Re: AS400 user password

["Leif Svalgaard" <leif@xxxxxxxx>]

> >A long password is not more secure than a short
> >password.
> 
> Is this correct ?
> 
> I only ask as having tried the decryption program, short
> passwords are solved much quicker than long ones (4 letter
> ones are solved in seconds , whereas 7 long ones take hours)
> 

If you are after anybody's password, it doesn't matter if
it takes seconds, minutes, or even hours. As long as it
is feasible to do it in a reasonable time the password
is insecure. If you can decrypt a password in 2 minutes
instead of 2 seconds, does not mean that the first is
60 times more secure.

What I really meant to say, though, was that since the
password is encrypted in pieces, it is the size of the
largest piece (7 characters) that determines the time.
The 8th, 9th, and 10th characters are part of the
last piece (only 3 long - so decrypts in seconds)).

A 7-character piece only takes a couple of hours on
average.


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---