Cannot parse sha256/sha512 Password-Hashes

[C0D3-M4513R]

I cannot parse sha256_crypt or sha512_crypt Password-Hashes with this library, because none of the encodings fit.

I tested with the password password hashed by https://www.dcode.fr/crypt-hashing-function to sha512 at 5000 rounds: $6$$bLTg4cpho8PIUrjfsE7qlU08Qx2UEfw..xOc6I1wpGVtyVYToGrr7BzRdAAnEr5lYFr1Z9WcCf1xNZ1HG9qFW1.

The crate you use for decoding the output hash seems to have a Decoder/Encoder ready for that use-case: Base64ShaCrypt

Edit: I also just realised, that this probably belongs to https://github.com/RustCrypto/traits/

[tarcieri]

Please provide a complete reproduction of the problem

[C0D3-M4513R]

password_hash::Encoding::Crypt can be swapped out for any existing encoding, and the decode will fail

password_hash::Output::decode("bLTg4cpho8PIUrjfsE7qlU08Qx2UEfw..xOc6I1wpGVtyVYToGrr7BzRdAAnEr5lYFr1Z9WcCf1xNZ1HG9qFW1", password_hash::Encoding::Crypt).expect("Expected Hash to decode")

[C0D3-M4513R]

Seems like this was already addressed in RustCrypto/traits@fd48936 , but I don't have that yet, because I am still using the 2 years old version 0.5.0 and 0.6.0 is still in release candidate stage after 8 months.

[tarcieri]

The only support for that hash format is in the sha-crypt crate.

It's a legacy MCF encoding (where MCF isn't really a "standard" but a collection of algorithm-specific encodings), whereas the password-hash crate supports the PHC string format.

[C0D3-M4513R]

I want my application to support lazily re-hashing the passwords though.
I have made wrappers (in my app) for sha-crypt and bcrypt-pbkf for that exact purpose to support password-hash.

[tarcieri]

We'd need to look into if there are proper PHC encodings for sha-crypt hashes

[tarcieri]

FYI, I've written a crate to generically operate on the "Modular Crypt Format": https://docs.rs/mcf/latest/mcf/

I plan on using it to reimplement hash serialization in the sha-crypt crate.

Once that's done, we can experiment with trying to change the traits in the password-hash crate to be generic over password hash formats, which should make them more flexible for these sorts of use cases