Re: draft-stroeder-hashed-userpassword-values-01

Hi Michael,

I'm glad that you've added text to support {CRYPT}. But I'm not sure it is necessary to make the description complete (i.e. refer to all underlying platform specific algorithm).
I think it might be enough to describe the general format of passwords generated by the crypt(3) library, mentions the default unix crypt and one or two other algorithm, but also warn that crypt being extensible and platform specific, it's use might result in interoperability issues.

I would suggest that you add to the list of schemes, PBKDF2 and BCrypt that are 2 mechanisms that are providing much stronger security than the SHA 1 or 2.
I'be happy to provide a description of PBKDF2 if you want, as we've implemented support for it in OpenDJ.

Regards,

Ludo
--  
Ludovic Poitou
http://ludopoitou.wordpress.com


On Thursday, March 14, 2013 at 2:23 , Michael Ströder wrote:

> Andrew Findlay wrote:
> > On Wed, Mar 13, 2013 at 11:39:28PM +0100, Michael Ströder wrote:
> >  
> > > > I see this document is marked as being intended to be published as
> > > > Informational, but it reads more like it's trying to be a standard.
> > > >  
> > >  
> > >  
> > > I tried to add some wording to avoid that misunderstanding in the next
> > > revision of this draft:
> > >  
> > > http://www.ietf.org/internet-drafts/draft-stroeder-hashed-userpassword-values-01.txt
> >  
> > Still -01 ?
>  
> Not "still" -01. Now -01.
>  
> > You are explicitly excluding details of '{crypt}'. I think this is a
> > mistake, especially in an informational document. {crypt} is
> > extremely useful in transition scenarios, so people need to know about
> > it.
> >  
>  
>  
> Hmm...I've expected somebody to ask for it. :-/
> It makes the spec part more complex.
>  
> > What platform-specific variants do you know of?
>  
> Well, looking at crypt(3) man page it seems to me that there are many variants
> of the library on various Unix platforms. This is what I meant with
> "platform-specific".
>  
> > The really important one is the old Unix-crypt 13-char salted hash.
> >  
> > Could you perhaps say something like:
> >  
> > {crypt} introduces a password-hash string that is generated and
> > checked by the crypt(3) library. This could be the traditional
> > 13-character 'Unix crypt' or some other variant such as the stronger
> > '$1$' and $6$' schemes used by recent versions of Linux.
> >  
>  
>  
> I've added some text hopefully getting {CRYPT} stuff complete. Yuck!
>  
> Ciao, Michael.
> _______________________________________________
> Ldapext mailing list
> [email protected] (mailto:[email protected])
> https://www.ietf.org/mailman/listinfo/ldapext
>  
>  
>  
>  
> Attachments:  
> - smime.p7s
>  
>

_______________________________________________
Ldapext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ldapext