Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-05-23 Thread Agustin Martin
reassign 740748 bcrypt forcemerge 700758 740748 thanks On Thu, May 08, 2014 at 12:33:23PM +0200, Agustin Martin wrote: > I plan to upload encription-disabled bcrypt package closing #700758, wait for > it to reach testing in case any problem appear and then reassign #740748 to > bcrypt and forcemer

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-05-08 Thread Agustin Martin
On Wed, Apr 09, 2014 at 01:09:40PM +0200, Agustin Martin wrote: > On Mon, Apr 07, 2014 at 12:38:16PM +0200, Agustin Martin wrote: > > If something Debian-only is to be done with this package to keep it > > available, it could be disabling encryption, together with a descriptive > > error message. T

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-04-09 Thread Agustin Martin
On Mon, Apr 07, 2014 at 12:38:16PM +0200, Agustin Martin wrote: > On Mon, Feb 24, 2014 at 04:55:50PM +0100, Ulrik wrote: > > Hi, > > > > Fixing the flaw is not a good idea. A debian-developed new encrypted > > file format just to salvage this package? Not a good idea. > > > > Alternatives: > > >

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-04-07 Thread Agustin Martin
On Mon, Feb 24, 2014 at 04:55:50PM +0100, Ulrik wrote: > Hi, > > Fixing the flaw is not a good idea. A debian-developed new encrypted > file format just to salvage this package? Not a good idea. > > Alternatives: > > 1) Remove it > 2) Document the flaw directly in the package description, recomm

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-02-24 Thread Ulrik
Hi, Fixing the flaw is not a good idea. A debian-developed new encrypted file format just to salvage this package? Not a good idea. Alternatives: 1) Remove it 2) Document the flaw directly in the package description, recommend a better solution (gpg) directly in the package description. Alterna

Bug#700758: bcrypt: Bcrypt exposes patterns in data, it is broken

2014-01-12 Thread coldtobi
Package: bcrypt Followup-For: Bug #700758 -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I see two options: 1) Fix it 2) Remove it 1) Is probably out of scope (ends probably in a fork, breaks compatibiity...) Maybe it should be removed from Debian? (I think we need to maintain a certain level of