Better Password Hashes

[Garance A Drosehn]

On 7/7/13 1:36 PM, A.J. Kehoe IV (Nanoman) wrote:
> I commissioned Derek to come up with a solution by either updating
> Steven's patch or by devising a new method. To paraphrase Derek's comments:
>
> -----BEGIN PARAPHRASIS-----
> I did some research into what other *BSDs are doing. OpenBSD and NetBSD
> use the algorithm name, a comma, and then the number of rounds:
>
> http://www.openbsd.org/cgi-bin/man.cgi?query=login.conf&sektion=5
>
> localcipher=blowfish,6
>
> http://netbsd.gw.com/cgi-bin/man-cgi?passwd.conf+5+NetBSD-current
>
> localcipher=blowfish,6
>
> To me, this isn't a good way to do it because we'd need special
> rules to parse this extra field out of the previously unstructured
> data.  This parsing would be algorithm dependant.

To comment only on this point, I do not think it is a significant
issue.  If OpenBSD and NetBSD are already doing this, then whatever
parsing issues are already being addressed by users on those OS's.

I think there is a significant advantage in using something that
they are already using.  Now, if they say "Wow, was this a bad
idea!", then obviously I wouldn't want to add it.  But if their
security is better with this feature, and if *they* don't have
major regrets with using it, then I think we should consider it.

I'd certainly want to consider other ideas too.  But I don't think
we should cross this idea off the list just because it would be
too much extra effort *if* we were the only OS which used it.  I
run both FreeBSD and OpenBSD systems, and for people like me it
will be more effort if different BSD's use incompatible methods
to achieve better password security.  You won't be saving me any
effort, you'll only be adding to the effort I already have.

[admittedly that isn't much effort. :) ]

-- 
Garance Alistair Drosehn                =     drosih at rpi.edu
Senior Systems Programmer               or   gad at FreeBSD.org
Rensselaer Polytechnic Institute;             Troy, NY;  USA