Hi Rich, > Date: 2026-11-12 09:43:49-0500 > From: Rich Felker > [...] > > But is the POSIX specification really useful for applications? > > Yes. It tells you enough to validate a password for authentication > purposes: > > const char *result = crypt(password, hash); > if (result && strcmp(result, hash)==0) { > /* password validated */ > } Is this really specified by POSIX? Unless I'm missing something, I only see something about it in EXAMPLES, which is non-normative, and it doesn't even explain that this is the only way to do it correctly, but rather as a possible example. Notably, I don't find any text that says that passing a different hash as salt could potentially result in a hash that matches the stored hash. That is, I don't see any text (normative or non-normative) in the POSIX specification that implies this: When comparing a password against an existing hash, that hash (and no other) must be passed as salt. If and only if salt compares equal (see streq(3)) to the returned string, the password matches the existing hash specified by salt. The example is useful, but I'd say it's not enough. I think the example should contain wording like that one above (which we're discussing in the other thread for the manual page). Cheers, alex [...] > > > An application should not rely on the specified return value either. > > It can rely on it for validating passwords against existing hashes. > That is the more usual application need. Setting new passwords is > usually an administrative task, except for non-system uses like making > .htaccess files. > > Rich --