Add pure Go DES crypt(3) password hashing support - #1
Open
fpesce wants to merge 1 commit into
Open
Conversation
- Add des_crypt package implementing POSIX traditional 13-character DES crypt(3) - Add crypt.DES constant and fallback auto-detection in NewFromHash - Implement strict 13-character hash validator with 2-bit zero-mask check - Zero Cgo dependencies, constant-time verification, and runnable Go examples - SPDX BSD-2-Clause license (engine authored by Francois Pesce)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Summary
This PR adds support for the classic 13-character UNIX DES-based
crypt(3)password hashing algorithm in pure Go.As this project,
tredoe/cryptprovides modern pure Go implementations of standard UNIX password hashing algorithms (MD5, APR1, SHA-256, SHA-512). Adding traditional DEScrypt(3)achieves full POSIX feature parity, enabling cross-platform applications to verify historic/etc/shadowentries, manage embedded/retro systems, and execute legacy database migration pipelines without Cgo.Key Changes
des_cryptSubpackage:crypt(3)algorithm in pure Go (authored by myself 7 years ago, licensed for you under BSD-2-Clause).crypt.Crypter(Generate,Verify,Cost,SetSalt).Validate(hash string) boolverifying exact 13-character length, valid./0-9A-Za-zcharset, and the 2-bit zero mask on character 13.crypto/subtle.cryptPackage Updates:crypt.DESconstant toCryptenum.RegisterFallback(c Crypt, f func() Crypter, validator func(string) bool).NewFromHash()to detect 13-character DES hashes and return(crypt.DES.New(), nil).crypt_test.goand added runnableExampleCrypt_desinexample_test.go.README.mdwith supported algorithms table and examples.Security Consideration
DES password hashing is cryptographically obsolete for modern credentials. This package is explicitly provided for legacy verification and migration purposes.
Verification & Testing
go test -v -race -count=1 ./...All packages build and pass with zero race conditions.