Bug 272902 - Security: allow passphrases for WPA-EAP to be saved without using clear text in a world-readable file
Summary: Security: allow passphrases for WPA-EAP to be saved without using clear text ...
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL: https://unix.stackexchange.com/q/2789...
Keywords: security
Depends on:
Blocks:
 
Reported: 2023-08-02 21:58 UTC by Graham Perrin
Modified: 2023-08-02 22:09 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Graham Perrin 2023-08-02 21:58:12 UTC
% ls -hln /etc/wpa_supplicant.conf
-rwxrw-r-x  1 0 0  1.4K  2 Aug 11:15 /etc/wpa_supplicant.conf
% 

Connection to eduroam works if a clear text password is saved in this world-readable file.

wpa_passhrase(8) can generate a 256-bit pre-shared WPA key, for example: 

wpa_passphrase eduroam

If the key (and not the clear text password) is saved in wpa_supplicant.conf(5) then there will be no connection to eduroam. 

Keyword: security, however there's no need to obscure this bug report; the clear text issue is well-known. 

Bug severity: minimal, because this is an enhancement request.
Comment 1 Graham Perrin 2023-08-02 22:09:48 UTC
I bookmarked the question in Stack Exchange in 2017. Please note that neither of the answers is accepted. 

<https://unix.stackexchange.com/a/278948/13260> suggests: 

echo -n plaintext_password_here | iconv -t utf16le | openssl md4

The result, with FreeBSD 14.0-CURRENT: 

Error setting digest
0020A1D581210000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:/usr/src/crypto/openssl/crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (MD4 : 71), Properties ()
0020A1D581210000:error:03000086:digital envelope routines:evp_md_init_internal:initialization error:/usr/src/crypto/openssl/crypto/evp/digest.c:254:


% uname -aKU
FreeBSD mowa219-gjp4-8570p-freebsd 14.0-CURRENT FreeBSD 14.0-CURRENT amd64 1400093 #1 main-n264312-789df254cc9e-dirty: Tue Jul 25 11:18:53 BST 2023     grahamperrin@mowa219-gjp4-8570p-freebsd:/usr/obj/usr/src/amd64.amd64/sys/GENERIC-NODEBUG amd64 1400093 1400093
%