Fedora 43 perl-Crypt-PBKDF2 Crucial Hashing Upgrade 2026-e8231b773d

PBKDF2 is a secure password hashing algorithm that uses the techniques of "key

strengthening" to make the complexity of a brute-force attack arbitrarily high.

PBKDF2 uses any other cryptographic hash or cipher (by convention, usually

HMAC-SHA2, but Crypt::PBKDF2 is fully pluggable), and allows for an arbitrary

number of iterations of the hashing function, and a nearly unlimited output

hash size (up to 2**32-1 times the size of the output of the backend hash).

The hash is salted, as any password hash should be, and the salt may also be of

arbitrary size.

This update addresses a number of security issues: Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) Generate salts using Crypt::URandom (a strong system RNG) instead of perl's builtin rand(), which is not cryptographically secure (CVE-2026-9638) Use a constant-time comparison in validate to avoid timing attacks (CVE-2017-20240)