[Bug 11201] New: crypt()

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=11201

            Bug ID: 11201
           Summary: crypt()
           Product: Busybox
           Version: unspecified
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Other
          Assignee: unassigned at busybox.net
          Reporter: mishra.dhiraj95 at gmail.com
                CC: busybox-cvs at busybox.net
  Target Milestone: ---

File:/master/libbb/pw_encrypt.c#L151

Function crypt() is a poor one-way hashing algorithm; since it only accepts
passwords of 8 characters or less, and only a two-byte salt, it is excessively
vulnerable to dictionary/bruteforce based attacks given today's faster
computing equipment.

Use a different algorithm, such as SHA-1, with a larger non-repeating salt.

-- 
You are receiving this mail because:
You are on the CC list for the bug.