Skip to content

Add pure Go DES crypt(3) password hashing support - #1

Open
fpesce wants to merge 1 commit into
tredoe:masterfrom
fpesce:feature/des-crypt-tredoe
Open

Add pure Go DES crypt(3) password hashing support#1
fpesce wants to merge 1 commit into
tredoe:masterfrom
fpesce:feature/des-crypt-tredoe

Conversation

@fpesce

@fpesce fpesce commented Aug 15, 2026

Copy link
Copy Markdown

Description

Summary

This PR adds support for the classic 13-character UNIX DES-based crypt(3) password hashing algorithm in pure Go.

As this project, tredoe/crypt provides modern pure Go implementations of standard UNIX password hashing algorithms (MD5, APR1, SHA-256, SHA-512). Adding traditional DES crypt(3) achieves full POSIX feature parity, enabling cross-platform applications to verify historic /etc/shadow entries, manage embedded/retro systems, and execute legacy database migration pipelines without Cgo.

Key Changes

  1. New des_crypt Subpackage:
    • Implements 25-round DES crypt(3) algorithm in pure Go (authored by myself 7 years ago, licensed for you under BSD-2-Clause).
    • Fully implements crypt.Crypter (Generate, Verify, Cost, SetSalt).
    • Implements Validate(hash string) bool verifying exact 13-character length, valid ./0-9A-Za-z charset, and the 2-bit zero mask on character 13.
    • Generates random 2-character salts when salt is empty.
    • Slices first 2 characters when full 13-character hash is passed as salt (POSIX idiom).
    • Constant-time password verification via crypto/subtle.
  2. Root crypt Package Updates:
    • Added crypt.DES constant to Crypt enum.
    • Added RegisterFallback(c Crypt, f func() Crypter, validator func(string) bool).
    • Updated NewFromHash() to detect 13-character DES hashes and return (crypt.DES.New(), nil).
  3. Tests & Documentation:
    • Unit tests covering known glibc test vectors, key truncation (> 8 bytes), short keys (< 8 bytes), invalid salts, bitmask validation, and benchmarks.
    • Updated crypt_test.go and added runnable ExampleCrypt_des in example_test.go.
    • Updated README.md with supported algorithms table and examples.

Security Consideration

DES password hashing is cryptographically obsolete for modern credentials. This package is explicitly provided for legacy verification and migration purposes.

Verification & Testing

go test -v -race -count=1 ./...

All packages build and pass with zero race conditions.

- Add des_crypt package implementing POSIX traditional 13-character DES crypt(3)
- Add crypt.DES constant and fallback auto-detection in NewFromHash
- Implement strict 13-character hash validator with 2-bit zero-mask check
- Zero Cgo dependencies, constant-time verification, and runnable Go examples
- SPDX BSD-2-Clause license (engine authored by Francois Pesce)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant