Guillermo Grandes created CODEC-316:
---------------------------------------
Summary: Support for yescrypt
Key: CODEC-316
URL: https://issues.apache.org/jira/browse/CODEC-316
Project: Commons Codec
Issue Type: Wish
Reporter: Guillermo Grandes
I have recently been aware (although it's not something new ??2021??) of the
switch ^[3]^ to yescrypt ^[1]^ from scrypt/sha512crypt ^[4]^ for shadow
passwords on Linux distributions such as Fedora, Debian, Ubuntu and Arch. I
have not found the porting/implementation in commons-codec like
org.apache.commons.codec.digest.Sha2Crypt, nor a Jira ticket about it.
It would be nice to have support for yescrypt {^}[2]{^}.
Output description {^}[5]{^}:
{noformat}
Prefix
"$y$"
Hashed passphrase format
\$y\$[./A-Za-z0-9]+\$[./A-Za-z0-9]{,86}\$[./A-Za-z0-9]{43}
Maximum passphrase length
unlimited
Hash size
256 bits
Salt size
up to 512 (128+ recommended) bits
CPU time cost parameter
1 to 11 (logarithmic)
{noformat}
Test vectors:
{noformat}
yescrypt("test")=$y$j9T$UcqCeDUQFBu6eDpvTJWXL.$nfThj9aJvXBk3nmdKQqtvMGkElHH6czHg7zbiw7lSBC
yescrypt("test")=$y$j9T$yzE3Bw20v45HTM16muFqi1$5TZjNm3236kfMfJVPg98dcH8R0FsprhXdTEdvG/MxJ7
{noformat}
References:
# yescrypt - scalable KDF and password hashing scheme
[https://www.openwall.com/yescrypt/]
# yescrypt - C source code
[https://github.com/openwall/yescrypt]
# Fedora change log - yescrypt as default hashing for shadow
[https://fedoraproject.org/wiki/Changes/yescrypt_as_default_hashing_method_for_shadow]
# Sha2Scrypt Javadoc - Apache Commons Codec
[https://commons.apache.org/proper/commons-codec/apidocs/org/apache/commons/codec/digest/Sha2Crypt.html]
# man crypt(5)
[https://manpages.debian.org/bookworm/libcrypt-dev/crypt.5.en.html]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
