Arch Linux: Changes to default password hashing algorithm and umask settings

[NewsBot]

A new Arch Linux blog post/announcement has been posted!

With shadow >= 4.14.0, Arch Linux's default password hashing algorithm changed from SHA512 to yescrypt [1].

Furthermore, the umask [2] settings are now configured in /etc/login.defs instead of /etc/profile.

This should not require any manual intervention.

Reasons for Yescrypt

The password-based key derivation function (KDF) and password hashing scheme yescrypt has been chosen due to its adoption (readily available in libxcrypt, which is used by pam [3]) and its stronger resilience towards password cracking attempts over SHA512.

Although the winner of the Password Hashing Competition [4] has been argon2, this even more resilient algorithm is not yet available in libxcrypt [5][6].

Configuring yescrypt

The YESCRYPT_COST_FACTOR setting in /...

Get the full details here: Arch Linux - News: Changes to default password hashing algorithm and umask settings