[Bug libc/16522] On sha* password generation, select hash rounds to achieve given computation time based on hash computation speed

["bugdal at aerifal dot cx" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=16522

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bugdal at aerifal dot cx

--- Comment #2 from Rich Felker <bugdal at aerifal dot cx> ---
I'm a bit concerned about this proposal. What happens when your hashes are
shared between multiple machines (e.g. a very fast server and multiple thin
clients) or when you're setting up a VE image for cpu-limited hosting or a
system image to run on a lower-end machine using a higher-end one? I think it's
flawed to assume that the machine on which hashes will later be validated is as
capable as the machine on which the original hashes are generated. Whether this
is an acceptable flaw (i.e. whether the benefit is worth dealing with the side
effects of this flaw) is a matter for discussion.

-- 
You are receiving this mail because:
You are on the CC list for the bug.