Re: Rewarding Challenge AS/400

let me clarify. there are actually TWO encrypted values stored in
the user-password table QSYUPTBL. One is the user id encrypted with
the password, the other is a secret unique key encrypted with the password.
The latter is the easier one. If you have access to the first you also have
access to the second. Both can be decrypted by brute force. There is a
program you can download from the internet that does this.
On a 500 MHz PIII or equivalent the latter takes at most 6.7 hours while the
first takes at most 40 times as long. So send me the second of the two
encrypted values. Also send the password to someone else on the list
so the validity of my decryption that be verified. The encryption method is
in both cases 56-bit DES, which is strong enough at it is. The reason we
can crack the encryption is the limited key space (only 40 different symbols)
and the crummy way IBM has applied the (otherwise strong) DES algorithm.

----- Original Message -----
From: <leif@ibm.net>
To: <MIDRANGE-L@midrange.com>
Sent: Friday, September 17, 1999 8:57 PM
Subject: Re: Rewarding Challenge AS/400


> I'll take you up one that one.
> I'll decrypt it in less than a day.
> ----- Original Message -----
> From: Steve Glanstein <mic@aloha.com>
> To: mr <midrange-l@midrange.com>
> Cc: Leif Svalgaard <leif@ibm.net>
> Sent: Friday, September 17, 1999 4:32 PM
> Subject: Rewarding Challenge AS/400
>
>
> >
> > >The encryption method **may** change from release to release, but
between
> > >machines on the same release, and from what I've played with, it
**seems**
> > >the same method but who really knows ?
> >
> > It is the same method. For example, the encrypted password for user TEST,
> > password TEST is 50C8C4C683D60CE2. This is the same on V1R2 through V4R3.
> >
> > This encryption is done with both user id and password. No other parts
are
> > needed. For example, if you replace another password for TEST with the
> > above hex then TEST will have a password of TEST.
> >
> > Unfortunately the software vendor (you know who I mean!)doesn't have
> > enough confidence in the encryption technique to permit public analysis
> > and verification that it is truly one way.
> >
> > The answer to people who can crack the AS/400 password...I'll send them
the
> > encrypted password and see if they can decrypt it! This was done several
> > times with PGP and the network went silent.
> >
> > Steve Glanstein
> > mic@aloha.com
> >
> >
> > +---
> > | This is the Midrange System Mailing List!
> > | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> > | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> > | To unsubscribe from this list send email to
> MIDRANGE-L-UNSUB@midrange.com.
> > | Questions should be directed to the list owner/operator:
> david@midrange.com
> > +---
> >
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---