#1144310 ITP: rust-md4 -- MD4 hash function - Rust source code

Package:
wnpp
Source:
wnpp
Submitter:
Peter Pentchev
Date:
2026-08-17 10:59:02 UTC
Severity:
normal
#1144310#5
Date:
2026-08-13 13:57:05 UTC
From:
To:
* Package name    : rust-md4
  Version         : 0.11.0
  Upstream Contact: The RustCrypto Project Developers
* URL             : https://github.com/RustCrypto/hashes
* License         : Expat or Apache-2.0
  Programming Lang: Rust
  Description     : MD4 hash function - Rust source code

 This is an implementation of the (really weak!) MD4 hash
 algorithm in Rust. Its only purpose in the Debian archive is
 to allow the build of the donkey S/Key one-time-password tool.

I intend to maintain this package within the Rust team.
#1144310#10
Date:
2026-08-14 05:53:07 UTC
From:
To:
Hello Peter,

If it should only be used by this password tool, and it is a very weak algorithm, would it be an option to remove all invocations of the MD4 hash code in the upstream code?

With kind regards,
Roland Clobus
#1144310#15
Date:
2026-08-14 07:46:05 UTC
From:
To:
TBH, I'd been leaning towards that myself (in my role as upstream).
And yes, I think it's actually time to make the S/Key MD4 support
an explicit non-default build-time option, and do MD5 by default;
that's what FreeBSD's security/opie port does by default, too.

So... yeah. Thanks for challenging me on this (to be completely honest,
part of me was maybe hoping somebody would, and that's partly why
I decided to file an ITP for this library...) ...and sorry for the noise.

G'luck,
Peter
#1144310#20
Date:
2026-08-17 10:57:03 UTC
From:
To:
The Debian NEW review of rust-md4 0.11.0-1 has been completed.

Decision: REJECTED
Reviewer: Mechtilde Stehmann

Review comment:

as requested

Full review details: https://dfsg-new-queue.debian.org/reviews/rust-md4