Re: Rewarding Challenge AS/400

Doug, there are TWO encryptions.
One is the user-id encrypted with the password (that's the one you tried).
The other is a secret key encrypted with the password and it splits the
password in two pieces, one seven chars long for the first 8 bytes of
the encrypted value, and the rest 3 chars long for the second 8 bytes.
Try to look at the bytes following the ones you were looking at and
you can see it clearly.

----- Original Message -----
From: Douglas Handy <dhandy@isgroup.net>
To: <MIDRANGE-L@midrange.com>
Sent: Tuesday, September 21, 1999 3:49 PM
Subject: Re: Rewarding Challenge AS/400


> Leif,
>
> >BTW, there is no extra security in having a password longer than seven
> >characters. You can safely cut it to LXPQ94K and save yourself some
typing.
>
> Are you sure it is 7 characters not 8?
>
> The normal DES-56 uses 8 bytes for the key, but drops every 8th bit so
> only uses 56 of the 64 bits.  However 7 of the 8 bits in the 8th byte
> are used in the cryptokey (in normal DES-56), although I do not
> pretend to know if the 400 uses the same implementation and/or if the
> encryption key is other than the first 8 bytes of the password.
>
> ** Later **
>
> OK, I just ran a little test with user-id TEST and the following
> passwords, then checked the encrypted password, and it seemed to
> verify my assertion:
>
>  LXPQ94K       = D836DB87 D883E5A4
>  LXPQ94K$     = 5CF3B56B 2922B4A2
>  LXPQ94K$_   = 5CF3B56B 2922B4A2
>  LXPQ94K$_Y = 5CF3B56B 2922B4A2
>
> Of course, other things in the profile change when the password is
> over 8 bytes long.  But I agree the strength of the security does not
> improve over 8 bytes (of which 56 bits are used).
>
> Doug
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---