Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-05-23 Thread Agustin Martin
reassign 740748 bcrypt forcemerge 700758 740748 thanks On Thu, May 08, 2014 at 12:33:23PM +0200, Agustin Martin wrote: I plan to upload encription-disabled bcrypt package closing #700758, wait for it to reach testing in case any problem appear and then reassign #740748 to bcrypt and forcemerge

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-05-08 Thread Agustin Martin
On Wed, Apr 09, 2014 at 01:09:40PM +0200, Agustin Martin wrote: On Mon, Apr 07, 2014 at 12:38:16PM +0200, Agustin Martin wrote: If something Debian-only is to be done with this package to keep it available, it could be disabling encryption, together with a descriptive error message. This

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-04-09 Thread Agustin Martin
On Mon, Apr 07, 2014 at 12:38:16PM +0200, Agustin Martin wrote: On Mon, Feb 24, 2014 at 04:55:50PM +0100, Ulrik wrote: Hi, Fixing the flaw is not a good idea. A debian-developed new encrypted file format just to salvage this package? Not a good idea. Alternatives: 1) Remove it

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-04-07 Thread Agustin Martin
On Mon, Feb 24, 2014 at 04:55:50PM +0100, Ulrik wrote: Hi, Fixing the flaw is not a good idea. A debian-developed new encrypted file format just to salvage this package? Not a good idea. Alternatives: 1) Remove it 2) Document the flaw directly in the package description, recommend a

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-02-24 Thread Ulrik
Hi, Fixing the flaw is not a good idea. A debian-developed new encrypted file format just to salvage this package? Not a good idea. Alternatives: 1) Remove it 2) Document the flaw directly in the package description, recommend a better solution (gpg) directly in the package description.

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-01-12 Thread coldtobi
Package: bcrypt Followup-For: Bug #700758 -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I see two options: 1) Fix it 2) Remove it 1) Is probably out of scope (ends probably in a fork, breaks compatibiity...) Maybe it should be removed from Debian? (I think we need to maintain a certain level