[openssh-commits] [openssh] 05/87: fix fake password salt generation for bcrypt hashes

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 84f8f4666b536dcd3959ab27171caecd5e80947b
Author: Damien Miller <djm at mindrot.org>
AuthorDate: Fri Oct 30 17:49:48 2026 +1100

    fix fake password salt generation for bcrypt hashes
    
    When an invalid user is being considered for non-PAM password authentication,
    sshd will generate a fake passwd/salt to hide timing differences in crypt(3)
    or similar. To do this, it uses the salt algorithm from the first valid
    account in the password database, but the approach we were using failed to
    correctly match bcrypt hashes. So, if the password database only contained
    bcrypt hashes, then the timing difference between a valid and invalid user
    would again be visible.
    
    Anthropic ANT-2026-7T6M8N4X
---
 openbsd-compat/xcrypt.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/openbsd-compat/xcrypt.c b/openbsd-compat/xcrypt.c
index 9cded6684..4e0d0d644 100644
--- a/openbsd-compat/xcrypt.c
+++ b/openbsd-compat/xcrypt.c
@@ -84,6 +84,13 @@ pick_salt(void)
 			continue;
 		if (passwd[0] == '$' && (p = strrchr(passwd+1, '$')) != NULL) {
 			typelen = p - passwd + 1;
+			/*
+			 * bcrypt ($2*$NN$) has no '$' between its 22 character
+			 * salt and the hash, so keep the salt too or crypt(3)
+			 * will reject the setting without doing any work.
+			 */
+			if (passwd[1] == '2' && strlen(p + 1) >= 22)
+				typelen += 1 + 22;
 			strlcpy(salt, passwd, MINIMUM(typelen, sizeof(salt)));
 			explicit_bzero(passwd, strlen(passwd));
 			goto out;

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.