revert low rounds-count limits in crypt hashes

it was determined in discussion that these kind of limits are not
sufficient to protect single-threaded servers against denial of
service attacks from maliciously large round counts. the time scales
simply vary too much; many users will want login passwords with rounds
counts on a scale that gives decisecond latency, while highly loaded
webservers will need millisecond latency or shorter.

still some limit is left in place; the idea is not to protect against
attacks, but to avoid the runtime of a single call to crypt being, for
all practical purposes, infinite, so that configuration errors can be
caught and fixed without bringing down whole systems. these limits are
very high, on the order of minute-long runtimes for modest systems.

diff --git a/src/crypt/crypt_blowfish.c b/src/crypt/crypt_blowfish.c
index bd37be84c1e996f9fcfc557ab5afdde1475dbe9a..d3f798517e872099ffad66e783e2e1e3be3e84dd 100644 (file)
--- a/src/crypt/crypt_blowfish.c
+++ b/src/crypt/crypt_blowfish.c
@@ -625,7 +625,7 @@ static char *BF_crypt(const char *key, const char *setting,
        }
 
        count = (BF_word)1 << ((setting[4] - '0') * 10 + (setting[5] - '0'));
-       if (count < min || count > 2048 || BF_decode(data.binary.salt, &setting[7], 16)) {
+       if (count < min || BF_decode(data.binary.salt, &setting[7], 16)) {
                return NULL;
        }
        BF_swap(data.binary.salt, 4);

diff --git a/src/crypt/crypt_des.c b/src/crypt/crypt_des.c
index d7b2b15af40be3bdc71b5554f154e11615b35758..4454a130de79208089875ecc6c29a067a9763752 100644 (file)
--- a/src/crypt/crypt_des.c
+++ b/src/crypt/crypt_des.c
@@ -911,7 +911,7 @@ static char *_crypt_extended_r_uut(const char *_key, const char *_setting, char
                                return NULL;
                        count |= value << (i - 1) * 6;
                }
-               if (!count || count > 262143)
+               if (!count)
                        return NULL;
 
                for (i = 5, salt = 0; i < 9; i++) {

diff --git a/src/crypt/crypt_sha256.c b/src/crypt/crypt_sha256.c
index 2dc27ee7b20b8488bb2c7a04e6c1ffe91eb570ac..076e4b161268530e415c18e318afa0de4deb49ba 100644 (file)
--- a/src/crypt/crypt_sha256.c
+++ b/src/crypt/crypt_sha256.c
@@ -172,7 +172,7 @@ static char *to64(char *s, unsigned int u, int n)
 #define SALT_MAX 16
 #define ROUNDS_DEFAULT 5000
 #define ROUNDS_MIN 1000
-#define ROUNDS_MAX 50000
+#define ROUNDS_MAX 9999999
 
 /* hash n bytes of the repeated md message digest */
 static void hashmd(struct sha256 *s, unsigned int n, const void *md)

diff --git a/src/crypt/crypt_sha512.c b/src/crypt/crypt_sha512.c
index 2c0de698f104265262c68f616c0469ea6cb3964e..0f1de814726ad7f97e23f7f371242ecc030278b8 100644 (file)
--- a/src/crypt/crypt_sha512.c
+++ b/src/crypt/crypt_sha512.c
@@ -193,7 +193,7 @@ static char *to64(char *s, unsigned int u, int n)
 #define SALT_MAX 16
 #define ROUNDS_DEFAULT 5000
 #define ROUNDS_MIN 1000
-#define ROUNDS_MAX 20000
+#define ROUNDS_MAX 9999999
 
 /* hash n bytes of the repeated md message digest */
 static void hashmd(struct sha512 *s, unsigned int n, const void *md)