Re: [PATCH docs v2 2/2] pveum: document that the pve realm now uses yescrypt

["Shannon Sterz" <s.sterz@proxmox.com>]

On Wed Oct 21, 2026 at 3:57 PM CEST, Maximiliano Sandoval wrote:
-->8 snip 8<--

>> +`/etc/pve/priv/shadow.cfg`. Passwords are hashed and salted using the yescrypt
>> +algorithm footnote:[yescrypt https://www.openwall.com/yescrypt/]. It provides
>> +strong protections against offline password cracking attempts. This realm is the
>
> nit: Perhaps /protections/protection/?

No protections is right. It offers tunable hardness for all three the
runtime, memory usage and parallelism. So I'd say those are multiple
protections.

>
>> +most convenient realm for small-scale (or even mid-scale) installations, where
>> +users do not need access to anything outside of {pve}. In this case, users are
>> +fully managed by {pve} and are able to change their own passwords via the GUI.
>> +
>> +NOTE: Passwords created with older versions of Proxmox VE  used a hashing scheme
>
> nit: This should be '{pve}' rather than 'Proxmox VE '.

Yep will update this for a potential v3. Same for the related PMG patch.

>
>> +based on SHA-256 that is now considered insecure. If the file
>
> nit: By whom? Is there any good source to link here?
>

> The default processing cost parameter is 5000, which is too low  for  modern
> hardware.
>
> - man 5 crypt

We never modified the default of 5000. So technically if you want to
capture all nuances here, the function itself *could* still be fine.
However, the way we used it wasn't (incidentally, SHA-256 is still used
by yescrypt, just in a different construction).

I'll add that to the commit message of the first patch for more clarity,
but I think for the docs the text is fine as-is. What's important for
users is that if they see a `$5$` in that file, they should log in again
or, alternatively, set a new password (e.g. by having an admin account
set a new password for that account).

Note that PDM and PBS already use yescrypt for that reason [1].

[1]: https://lore.proxmox.com/all/20240306123609.164021-7-s.sterz@proxmox.com/

-->8 snip 8<--