----- Original Message ----- > From: "Jakob Kramer" <[email protected]> > To: [email protected] > Sent: Friday, 11 April, 2014 3:01:42 PM > Subject: [openssl-dev] Maximum length of passwords > > There should either be a function that automatically allocates enough > memory to put the whole password in it (openssh does it this way, see > read_passphrase from openssh/readpass.c), or a compile-time flag that > sets the PASS_MAXLEN. > > Either way every `app' should check whether the whole password was read > and not silently truncate the password, and all apps should behave > consistently. > > I would like to hear which approach you would choose, malloc or PASS_MAXLEN.
128 characters allows you to hex encode 512 bits of data (e.g. from sha512sum) assuming 8 character words from 2048 word dictionary gives you 176 bit entropy for the same 128 characters. So, PASS_MAXLEN of 256 characters should be enough for anybody and of 128 for most environments. It still should refuse to accept longer passwords and not silently truncate.... As such, I think both solutions are acceptable. The static buffer implementation should be simpler, so should have lower probability of bugs in it. -- Regards, Hubert Kario Quality Engineer, QE BaseOS Security team Email: [email protected] Web: www.cz.redhat.com Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
