Your message dated Fri, 14 Aug 2026 10:46:05 +0300
with message-id <[email protected]>
and subject line Re: Bug#1144310: ITP: rust-md4 -- MD4 hash function - Rust
source code
has caused the Debian Bug report #1144310,
regarding ITP: rust-md4 -- MD4 hash function - Rust source code
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144310: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144310
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: wnpp
Severity: wishlist
Owner: Peter Pentchev <[email protected]>
X-Debbugs-Cc: [email protected], Debian Rust Maintainers
<[email protected]>, [email protected]
* Package name : rust-md4
Version : 0.11.0
Upstream Contact: The RustCrypto Project Developers
* URL : https://github.com/RustCrypto/hashes
* License : Expat or Apache-2.0
Programming Lang: Rust
Description : MD4 hash function - Rust source code
This is an implementation of the (really weak!) MD4 hash
algorithm in Rust. Its only purpose in the Debian archive is
to allow the build of the donkey S/Key one-time-password tool.
I intend to maintain this package within the Rust team.
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
On Fri, Aug 14, 2026 at 07:53:07AM +0200, Roland Clobus wrote:
> Hello Peter,
>
> On 13/08/2026 15:57, Peter Pentchev wrote:
> > * Package name : rust-md4
> > Description : MD4 hash function - Rust source code
> >
> > This is an implementation of the (really weak!) MD4 hash
> > algorithm in Rust. Its only purpose in the Debian archive is
> > to allow the build of the donkey S/Key one-time-password tool.
>
> If it should only be used by this password tool, and it is a very weak
> algorithm,
> would it be an option to remove all invocations of the MD4 hash code in
> the upstream code?
TBH, I'd been leaning towards that myself (in my role as upstream).
And yes, I think it's actually time to make the S/Key MD4 support
an explicit non-default build-time option, and do MD5 by default;
that's what FreeBSD's security/opie port does by default, too.
So... yeah. Thanks for challenging me on this (to be completely honest,
part of me was maybe hoping somebody would, and that's partly why
I decided to file an ITP for this library...) ...and sorry for the noise.
G'luck,
Peter
--
Peter Pentchev [email protected] [email protected] [email protected]
PGP key: https://www.ringlet.net/roam/roam.key.asc
Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13
signature.asc
Description: PGP signature
--- End Message ---
