No subject


Fri Apr 27 03:18:18 UTC 2012


appears that PASS_MIN_LEN is used by crypt() in a=0A=
pretty convoluted fashion. =0A=
=0A=
I'm not sure if ENCRYPT_METHOD affects the=0A=
functionality, but for the default (DES), it seems that=0A=
PASS_MIN_LEN needs to be at least 8 characters=0A=
for the encryption to be effective (crypt takes the=0A=
lowest 7 bits of the first 8 characters of the password).=0A=
=0A=
For the more applicable MD5 and SHA configurations,=0A=
the entire key is used, so maybe PASS_MIN_LEN=0A=
needs to be different for different ENCRYPT_METHOD=0A=
values?  The crypt() man-page says that MD5 encryption =0A=
uses all 22 bytes of the key, SHA-256 uses 43, and SHA-512=0A=
uses 86.=0A=
=0A=
--Mike=


More information about the scap-security-guide mailing list