> Is that necessary ? Would'nt it be enough just to make two versions of
> libc or libcrypt, one with full implementation and the other with just
> dummy functions that would do nothing. Then one just would need to get
> the library and let dynamic linking do it's magic.

nope, it's not that easy.  there is a set (though small) of things
which contain crypt() that are (and MUST BE) statically linked.

The one example that hops to mind is /sbin/init.

As for distribution of e.g. the passwd file:
the passwd file as shipped contains no passwds, so that's not a
problem.

Having a seperate "security dist" also helps in the Kerberos case --
kerberos is a bit harder to remove from the tree than is crypt(),
however, from what i've heard, various US gov't agencies are moving
to allow DES in general to be freely exportable, so, perhaps some
time in the near future this point will be moot.



cgd

------------------------------------------------------------------------------