[1582] in bugtraq
Re: passwd hashing algorithm
daemon@ATHENA.MIT.EDU (Charlie Watt)
Sat Apr 22 18:20:21 1995
From: Charlie Watt <watt@sware.com>
To: de5@sws5.CTD.ORNL.GOV (Dave Sill)
Date: Thu, 20 Apr 1995 14:59:58 -0400 (EDT)
Cc: watt@sware.com, fitz@wang.com, bugtraq@fc.net
In-Reply-To: <199504201812.SAA00843@sws5.CTD.ORNL.GOV> from "Dave Sill" at Apr 20, 95 06:12:34 pm
-----BEGIN PRIVACY-ENHANCED MESSAGE-----
Proc-Type: 4,MIC-CLEAR
Content-Domain: RFC822
Originator-Certificate:
MIIBwDCCAWoCEQC43J7oZ50NWTRSVBShvvaXMA0GCSqGSIb3DQEBAgUAMFkxCzAJ
BgNVBAYTAlVTMRgwFgYDVQQKEw9TZWN1cmVXYXJlIEluYy4xFzAVBgNVBAsTDlNl
Y3VyZVdhcmUgUENBMRcwFQYDVQQLEw5FbmdpbmVlcmluZyBDQTAeFw05NDA0MDUx
NzA2NDJaFw05NTA0MDUxNzA2NDJaMHAxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9T
ZWN1cmVXYXJlIEluYy4xFzAVBgNVBAsTDlNlY3VyZVdhcmUgUENBMRcwFQYDVQQL
Ew5FbmdpbmVlcmluZyBDQTEVMBMGA1UEAxMMQ2hhcmxlcyBXYXR0MFkwCgYEVQgB
AQICAgQDSwAwSAJBDNmUqe2+nqg6iuUWzxaXegxki426RzmVNO6VHHYCV4nbo/WL
X9a7Jn/2nWqZUK/l+RXqCHU/21Ur9jFIt4GNHhcCAwEAATANBgkqhkiG9w0BAQIF
AANBAEY6kP5jHqK9B9PhZCCJ9mckYuKMufWr7l61LulXGwUTqFzjFC0MOYwXo5s+
8lqrLQ7YpTzyE74pKR1cl5TAUU4=
Issuer-Certificate:
MIIBkDCCAToCEQCFP7oDPZq0SSDfetbu5nSkMA0GCSqGSIb3DQEBAgUAMEAxCzAJ
BgNVBAYTAlVTMRgwFgYDVQQKEw9TZWN1cmVXYXJlIEluYy4xFzAVBgNVBAsTDlNl
Y3VyZVdhcmUgUENBMB4XDTk0MDQwNTE3MDQyM1oXDTk1MDQwNTE3MDQyM1owWTEL
MAkGA1UEBhMCVVMxGDAWBgNVBAoTD1NlY3VyZVdhcmUgSW5jLjEXMBUGA1UECxMO
U2VjdXJlV2FyZSBQQ0ExFzAVBgNVBAsTDkVuZ2luZWVyaW5nIENBMFkwCgYEVQgB
AQICAgADSwAwSAJBAL4Od/KxhOB6HyUbBJC2X6Ic2P0XEcGnddzJ1QEHjSFyx5qz
n098ScMWDEJSiwrsVmQFbNvN01hkke7ZE21aG5sCAwEAATANBgkqhkiG9w0BAQIF
AANBAIBzwWRF5SkoGAdcliVyog2caFtsPrq7lyBIp562B+ckFNderoDTc+JW+i4f
MhnY9Q9I2KrlZV4GqcpZ+GjAeNk=
MIC-Info: RSA-MD5,RSA,
DHXK1gFgnW4z6WhdO2LUQjoUvLZ77mAzN+XGLcckFlabwPbzIS/ulDQT3g3qpwmb
pH67h9MMxVasMzMiPsGBYP4=
X-Sensitivity-Label: 1,CMW+3.0/SCO_2.1/sware.com,UNCLASSIFIED
X-Information-Label: 1,CMW+3.0/SCO_2.1/sware.com,UNCLASSIFIED
>
> Charlie Watt <watt@sware.com>
> >
> >As you point out, a better cryptographic linkage between blocks would
> >force the attacker to search the full password space for a given multiblock
> >password rather than break it down into separate 8 byte searches. We will
> >incoporate this into our next release. Thanks for the feedback.
>
> Why not just use md5 instead?
>
> -Dave
We provide hooks into the password mechanism so that an installation
can easily insert a site specific hashing scheme. The default mechanism
is based upon crypt() purely for marketing reasons -- that is the
way it has always been done and that is the way that most customers
feel comfortable. It seems that "extensions" to the hash using crypt()
that work the same as standard Unix for passwords <= 8 bytes but that can
also accommodate longer passwords is an easier sell than something perceived
as radically new and unproven. We do have more sophisticated customers who
prefer to install their own algorithms. MD5 would be a reasonable choice,
but even it would be judged inadequate (ONLY a 16 byte password hash space!)
by some customers.
Charlie Watt
SecureWare, Inc.
-----END PRIVACY-ENHANCED MESSAGE-----
