3 ms·
Can someone please help me understand the implications? Crypt_blowfish handles 8(and higher?)-bit characters wrong on OpenBSD? Are other *nix systems also affe
by Revisor 15y ago
Can someone please help me understand the implications?
Crypt_blowfish handles 8(and higher?)-bit characters wrong on OpenBSD? Are other *nix systems also affected? Is the wrong character handling consistent?
- dekz 15y agoI don't believe Crypt_blowfish == OpenBSD's implementation, they cannot interoperate as crypt_blowfish has this inconsistency with 8bit chars. You'd have to look up with distros use it, there are a number listed in his email but that might not list all affected platforms. I'd be looking into it if I was using PHP and blowfish.
- there 15y agocrypt_blowfish (http://www.openwall.com/crypt/ http://www.openwall.com/crypt/) is a 3rd party crypt() interface for non-openbsd systems that uses bcrypt. this problem doesn't affect openbsd. according to another post (http://seclists.org/oss-sec/2011/q2/653 http://seclists.org/oss-sec/2011/q2/653) postgresql and php-suhosin use the same crypt_blowfish code, but may or may not be affected.