Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add sm3crypt backend #188

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Add sm3crypt backend #188

wants to merge 1 commit into from

Conversation

uudiin
Copy link

@uudiin uudiin commented Jul 10, 2024

Add OSCCA SM3 secure hash (OSCCA GM/T 0004-2012 SM3) backend and tests.

Add OSCCA SM3 secure hash (OSCCA GM/T 0004-2012 SM3)
backend and tests.
@solardiz
Copy link
Collaborator

Are these hashes already in use? If not yet, you could want to take the same approach as with GOST (see gost-yescrypt here), not the same as with SHA-crypt (which you did in this PR now). I guess you need SM3 for the same kind of reasons that others needed GOST, so it'd make sense to be consistent.

The SHA-crypt-like hashes are not only weaker against offline password cracking, but they'd also require their own optimized implementations in publicly available password crackers, or otherwise you leave this potential advantage to attackers with unpublished implementations. The yescrypt-based approach mostly avoids this because almost all processing time is spent in yescrypt, not in the wrapper function, so only the shared tasks of yescrypt optimization remains (maybe separately for defense and offense, but shared between all these wrappers).

Also, usage of these hashes (both GOST and SM3) should be discouraged in the documentation, except in cases where required.

@besser82
Copy link
Owner

besser82 commented Nov 2, 2024

Are these hashes already in use?

Huawei uses sm3crypt in EulerOS and OpenEuler; KylinOS and openKylin seem to use it, too.

@solardiz
Copy link
Collaborator

solardiz commented Nov 3, 2024

Hashes like this (not sure if 100% compatible or not) were also used (among many others) in KoreLogic's annual Crack Me If You Can contest this summer. Support for them is also requested in hashcat/hashcat#3987

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants