Not accredited. Assurance authority: none; self-asserted by the contributing author. Endorsement: none.
Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.
Assurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.
Debian 13 password hashing (yescrypt)
Passwords on Debian 13 (trixie) are stored as yescrypt hashes: a salted, memory-hard key derivation function. pam_unix hashes password changes made through PAM with its yescrypt option, and tools that bypass PAM follow ENCRYPT_METHOD YESCRYPT in /etc/login.defs.
Both are Debian 13 defaults. This component configures nothing: it asserts the defaults and ships a verification script that makes the assertion checkable, including by inspecting a hash actually stored for a throwaway account.
Purpose. Evidence that stored passwords use an approved, salted key derivation function (IA-5(1)(d)).
Properties
| os-distribution | debian |
|---|
| os-release | 13 |
|---|
| os-codename | trixie |
|---|
| setting | login.defs:ENCRYPT_METHOD |
|---|
| setting | pam_unix:hashing-algorithm |
|---|
| configuration | none; asserts Debian 13 defaults |
|---|
The SP 800-53 Rev 5 IA-5(1) password-storage statement, from oscal-content release v1.4.0.
IA-5(1) — Password-based Authentication
This component claims only IA-5(1)(d), password storage. The other elements of IA-5(1) are claimed by debian-13-pam-pwquality, or by no component; see debian-13-passphrase-hardening.
| Statement | Status | Description |
|---|
| (d) | implemented | Passwords are stored using yescrypt, a salted, memory-hard key derivation function: pam_unix.so names yescrypt in /etc/pam.d/common-password, and /etc/login.defs sets ENCRYPT_METHOD YESCRYPT. Verified by inspecting the hash stored when a… |
Configuration and scripts