> It was brought to my attention that the password encryption in the
> current libc is broken. It was easy enough to fix it but this raises
> the issue of making the code/sources available via ftp. It is my
> understanding that US export laws prohibit exporting this code either
> in source or in binary form. I'm not happy about this law but on the
> other hand I'm also not willing to take any risks with it.
Not really. The crypt() call is one way only, so it's not cryptography.
It's useless for hiding information because you can't get it back.
This is why things like md5 can be distributed with no problems. All
crypt() is is a weak checksum on the key and salt.
Of course, the DES stuff is a bigger problem.
Erik
-------------------------------------------------------------------------------
"Eggheads unite! You have nothing to lose but your yolks" - Adlai Stevenson
Erik Troan = http://sunsite.unc.edu/ewt/ = ewt@sunsite.unc.edu