Re: Rewarding challenge AS/400...

> Bruce,
>
> > I don't understand why having password limiting system values would
> > lead to the conclusion that the method of encryption is not strong.
> > Could you expand on this?
>
> Sure.
>
> There are, as you know, a number of system values that limit what you can
> choose as a password. The
> system value in questioning the encryption strength is QPWDPOSDIF. This
> sysval stops you from changing your password from ABC1 to ABC2, because the
> ABC are still in the same place. One of the things that makes an encryption
> algorithm strong is the ability to hide the 'positional information' about
> the text being encrypted, because if your encrypted strings for ABC1 & ABC2
> end up, for example as C1C2C3F1 and C1C2C3F2, then it makes it very simple
> (simple in relative terms in cryptology) to determine/reverse the
encryption
> algorithm hence my point that the encryption method cannot be very strong
> (again, strong in cryptology terms).
>
> My point being that if IBM is saying there is no way to decrypt the
password
> then the encrypted password must be 'showing' the positional information
for
> the code to determine the positions of the characters in the old password
> verses the new password.


you don't need to decrypt the old password to check the positional
information.
When you are forced to change your password at signon time, you GIVE both
your old password and the new one.  If you use CHGUSRPRF to change your
password, none of the system values QPWD* are effective (that is to say:
not enforced) so again no problem.


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---