From smkelly@slashnet.org Mon Aug  9 14:45:22 1999
Return-Path: <smkelly@slashnet.org>
Received: from area51.slashnet.org (area51.slashnet.org [208.222.214.95])
	by hub.freebsd.org (Postfix) with ESMTP id 0B4A5152C4
	for <FreeBSD-gnats-submit@freebsd.org>; Mon,  9 Aug 1999 14:45:20 -0700 (PDT)
	(envelope-from smkelly@slashnet.org)
Received: from smkelly by area51.slashnet.org with local (Exim 3.03 #1)
	id 11Dx9o-0002B6-00; Mon, 09 Aug 1999 17:40:36 -0400
Message-Id: <E11Dx9o-0002B6-00@area51.slashnet.org>
Date: Mon, 09 Aug 1999 17:40:36 -0400
From: smkelly@slashnet.org
Reply-To: smkelly@slashnet.org
To: FreeBSD-gnats-submit@freebsd.org, sno@silver.slashnet.org
Subject: FreeBSD libcrypt bug?
X-Send-Pr-Version: 3.2

>Number:         13047
>Category:       misc
>Synopsis:       crypt() with 2 char salt is not returning 13 character backwards compatible strings
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Aug  9 14:50:01 PDT 1999
>Closed-Date:    Thu Aug 12 20:47:28 PDT 1999
>Last-Modified:  Thu Aug 12 20:47:55 PDT 1999
>Originator:     Sean Kelly
>Release:        FreeBSD 3.2-STABLE i386
>Organization:
>Environment:

	

>Description:

	The libcrypt.so.2 library contains the crypt() function.
	Other implimentations only support a format with a two
	character salt which generates a 13 character password.
	The FreeBSD crypt(3) manpage says that there is backward
	compatibility for such things if the 'setting' (second
	argument passed to crypt()) is just two characters.
	However, I am getting >13 character passwords even by
	using the compatible mode that the manpage described.
	This breaks some programs such as Internet Relay Chat
	Daemons that use crypted passwords on many platforms.

>How-To-Repeat:

	(1) smkelly@area51:~$ cat <<EOF >crypt.c
	> #include <stdio.h>
	> #include <unistd.h>
	> int main()
	> {
	> printf("Compat: %s\n", crypt("FreeBSD", "42"));
	> printf("Incompat: %s\n", crypt("FreeBSD", "_DEADBEEF"));
	> return 0;
	> }
	> EOF
	(2) smkelly@area51:~$ gcc -o crypt crypt.c -lcrypt
	(3) smkelly@area51:~$ ./crypt
	Compat: $1$42$2kP4RJzDJDeJaNnfz6kAD1
	Incompat: $1$_DEADBEE$qewOsrc1LJwwvGy7HmsLp0


>Fix:
	
	In the example, the Compat: should read '42RsTfgD2n9Gs'.
	Libcrypt needs to be fixed so it is backward compatible again.

>Release-Note:
>Audit-Trail:

From: "Danny J. Zerkel" <dzerkel@columbus.rr.com>
To: freebsd-gnats-submit@freebsd.org, smkelly@slashnet.org
Cc:  
Subject: Re: misc/13047: crypt() with 2 char salt is not returning 13 character 
 backwards compatible strings
Date: Mon, 09 Aug 1999 22:10:25 -0400

 Looks like compatibility has been gone since 1994...
 
 -- Danny J. Zerkel
 "Sursum ad Absurdum"
 

From: Chris Costello <chris@calldei.com>
To: smkelly@slashnet.org
Cc: FreeBSD-gnats-submit@FreeBSD.ORG, sno@silver.slashnet.org
Subject: Re: misc/13047: FreeBSD libcrypt bug?
Date: Tue, 10 Aug 1999 00:10:25 -0500

 On Mon, Aug 09, 1999, smkelly@slashnet.org wrote:
 > 	(2) smkelly@area51:~$ gcc -o crypt crypt.c -lcrypt
 > 	(3) smkelly@area51:~$ ./crypt
 > 	Compat: $1$42$2kP4RJzDJDeJaNnfz6kAD1
 > 	Incompat: $1$_DEADBEE$qewOsrc1LJwwvGy7HmsLp0
 > 
 > 
 > >Fix:
 > 	
 > 	In the example, the Compat: should read '42RsTfgD2n9Gs'.
 > 	Libcrypt needs to be fixed so it is backward compatible again.
 
    No, libcrypt is linked to libscrypt on your system
 (obviously), and libscrypt will not create those style passwords
 -- they are MD5-based only.
 
 -- 
 |Chris Costello <chris@calldei.com>
 |I haven't lost my mind; it's backed up on tape somewhere.
 `---------------------------------------------------------
 

From: Dag-Erling Smorgrav <des@flood.ping.uio.no>
To: smkelly@slashnet.org
Cc: FreeBSD-gnats-submit@FreeBSD.ORG, sno@silver.slashnet.org
Subject: Re: misc/13047: FreeBSD libcrypt bug?
Date: 11 Aug 1999 09:58:47 +0200

 smkelly@slashnet.org writes:
 > 	However, I am getting >13 character passwords even by
 > 	using the compatible mode that the manpage described.
 > 	This breaks some programs such as Internet Relay Chat
 > 	Daemons that use crypted passwords on many platforms.
 
 You didn't install the DES library. The 13-character hashes you
 describe are DES hashes, which are supported by the optional DES
 library.
 
 DES (the hacker, not the hash)
 -- 
 Dag-Erling Smorgrav - des@flood.ping.uio.no
 
State-Changed-From-To: open->closed 
State-Changed-By: chris 
State-Changed-When: Thu Aug 12 20:47:28 PDT 1999 
State-Changed-Why:  
Originator confirms his problem has been fixed. 
>Unformatted:
