FreeBsdCrypt updated

java-programmer, FreeBsdCrypt updated Alas, I don't have the time to make a proper port of this (but if someone
else wants to, please do feel free) but since there's an update and folks
may find this useful, I thought I'd mention it anyway.

FreeBsdCrypt can be found at
http://spatula.net/software/FreeBsdCrypt-1.1.jar . This contains an
implementation of FreeBSD-style MD5 crypt, which many have found useful
when trying to integrate Java stuff with FreeBSD stuff, or migrating from
other languages to servlets, or whatever.

The jar contains all the API docs, source code, and the complied class.
Usage is pretty simple anyway:

String result = FreeBsdCrypt.crypt("password", "salt");

The major change in this version is correcting the way the class name is
capitalized. It needed to start with an uppercase letter since it's a
class name, and then Pascal-casing the rest of it. Consensus on the web
seems to be that acronyms of 3 letters or more are to be Pascal-cased.

Nick

--
"The aptly-named morons.org is an obscenity-laced screed..."
-- Robert P. Lockwood, Catholic League director of research
Nick Johnson, version 2.1 http://web.morons.org/
_______________________________________________
email***@***.com mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-java
To unsubscribe, send any mail to "email***@***.com"

java-programmer >> FreeBsdCrypt updated Just as a sort of heads-up on this and not to anyone
in particular, MD5 and a host of other older hashing
algorithms were shifted into the "broken" basked a couple
of weeks ago at the Crypto conference [1].

Whether this means a given relying system, like Crypt,
can be breached in practical circumstances is currently
under debate, and depends highly on the use and import
of the message digest within the system. From what I
recall of Crypt, it isn't likely to be much of a threat
there as the password list is still "hard to get".

But, the message is clear: time to switch. Probably,
the best thing to do is to switch to SHA1, which is
unbroken (having a specific defence against the cracks
announced mid august). But, a word of caution: there
is a sort of uncertainty about how long SHA1 will last,
and SHA-256 is maybe the next thing to aim at. But to
double that caution, SHA-256 is the same construction
as SHA-1, so there are thoughts that it is time for a
whole new generation.

So, the software systems engineer's viewpoint is this:
migrate to a system where a few hashes can be accepted,
and that way more migratibility can be built in. That
is, relying on one message digest is no longer acceptable.

As an example, taken from my company's software, we use
textual forms like SHA:ABC123 SHA256:abc123 and we use
binary forms with OpenPGP single byte numbers before the
binary (RFC 2440: 0x02 == SHA1, 0x08 == SHA256).

iang

[1] Some of the detail of the conference is collected here:
http://www.financialcryptography.com/mt/archives/000199.html

Nick Johnson wrote:

> FreeBsdCrypt can be found at
> http://spatula.net/software/FreeBsdCrypt-1.1.jar . This contains an
> implementation of FreeBSD-style MD5 crypt, which many have found useful
> when trying to integrate Java stuff with FreeBSD stuff, or migrating from
> other languages to servlets, or whatever.
>
> The jar contains all the API docs, source code, and the complied class.
> Usage is pretty simple anyway:
>
> String result = FreeBsdCrypt.crypt("password", "salt");
>
> The major change in this version is correcting the way the class name is
> capitalized. It needed to start with an uppercase letter since it's a
> class name, and then Pascal-casing the rest of it. Consensus on the web
> seems to be that acronyms of 3 letters or more are to be Pascal-cased.
>
> Nick
>
_______________________________________________
email***@***.com mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-java
To unsubscribe, send any mail to "email***@***.com"