Hello, > - md5.c/h comes from Grub Legacy, just a bit adapted to use Grub2 memory > functions (malloc, memset, endianness). Therefore, code works correctly, or > at least in a coherent way with respect to Grub Legacy. I can try to make > the code clearer if needed... Other code is made from scratch.
IMO, we should stop using MD5 for the encryption, because it is nowadays considered to be not secure enough. At least SHA1 should be used, although even SHA1 is considered to be vulnerable in near future... You can take an implementation from gnulib. > - limit to password of 64 chars is to have a max buffer size when asking > for the password. It could be greater if required. But will someone really > use >64chars plain text password ? I don't think so. For me, this is an acceptable limitation. > - plain text passwords are indeed very insecure, but I kept them, as it > was possible in Grub legacy. Should I remove them ? Yes. Basically we don't need to keep compatibilty with GRUB Legacy, thus insecure things should be abandoned. Thanks, Okuji _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org http://lists.gnu.org/mailman/listinfo/grub-devel
