Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8355467

Support yescrypt Password Hash Algorithms

XMLWordPrintable

    • Icon: Enhancement Enhancement
    • Resolution: Unresolved
    • Icon: P4 P4
    • None
    • None
    • security-libs

      A DESCRIPTION OF THE PROBLEM :
      JDK-8294867 suggests scrypt, but yescrypt, which is built upon it, is more reliable and worth implemented.
      yescrypt is adopted by Fedora 35+, Ubuntu 22.04+, modern Debian, modern Arch Linux, and CentOS Stream 10 (i.e. RHEL 10 in the future) as the default algorithm. I would not suggest this if JDK-8294867 had been closed as "Won't Fix" or not been opened, or yescrypt were independent on scrypt.
      On the other hand, I have never heard that scrypt was adopted as the default password hashing algorithm in an Unix-like OS.

      Here is why Fedora adopted it: https://fedoraproject.org/wiki/Changes/yescrypt_as_default_hashing_method_for_shadow

      Ubuntu info: https://wiki.ubuntu.com/Security/Features
      Arch Linux announcement: https://archlinux.org/news/changes-to-default-password-hashing-algorithm-and-umask-settings/
      CentOS: See /etc/login.defs, or create an user, change its password, and see /etc/shadow in the official Docker image (quay.io/centos/centos:stream10)


            Unassigned Unassigned
            webbuggrp Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: