How to use SHA-256 crypt with musl?

Question

I am using musl: https://www.musl-libc.org

If i browse the repository i can see that there are a bunch of crypt related source files (including crypt_sha256.c).

The problem is that there are no header files for them. How am i supposed to use them?

These are the symbols from the lib on my system:

sha256_sum

I could also not find any code samples from google how to use the SHA-256 features of musl.

Thanks!

you should accept R.s answer ;) can't be straighter from the horse's mouth — Antti Haapala -- Слава Україні, Jan 24 '20 at 14:38
I think Ctx answered the question as stated plenty well; my answer just provides additional information. I'm happy for others to get the rep too; I sure don't need it. — R.. GitHub STOP HELPING ICE, Jan 24 '20 at 16:18

Antti Haapala -- Слава Україні · Answer 1 · 2020-01-24T10:58:59.303

3

That's not generic SHA-256 message digest algorithm but a specific algorithm used by the crypt(3) password hashing function. See the documentation for that function on how it is used.

edited Jan 24 '20 at 10:58

answered Jan 24 '20 at 10:52

Antti Haapala -- Слава Україні

129,958
22
279
321

score 3 · Accepted Answer · answered Jan 24 '20 at 11:52

3

You are correct, that the three functions

sha256_init()
sha256_update()
sha256_sum()

are indeed generic SHA256 hash functions.

Unfortunately, these symbols are not exported publically, but only used internally to generate a salted password hash of the form $5$0rXgD0/KkyyT0$5PPj3bke0vPxsMDlSXzBz2D3TFNahLrXSs7.elU3u2/

For that reason, no public header files for use of these functions are provided. Only the higher-level function crypt_sha256() is exported.

Why they decided to not export the generic interface can only be speculated about, at least I could not find an explanation for that.

answered Jan 24 '20 at 11:52

Ctx

18,090
24
36
51

I can answer that. :-) – R.. GitHub STOP HELPING ICE Jan 24 '20 at 14:10
Done. Would have done sooner but my isp was crapping out while I was trying to post. – R.. GitHub STOP HELPING ICE Jan 24 '20 at 14:23
The crypt.h used to come in the package musl-dev in Ubuntu 20 but not in 22, any idea how to fix the missing header? – teknopaul Oct 15 '22 at 19:56

score 3 · Answer 3 · answered Jan 24 '20 at 14:19

As Ctx wrote and commented about not knowing the reason for, these functions are not exported. I can fill in that reason.

Generally, musl does not unilaterally invent new interfaces that will almost surely end up differing in subtle ways from similar interfaces other libc providers end up inventing. We are in the process of launching a cross-libc collaboration group less formal than the POSIX standardization process that might make it reasonable to offer some interfaces like this in the future, and that might eventually funnel some of the consensus that emerges upstream to POSIX.

Short of that, anyone wanting to use these implementations is welcome to copy the code and use it under the terms of the license. They're small, self-contained, and permissively-licensed, and by using them this way you don't lock in the signature for any external interface boundary. As usual with cryptographic code, though, you should be careful of any risk of side channels leaking secrets. As used in musl I don't believe that's an issue, but I haven't analyzed other possible uses, and it might be safer to pick an implementation designed for use in arbitrary cryptographic settings.

Thanks for your explanation, I can understand this reasoning. — Ctx, Jan 24 '20 at 14:25

How to use SHA-256 crypt with musl?

3 Answers3