Instead of limiting the possible generated salts to 2^32 different ones, try to get some actual random bits and mix those in. Keep the old pseudo-random generation in place, so that even if open_read_close() fails or only returns a partial result, we're not doing any worse than previously.
In fact, even with /dev/urandom being unavailable, this might still improve things a bit since whatever sort-of random content might be in the p buffer on entry is then mixed in. Signed-off-by: Rasmus Villemoes <rasmus.villem...@prevas.dk> --- libbb/pw_encrypt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libbb/pw_encrypt.c b/libbb/pw_encrypt.c index 3de31f711..cbb1f36f0 100644 --- a/libbb/pw_encrypt.c +++ b/libbb/pw_encrypt.c @@ -37,8 +37,10 @@ static int i64c(int i) int FAST_FUNC crypt_make_salt(char *p, int cnt) { unsigned x = getpid() + monotonic_us(); + open_read_close("/dev/urandom", p, cnt); do { - *p++ = i64c(x); + *p = i64c(x + *p); + p++; x >>= 6; } while (--cnt); *p = '\0'; -- 2.40.1.1.g1c60b9335d _______________________________________________ busybox mailing list busybox@busybox.net http://lists.busybox.net/mailman/listinfo/busybox