Subject: Arch-announce Digest, Vol 9, Issue 2

From: [email-masked]
Date: Sat, 23 Sep 2023 08:09:31 +0000

Send Arch-announce mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via email, send a message with subject or
body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Arch-announce digest..."

Today's Topics:

   1. [arch-announce] Changes to default password hashing algorithm and umask settings
      (Arch Linux: Recent news updates: David Runge)

----------------------------------------------------------------------

Message: 1
Date: Fri, 22 Sep 2023 20:26:30 -0000
From: "Arch Linux: Recent news updates: David Runge"
	<[email-masked]>
Subject: [arch-announce] Changes to default password hashing algorithm
	and umask settings
To: [email-masked]
Message-ID: <[email-masked]>
Content-Type: text/plain; charset="utf-8"

With *shadow* &gt;= `4.14.0`, Arch Linux&#x27;s default password hashing algorithm changed from **SHA512** to **yescrypt** [1].

Furthermore, the `umask` [2] settings are now configured in `/etc/login.defs` instead of `/etc/profile`.

This should not require any manual intervention.

## Reasons for Yescrypt
The password-based key derivation function (KDF) and password hashing scheme **yescrypt** has been chosen due to its adoption (readily available in *libxcrypt*, which is used by *pam* [3]) and its stronger resilience towards password cracking attempts over **SHA512**.

Although the winner of the Password Hashing Competition [4] has been **argon2**, this even more resilient algorithm is not yet available in *libxcrypt* [5][6].

## Configuring yescrypt
The `YESCRYPT_COST_FACTOR` setting in `/etc/login.defs` is currently without effect, until *pam* implements reading its value [7]. If a `YESCRYPT_COST_FACTOR` higher (or lower) than the default (`5`) is needed, it can be set using the `rounds` option of the `pam_unix` [8] module (i.e. in `/etc/pam.d/system-auth`).

## General list of changes
- **yescrypt** is used as default password hashing algorithm, instead of **SHA512**
- *pam* honors the chosen `ENCRYPT_METHOD` in `/etc/login.defs` and does not override the chosen method anymore
- changes in the *filesystem* (&gt;= `2023.09.18`) and *pambase* (&gt;= `20230918`) packages ensure, that `umask` is set centrally in `/etc/login.defs` instead of `/etc/profile`

[1] https://www.openwall.com/yescrypt/

[2] https://man.archlinux.org/man/umask.1p

[3] https://wiki.archlinux.org/title/PAM

[4] https://www.password-hashing.net/

[5] https://github.com/besser82/libxcrypt/pull/113

[6] https://github.com/besser82/libxcrypt/pull/150

[7] https://github.com/linux-pam/linux-pam/issues/607

[8] https://man.archlinux.org/man/pam_unix.8

URL: https://archlinux.org/news/changes-to-default-password-hashing-algorithm-and-umask-settings/

------------------------------

Subject: Digest Footer

_______________________________________________
Arch-announce mailing list -- [email-masked]
To unsubscribe send an email to [email-masked]

------------------------------

End of Arch-announce Digest, Vol 9, Issue 2
*******************************************