[Bug-mit-scheme] [bug #27230] Edwin's support for editing Blowfish-encrypted files uses a weak key-derivation function

[Taylor R. Campbell]

URL:
  <http://savannah.gnu.org/bugs/?27230>

                 Summary: Edwin's support for editing Blowfish-encrypted
files uses a weak key-derivation function
                 Project: MIT/GNU Scheme
            Submitted by: riastradh
            Submitted on: Wed 12 Aug 2009 01:33:22 GMT
                Category: edwin
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: Incorrect behavior
                  Status: None
                 Privacy: Public
             Assigned to: None
         Originator Name: 
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
                Keywords: 

    _______________________________________________________

Details:

Edwin maps pass phrases into Blowfish keys by sending them through MD5. 
Instead it should use a strong KDF such as bcrypt, scrypt, or at least one of
the PBKDF2 family of KDFs.  PBKDF2 is a standard for KDFs, defined in PKCS#5;
bcrypt and scrypt are stronger KDFs, but are not standardized.




    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?27230>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/