Skip to content

lib/salt.c: gensalt(): Default to SHA512 instead of DES#1454

Draft
alejandro-colomar wants to merge 1 commit intoshadow-maint:masterfrom
alejandro-colomar:sha512
Draft

lib/salt.c: gensalt(): Default to SHA512 instead of DES#1454
alejandro-colomar wants to merge 1 commit intoshadow-maint:masterfrom
alejandro-colomar:sha512

Conversation

@alejandro-colomar
Copy link
Collaborator

@alejandro-colomar alejandro-colomar commented Dec 27, 2025

DES is insecure; use it only if explicitly requested.


Do not merge before the release of 4.20.

Revisions:

v1b
  • Rebase
$ git rd 
1:  f4dd13ccb108 < -:  ------------ */: Remove support for MD5_CRYPT_ENAB
2:  85771ad90a6c < -:  ------------ lib/salt.c: Compact conditionals
3:  fdc32380c44a < -:  ------------ */: chpasswd(8): -m,--md5: Remove option
4:  43b5bef9f464 < -:  ------------ */: chgpasswd(8): -m,--md5: Remove option
5:  5bb41add8c8a = 1:  0c12025560a2 lib/salt.c: gensalt(): Default to SHA512 instead of DES

DES is insecure; use it only if explicitly requested.

Closes: <shadow-maint#1278>
Reported-by: Andre Boscatto <andreboscatto@gmail.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
@alejandro-colomar alejandro-colomar marked this pull request as ready for review February 25, 2026 16:00
@alejandro-colomar alejandro-colomar marked this pull request as draft February 25, 2026 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fallback to DES when ENCRYPT_METHOD is unset is insecure: propose SHA512 or safe default

1 participant