Cyber ·
OpenSSH with musl libc: crypt() and timing measurements in password authentication
According to the text, an author posted on the oss-sec list, dated November 6, 2026, measurements of the values crypt() returns on failure and of password authentication times in OpenSSH with glibc/libxcrypt and with musl. The received excerpt is partial and includes no results.
The author says they would investigate two questions still under debate in the thread: what crypt() returns on failure in each implementation, and the timing question raised by Jeff. They state they measured both on their own machines.
The environments cited are OpenSSH 10.6p2 built with --without-pam; glibc 2.39 with libxcrypt 4.4.36 on Ubuntu 24.04; and musl 1.2.5 on Alpine 3.21. The test scripts and raw data are said to be available on request. The received text cuts off before the results, so this bulletin reports no conclusions.
The relevance lies in the authentication and system library topic, not in a Rota Nacional feature. The platform does not fix or assess this engineering question. To verify, search the public oss-sec list archive by thread title and check the date and full content before citing any result.
If you use AI to study the material, do not paste server configurations, host names, keys, logs or credentials. Use only public, sanitized excerpts.
Original source: Re: “sshole”: desvio da autenticação por senha no OpenSSH com musl libc