| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
usergen.c:154:12: error: conflicting types for 'getpass'
154 | static int getpass(char *const password, const size_t n)
| ^
/data/data/com.termux/files/usr/bin/../../usr/include/unistd.h:533:25: note: previous definition is
here
533 | static __inline__ char* getpass(const char* prompt) {
| ^
usergen.c:511:30: error: too many arguments to function call, expected single argument 'prompt',
have 2 arguments
511 | || getpass(password, sizeof password)
| ~~~~~~~ ^~~~~~~~~~~~~~~
/data/data/com.termux/files/usr/bin/../../usr/include/unistd.h:533:25: note: 'getpass' declared
here
533 | static __inline__ char* getpass(const char* prompt) {
| ^ ~~~~~~~~~~~~~~~~~~
2 errors generated.
Signed-off-by: fukiame <fukiame@proton.me>
|
|
|
The SHA256-based password hashing algorithm used by slcl(1) and
usergen(1) is considered insecure against several kinds of attacks,
including brute force attacks. [1]
Therefore, a stronger password hashing algorithm based on the Argon2id
key derivation function is now used by default. While OpenSSL does
support Argon2id, it is only supported by very recent versions [2],
which are still not packaged by most distributions as of the time of
this writing. [3]
As an alternative to OpenSSL, libsodium [4] had several benefits:
- It provides easy-to-use functions for password hashing, base64
encoding/decoding and other cryptographic primitives used by slcl(1)
and usergen(1).
- It is packaged by most distributions [5], and most often only the patch
version differs, which ensures good compatibility across distributions.
Unfortunately, and as opposed to OpenSSL, libsodium does not come with
command-line tools. Therefore, usergen(1) had to be rewritten in C.
In order to maintain backwards compatiblity with existing databases,
slcl(1) and usergen(1) shall support the insecure, SHA256-based password
hashing algorithm. However, Argon2id shall now be the default choice for
usergen(1).
[1]: https://security.stackexchange.com/questions/195563/why-is-sha-256-not-good-for-passwords
[2]: https://docs.openssl.org/3.3/man7/EVP_KDF-ARGON2/
[3]: https://repology.org/project/openssl/versions
[4]: https://www.libsodium.org/
[5]: https://repology.org/project/libsodium/versions
|
