DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=31440>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=31440 ------- Additional Comments From [EMAIL PROTECTED] 2008-01-28 11:46 ------- Any attacker who has the same PRNG as the system where htpasswd runs would be foolish to blindly precompute even a 32 bit apr1 dictionary. 32 bits of time() represents 136 years worth of htpasswd execution with the current srand() code. In a given month, there are less than 22 bits worth of salt when using srand(time(NULL)), 17 bits in a day, 12 bits in an hour, 6 bits in a minute, 0 in a second. 29 bits is all it takes to stretch back to the beginning of Apache, before the apr1 MD5 algorithm appeared in 1.3.6 -- even with your improvement. To "fix" htpasswd so it takes full advantage of the apr1 spec's 48 bits of salt, it is necessary to fix the srand() problem, too. With your generate_salt() and my seed_prng(), htpasswd finally produces nicely random 48-bit salts for apr1. -- Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee. --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
