Re: AS/400 Rewarding Challenge

There is nothing wrong as such with the DES. It is the way IBM has
applied it that is crummy. Trust them to screw up MD5 as well.
BTW: IBM already knows all of this (and have for months). It is
just that they ain't telling their customers that. I had kind of
expected that they a long time ago would have taken out a front
page add in the Wall Street Journal, alerting their customers
to this serious flaw, and promising an immediate fix downloadable
on the spot. But no, that didn't happen.

----- Original Message -----
From: Steve Glanstein <mic@aloha.com>
To: mr <midrange-l@midrange.com>
Cc: Leif Svalgaard <leif@ibm.net>
Sent: Tuesday, September 21, 1999 2:17 PM
Subject: AS/400 Rewarding Challenge


> >-----------------------------
> >
> >>Date: Mon, 20 Sep 1999 20:14:50 -0500
> >>From: leif@ibm.net
> >>Subject: Re: Rewarding Challenge AS/400
> >
> >>From: Steve Glanstein <mic@aloha.com>
> >
> >> The answer to people who can crack the AS/400 password...I'll send them
> the
> >> encrypted password and see if they can decrypt it! This was done several
> >> times with PGP and the network went silent.
> >
> >you are awfully silent right now, Steve.
> >What gives?
>
> Leif et al:
>
> I've read some information that shows that the AS/400 password encryption
> is not cryptographically sound. I am currently in contact with an
> individual who says he can brute-force crack the password. He has a sample
> and I expect a result in about a day. Based upon what I have read, I expect
> the gentleman to succeed. After receiving physical proof of this, I can
> pass it on to the world.
>
> I certainly hope that IBM can fix it...even a simple MD5 encryption would
> be better than what I've read.
>
> Steve Glanstein
> mic@aloha.com
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---