<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">My experience with embedded systems is that crypt(3) is in the standard library and not accessed via OpenSSL. Apps/password uses DES_crypt() and password crackers used to use OpenSSL for performance reasons. Neither seems like a huge deal. I.e. I can’t think of a good reason to keep them.<div class=""><br class=""><div class="">Removing these calls will require an OMC vote as a breaking API change. I’m fine to call one if it seems justified.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Pauli<br class=""><div class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">-- <br class="">Dr Paul Dale | Distinguished Architect | Cryptographic Foundations <br class="">Phone +61 7 3031 7217<br class="">Oracle Australia</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline">
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 17 Jan 2020, at 5:41 pm, Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" class="">openssl-users@dukhovni.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On Fri, Jan 17, 2020 at 04:31:06PM +1000, Dr Paul Dale wrote:<br class=""><br class=""><blockquote type="cite" class="">There are two functions (DES_crypt and DES_fcrypt) which implement the<br class="">old crypt(3) password algorithm. Once these are deprecated, they will<br class="">no longer be reachable via EVP. The confounding point is that they<br class="">aren’t quite DES — close but not identical. I would be surprised if<br class="">they aren’t still in use for /etc/passwd files on old and/or embedded<br class="">systems.<br class=""></blockquote><br class="">Generally speaking, on Unix-like systems that use crypt(3) for<br class="">/etc/passwd I'd expect to find a standaline crypt() implementation in<br class="">libc, that is independent of OpenSSL. That is, if your system still<br class="">uses crypt() for passwords, you don't need OpenSSL to compute crypt<br class="">hashes.<br class=""><br class="">That said, this is experience from general-purpose computers running<br class="">Unix-like OSes, not embedded systems, where I have no idea whether<br class="">crypt() is popular, and whether it is provided by a port of libcrypto<br class="">to that platform.<br class=""><br class=""><blockquote type="cite" class="">I’ve got several choices: Leave them public and unchanged — that is,<br class="">don’t deprecate these two functions yet. Deprecate them and add KDFs<br class="">to replace them. Deprecate them, leave them alone and hope they go<br class="">away painlessly at some point.<br class=""></blockquote><br class="">I would not expect to find many users of OpenSSL's crypt(), except<br class="">internally within OpenSSL itself.<br class=""><br class=""><blockquote type="cite" class="">The apps/password.c applet calls these which is how I stumbled over<br class="">the complication. I’m fine refactoring this based on the solution<br class="">chosen. I’d also be okay with factoring out all the password<br class="">derivation functions into KDFs if necessary.<br class=""><br class="">Thoughts? Other alternatives?<br class=""></blockquote><br class="">I don't know enough about embedded systems to speak about what if<br class="">anything we need to do for those with respect to crypt().<br class=""><br class="">-- <br class=""> Viktor.<br class=""></div></div></blockquote></div><br class=""></div></div></body></html>