007, before crazy-fast video card processing
arrived for almost no money.

bcrypt is designed for secure password storage so the benefit to glibc would be
increased security.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13286] RFE: bcrypt support

[jakub at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13286

Jakub Jelinek <jakub at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at redhat dot com

--- Comment #3 from Jakub Jelinek <jakub at redhat dot com> 2011-10-13 12:46:28 UTC ---
You haven't read the paper in detail, right?  You can tweak how expensive is it
to compute it.
E.g.
crypt ("Hello, world!", "$6$rounds=99999999$asaltof16chars..")
takes almost 80 seconds to compute on pretty fast box these days, and the
hashing scheme allows even 10 times more rounds than that.  While you can
parallelize by computing crypt of many passwords at once, computing a single
password is hardly parallelizable.
So if you are worried that you can crack it too fast, just use a higher rounds=
from the default 5000.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13286] RFE: bcrypt support

[lsof at nodata dot co.uk]

http://sourceware.org/bugzilla/show_bug.cgi?id=13286

--- Comment #4 from lsof at nodata dot co.uk 2011-10-13 19:49:56 UTC ---
(In reply to comment #3)
> You haven't read the paper in detail, right?  You can tweak how expensive is it
> to compute it.

I didn't read the paper, I just tried to answer your question by quoting the
website that says that hash isn't very good for passwords.

> E.g.
> crypt ("Hello, world!", "$6$rounds=99999999$asaltof16chars..")
> takes almost 80 seconds to compute on pretty fast box these days, and the
> hashing scheme allows even 10 times more rounds than that.  While you can
> parallelize by computing crypt of many passwords at once, computing a single
> password is hardly parallelizable.
> So if you are worried that you can crack it too fast, just use a higher rounds=
> from the default 5000.

Okay so creating a crypted password is strong. I'm guessing the other types of
attack (brute, dictionary, rainbow, etc.) are safe as well.

I'm not really the right person to be answering questions like this, I've
e-mailed the author of the article, maybe he will reply here.

Onq question though - would it be a bad thing to have bcrypt as an option?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13286] RFE: bcrypt support

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13286

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #5 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-10-15 13:37:36 UTC ---
I added a long time back the new hash sum based password mechanisms.  They are
at least as good.  I'm not going to add anything more.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13286] RFE: bcrypt support

[ldv at altlinux dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13286

Dmitry V. Levin <ldv at altlinux dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |WONTFIX

--- Comment #6 from Dmitry V. Levin <ldv at altlinux dot org> 2011-10-16 18:48:31 UTC ---
(In reply to comment #0)
> Please could bcrypt support be added to glibc so that we have a modern, safe
> way of storing passwords?

The implementation you are talking about is already exists (since 1998).
It's called crypt_blowfish, you can find more information about it at
http://www.openwall.com/crypt/
Some GNU/Linux distributions integrated crypt_blowfish to their glibc packages
long time ago, much before the moment of adding rival SHA-based algorithms to
mainline glibc (about 4 years ago).

AFAIK the decision to not consider including bcrypt support to mainline glibc
was a political one, so I very much doubt raising this issue in bugzilla could
affect that decision.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13286] RFE: bcrypt support

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13286

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.