lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 21 Mar 2013 17:15:37 +0000
From: Marsh Ray <maray@...rosoft.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: RE: [PHC] Password Hashing done wrong on CISCO IOS

> -----Original Message-----
> From: Per Thorsheim [mailto:per@...rsheim.net]
> Discovered & responsibly reported to Cisco by Jens Steube (+friend). Jens
> happens to be atom@...hcat.net, who should be a well-known person to
> this list I guess. ;-)

Think we'll learn the details of the implementation error?

Sounds like another case where the ready availability of a comprehensive set of test vectors could have made a big difference. I implemented PBKDF2[ HMAC[ SHA-2-512/256 ] ] a few years ago and didn't find any official end-to-end vectors that I could use, but of course the components were testable individually.

> -----Original Message-----
> From: ravin wind [mailto:ravinwinddce@...il.com]
> Sent: Thursday, March 21, 2013 9:29 AM
> 
> What is worst is that Cisco has *no plans to correct this error* according to
> their current  statement.

	"In future, Cisco plans to deprecate Type 4 passwords and deprecation warnings
	for Type 5 will be removed. The company then plans on having another go at
	implementing the 1000 iteration SHA-256 with 80-bit salt algorithm it had
	planned for Type 4; it has yet to select a type designation for this new algorithm."

They can't just patch the "Type 4 " algorithm at this point because that will break stuff. Whatever they do next they're obviously going to be extra careful. Most companies don't like to talk publicly about their development plans until they're very solid.

Perhaps they're waiting for the recommendation of the PHC to adopt as Type 3 !  (their numbering scheme seems to count down)

- Marsh

Powered by blists - more mailing lists