[
https://issues.apache.org/jira/browse/CODEC-316?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17800194#comment-17800194
]
Gary D. Gregory commented on CODEC-316:
---------------------------------------
Hello [~technobcn]
Thank you for your request.
Feel free to provide a PR on GitHub.
> Support for yescrypt
> --------------------
>
> Key: CODEC-316
> URL: https://issues.apache.org/jira/browse/CODEC-316
> Project: Commons Codec
> Issue Type: Wish
> Reporter: Guillermo Grandes
> Priority: Major
>
> I have recently been aware (although it's not something new ??2021??) of the
> switch ^[3]^ to yescrypt ^[1]^ from scrypt/sha512crypt ^[4]^ for shadow
> passwords on Linux distributions such as Fedora, Debian, Ubuntu and Arch. I
> have not found the porting/implementation in commons-codec like
> org.apache.commons.codec.digest.Sha2Crypt, nor a Jira ticket about it.
> It would be nice to have support for yescrypt {^}[2]{^}.
> Output description {^}[5]{^}:
> {noformat}
> Prefix
> "$y$"
> Hashed passphrase format
> \$y\$[./A-Za-z0-9]+\$[./A-Za-z0-9]{,86}\$[./A-Za-z0-9]{43}
> Maximum passphrase length
> unlimited
> Hash size
> 256 bits
> Salt size
> up to 512 (128+ recommended) bits
> CPU time cost parameter
> 1 to 11 (logarithmic)
> {noformat}
> Test vectors:
> {noformat}
> yescrypt("test")=$y$j9T$UcqCeDUQFBu6eDpvTJWXL.$nfThj9aJvXBk3nmdKQqtvMGkElHH6czHg7zbiw7lSBC
> yescrypt("test")=$y$j9T$yzE3Bw20v45HTM16muFqi1$5TZjNm3236kfMfJVPg98dcH8R0FsprhXdTEdvG/MxJ7
> {noformat}
> References:
> # yescrypt - scalable KDF and password hashing scheme
> [https://www.openwall.com/yescrypt/]
> # yescrypt - C source code
> [https://github.com/openwall/yescrypt]
> # Fedora change log - yescrypt as default hashing for shadow
> [https://fedoraproject.org/wiki/Changes/yescrypt_as_default_hashing_method_for_shadow]
> # Sha2Scrypt Javadoc - Apache Commons Codec
> [https://commons.apache.org/proper/commons-codec/apidocs/org/apache/commons/codec/digest/Sha2Crypt.html]
> # man crypt(5)
> [https://manpages.debian.org/bookworm/libcrypt-dev/crypt.5.en.html]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
