From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1IIUMl-0005eJ-Ec for mharc-grub-devel@gnu.org; Tue, 07 Aug 2007 15:05:15 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1IIUMj-0005dz-Kk for grub-devel@gnu.org; Tue, 07 Aug 2007 15:05:13 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1IIUMb-0005d6-Ue for grub-devel@gnu.org; Tue, 07 Aug 2007 15:05:13 -0400 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1IIUMb-0005d3-Nj for grub-devel@gnu.org; Tue, 07 Aug 2007 15:05:05 -0400 Received: from [212.85.152.101] (helo=kotoba.storever.com) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1IIUMZ-00044i-Js for grub-devel@gnu.org; Tue, 07 Aug 2007 15:05:04 -0400 Received: from kotoba.oasis.nexedi.com (kotoba.oasis.nexedi.com [212.85.152.101]) by kotoba.storever.com (Postfix) with ESMTP id A3BD93D299F67 for ; Wed, 8 Aug 2007 01:44:39 +0200 (CEST) Received: from [??1] (localhost [127.0.0.1]) by kotoba.storever.com (Postfix) with ESMTP id 4402C3D299E3A for ; Wed, 8 Aug 2007 01:44:39 +0200 (CEST) From: "Yoshinori K. Okuji" Organization: enbug.org To: The development of GRUB 2 Date: Tue, 7 Aug 2007 21:04:41 +0200 User-Agent: KMail/1.9.4 References: <46B6193D.4010403@gmail.com> <877io7fyag.fsf@xs4all.nl> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200708072104.41790.okuji@enbug.org> X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=0.17.2 X-Detected-Kernel: Linux 2.6, seldom 2.4 (older, 4) Subject: Re: [PATCH] password command implementation X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Aug 2007 19:05:14 -0000 Hello, > - md5.c/h comes from Grub Legacy, just a bit adapted to use Grub2 memory > functions (malloc, memset, endianness). Therefore, code works correctly, or > at least in a coherent way with respect to Grub Legacy. I can try to make > the code clearer if needed... Other code is made from scratch. IMO, we should stop using MD5 for the encryption, because it is nowadays considered to be not secure enough. At least SHA1 should be used, although even SHA1 is considered to be vulnerable in near future... You can take an implementation from gnulib. > - limit to password of 64 chars is to have a max buffer size when asking > for the password. It could be greater if required. But will someone really > use >64chars plain text password ? I don't think so. For me, this is an acceptable limitation. > - plain text passwords are indeed very insecure, but I kept them, as it > was possible in Grub legacy. Should I remove them ? Yes. Basically we don't need to keep compatibilty with GRUB Legacy, thus insecure things should be abandoned. Thanks, Okuji