[12528] in bugtraq
Re: Insecure handling of NetSol maintainer passwords
daemon@ATHENA.MIT.EDU (Trevor Schroeder)
Thu Nov 11 12:50:33 1999
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <19991111002226.8E3681563@duckdog.zweknu.org>
Date: Wed, 10 Nov 1999 18:22:26 -0600
Reply-To: Trevor Schroeder <tschroed@ACM.ORG>
From: Trevor Schroeder <tschroed@ACM.ORG>
X-To: Jefferson Ogata <jogata@NODC.NOAA.GOV>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <38287ADC.23E073B2@nodc.noaa.gov>
On Tue, 9 Nov 1999, Jefferson Ogata wrote:
> generate with their New Contact Form web system runs the password you
> enter through crypt(), but the first two characters of the encrypted
> value (the salt) are the same as the first two characters of the
> password, indicating they use the password as its own salt. This
> dramatically limits the usefulness of encrypting the password in the
> first place, since you've already given away the first two characters,
> and probably hamstrung the whole algorithm at the same time. (More
> advanced crypto people than I can comment on this.) In any case,
Your damn tooty this isn't the way to do this!! If anyone gets ahold of
your crypted password, they've got the first two chars of the password
making the guess significantly easier.
crypt() basically DES encrypts 0 with your password as the key. That's why
it's 8 chars. 8 ASCII chars = 7 bits/char * 8 char = 56 bits.
2^56 = 72057594037927936 possible keys.
Of course, 7 bits => 128 chars, but we must subtract the 32 control chars which leaves us with 96 textual characters (including spaces).
Now our keyspace is 96^8 = 7213895789838336, roughly 1/10th of the previous
keyspace, but not unreasonable for non-critical applications. (ie, nothing
to trust your credit card to, but a non-trivial key nonetheless).
However, if we can get the first two characters of your password, assuming
that the rest is randomly distributed (ie, no dictionary based passwords),
that leaves us with 6 unknown chars.
Our unknown keyspace is now 96^6 = 782757789696, just over 1/10000th the
previous and 1/100000th the space of a full 56 bit key. This leaves us
with roughly 40 bits (log2(782757789696) = 39.5) of entropy--again,
assuming random characters.
40 bits keys can be broken pretty quickly.
..........................................................................
: "I knew it was going to cost me my head and also my swivel chair, but :
: I thought: What the hell--better men than I have risked their heads :
: and their swivel chairs for truth and justice." -- James P. Cannon :
:........... http://www.zweknu.org/ for PGP key and more ................:
