[ruby-core:88061] Re: [Ruby trunk Feature#14915] Deprecate String#crypt, move implementation to string/crypt

[e-mail] wrote:
> shyouhei (Shyouhei Urabe) wrote:
> >  - Basic authentication itself does not require DES.  It is an
> >  implementation detail.  You can safely migrate to another
> >  hash function at will.  Ruby's openssl library has for
> >  instance OpenSSL::KDF.scrypt().
> 
> Note that OpenSSL::KDF.scrypt is only defined if the OpenSSL
> library defines EVP_PBE_scrypt, so it isn't always available.
> I believe this was added in OpenSSL 1.1.0, and it isn't
> currently available in LibreSSL. OpenSSL::KDF.pbkdf2_hmac is
> always defined, so that could be used as long as the openssl
> extension can be required.
> 
> Personally, I think it's best to punt and require the user
> provide implementations for creating a password hash and
> checking the password hash via two callable options (e.g.
> :create_password_hash and :check_password_hash).

Can you provide pre-defined, accepted-as-secure implementations
of these which we can recommend for common use cases which would
be compatible with other webservers?  I'd rather not
introduce/recommend hashes which are incompatible with other
webservers, but two-way compatibility with existing servers
is a good thing.

It could optionally recommend/use 3rd-party gem if available
(e.g. 'bcrypt'), or the bundled 'openssl' ext.

> That way the user can determine which password hash format
> they want to use, and it doesn't tie Webrick to one particular
> hash implementation.  If that is considered acceptable I can
> work on a patch for Webrick that keeps the current default
> behavior with a deprecation warning if the callable options
> are not provided.

That seems reasonable, but I want to avoid situations where
users cargo-cult blocks of code into the config they don't
understand.  They could get stuck with an option which is
eventually found insecure and we'd have no way of warning them.

Thanks.

Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>