Tickets :: Comment on [#8425] Poor salt generation for crypt-*

* Your Email Address
* Spam protection	Enter the letters below: .___..__ . ..___. __. \| [__)\|__\| _/ (__ \| \| \| \|./__..__)
Comment	> In lib/Horde/Auth.php, the function getSalt uses a poor algorithm for > generating salts for crypt-*. crypt allows, at the very least, all > Base64 characters in the salt, but the current algorithm only > generates hexadecimal digits. Furthermore, for crypt-md5, 8 bytes of > salt is permitted, so there are 64^8 = 2^48 possible salt values (if > we only allow Base64 characters), but on most systems, mt_rand() only > generates 2^31 different values, so the current algorithm generates > at most 2^31 different salt values. > > > > A better algorithm would use, for example, > base64_encode(md5(sprintf('%08X%08X', mt_rand(), mt_rand()), TRUE)) > instead of just md5(mt_rand()).
Attachment
Watch this ticket