@@ -27,7 +27,6 @@ It was last updated 20 October 2018.
27
27
* something bespoke for not having to write serialization and
28
28
deserialization logic for hash strings by hand, as this is
29
29
probably the most error-prone part of writing a hashing method
30
-
31
30
* the most sensitive piece of data handled by this library is a
32
31
cleartext passphrase. OS may have trusted-path facilities for
33
32
prompting the user for a passphrase and feeding it to a KDF
@@ -53,20 +52,15 @@ It was last updated 20 October 2018.
53
52
probably not match them (they have a ` crypt.conf ` but it’s not the
54
53
same, and their ` crypt_gensalt ` is API-incompatible anyway).
55
54
56
- [ crypt.conf branch ] : https://github.com/besser82/libxcrypt/tree/zack/crypt.conf
57
-
58
55
* Potential API enhancements:
59
-
60
56
* Support for "pepper" (an additional piece of information, _ not_
61
57
stored in the password file, that you need to check a password)
62
-
63
58
* Reading passphrases from the terminal is finicky and there are
64
59
several competing, poorly portable, questionably sound library
65
60
functions to do it (` getpass ` , ` readpassphrase ` , etc) -- should we
66
61
incorporate one?
67
62
* If we do, should it know how to trigger the trusted-path
68
63
password prompt in modern GUI environments? (probably)
69
-
70
64
* Make the crypt and crypt_gensalt static state thread-specific?
71
65
* Solaris 11 may have done this (its ` crypt(3) ` manpage describes
72
66
it as MT-Safe and I don’t see any other way they could have
@@ -75,11 +69,9 @@ It was last updated 20 October 2018.
75
69
data segment off the shared library
76
70
* alternatively, add a global lock and * crash the program* if we
77
71
detect concurrent calls
78
-
79
72
* Allow access to more of yescrypt’s tunable parameters and ROM
80
73
feature, in a way that’s generic enough that we could also use it
81
74
for e.g. Argon2’s tunable parameters
82
-
83
75
* Other yescrypt-inspired features relevant to using this library to
84
76
back a “dedicated authentication service,” e.g. preallocation of
85
77
large blocks of scratch memory
@@ -98,3 +90,5 @@ It was last updated 20 October 2018.
98
90
arguably uncopyrightable).
99
91
* Most of the test suite lacks any license or even authorship
100
92
information. We would have to track down the original authors.
93
+
94
+ [ crypt.conf branch ] : https://github.com/besser82/libxcrypt/tree/zack/crypt.conf
0 commit comments