Tickets :: Comment on [#8425] Poor salt generation for crypt-*

* Your Email Address
* Spam protection	Enter the letters below: . .. ..__ .___.. . \ /\|\/\|\| \ _/ \|__\| \/ \| \|\|__/./__.\| \|
Comment	> I think the code has changed a bit in the latest version. I've got > this for the crypt-md5 case: > > > > diff --git a/framework/Auth/lib/Horde/Auth.php > b/framework/Auth/lib/Horde/Auth.php > > index 8a5695a..fce7771 100644 > > --- a/framework/Auth/lib/Horde/Auth.php > > +++ b/framework/Auth/lib/Horde/Auth.php > > @@ -266,7 +266,7 @@ class Horde_Auth > > case 'crypt-md5': > > return $seed > > ? substr(preg_replace('\|^{crypt}\|i', '', $seed), 0, 12) > > - : '$1$' . substr(hash('md5', mt_rand()), 0, 8) . '$'; > > + : '$1$' . base64_encode(hash('md5', > sprintf('%08X%08X', mt_rand(), mt_rand()), true)) . '$'; > > > > case 'crypt-blowfish': > > return $seed > > > > What would you suggest for crypt and crypt-des? It's currently: > > > > case 'crypt': > > case 'crypt-des': > > return $seed > > ? substr(preg_replace('\|^{crypt}\|i', '', $seed), 0, 2) > > : substr(hash('md5', mt_rand()), 0, 2); > > > > Thanks!
Attachment
Watch this ticket