{"id":9,"date":"2006-10-11T13:10:41","date_gmt":"2006-10-11T10:10:41","guid":{"rendered":"http:\/\/lexa.tenet.ua\/blog\/2006\/10\/11\/solaris-crypt-better-password-hashing-algorithms\/"},"modified":"2006-10-11T18:06:11","modified_gmt":"2006-10-11T15:06:11","slug":"solaris-crypt-better-password-hashing-algorithms","status":"publish","type":"post","link":"https:\/\/lexa.od.ua\/blog\/2006\/10\/11\/solaris-crypt-better-password-hashing-algorithms\/","title":{"rendered":"Solaris Crypt : better password hashing algorithms"},"content":{"rendered":"<p>From Solaris 9 update 2, a new framework was introduced that would make it possible to select among a number of hash algorithms the famous one that would be used to compute the encrypted version of the passwords. Before that time, the traditional crypt() routine was used, limiting the size of passwords to 8 characters and providing the even more famous 13 characters found in the <strong>\/etc\/shadow<\/strong> file.The Solaris Pluggable Crypt Framework makes it possible to choose from 3 new algorithms, all allowing a maximal password size of 255 characters:<\/p>\n<p><strong># cat \/etc\/security\/crypt.conf<br \/>\n(\u2026)<br \/>\n1          crypt_bsdmd5.so.1<br \/>\n2a        crypt_bsdbf.so.1<br \/>\nmd5     crypt_sunmd5.so.1<br \/>\n<\/strong><\/p>\n<p>What are these libraries?<!--more--><\/p>\n<p>From the man pages:<br \/>\n<strong># man crypt_bsdmd5<\/strong><br \/>\n(\u2026)The crypt_bsdmd5 module is a one-way password hashing module for use with crypt(3C) that uses the MD5 message hash algorithm. (\u2026) The output is compatible with md5crypt on BSD and Linux systems.<\/p>\n<p><strong># man crypt_bsdbf<\/strong><br \/>\n(\u2026)The crypt_bsdbf module is a one-way password hashing module for use with crypt(3C) that uses the Blowfish cryptographic algorithm. (\u2026)<\/p>\n<p><strong># man crypt_sunmd5<\/strong><br \/>\n(\u2026)The crypt_sunmd5 module is a one-way password hashing module for use with crypt(3C) that uses the MD5 message hash algorithm. (\u2026)<\/p>\n<ul>\n<li><em>How to take advantage of this feature?<\/em><br \/>\nDead easy.<br \/>\n<strong># grep \u2018^CRYPT_DEFAULT\u2019 \/etc\/security\/policy.conf<br \/>\nCRYPT_DEFAULT=__unix__<\/strong>explains why the default hashing algorithm is still the traditional one. Replace <strong>__unix__<\/strong> by one of the identifiers specified in \/etc\/security\/crypt.conf (1,2a,md5). All the new local passwords will from then be hashed using your new algorithm.<\/li>\n<li><em>Which hashing algorithm to choose from?<\/em><br \/>\nAlec Muffett, one the top security engineers in Sun, has got a <a href=\"http:\/\/www.crypticide.com\/dropsafe\/2005\/12\/05#post20051205182853\">long interesting story<\/a> on that subject. Including a description of \u201chis\u201d sunmd5. From the man page again :<strong># man crypt_sunmd5<\/strong><br \/>\n(\u2026)This module is designed to make it difficult to crack passwords that use brute force attacks based on high speed MD5 implementations that use code inlining, unrolled loops, and table lookup.(\u2026)<\/li>\n<\/ul>\n<p>So unless you need Linux compatibility, it seems that sunmd5 is the right choice.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>From Solaris 9 update 2, a new framework was introduced that would make it possible to select among a number of hash algorithms the famous one that would be used to compute the encrypted version of the passwords. Before that time, the traditional crypt() routine was used, limiting the size of passwords to 8 characters [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[2],"tags":[],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-unix"],"_links":{"self":[{"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":0,"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"wp:attachment":[{"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lexa.od.ua\/blog\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}