RE: Display User Password?

[Don <dr2@xxxxxxxxxxxx>]

Dale,

I suggest you checkout Bruce's book "Applied Crytography" and get on his
mailing list for his newsletter www.counterpane.com as I recall..

Don in DC

On Wed, 29 Sep 2004, Dan Bale wrote:

> > So a prerequisite is that you need to be able to know when the correct
> > answer is discovered.  To do that offline (e.g., with the program Phil
> > and I are talking about), you need the encrypted version of the
> > password and the program needs to know the correct encryption method
> > to use so it can compute a potential ciphertext and compare to the
> > desired ciphertext.
>
> This is an interesting topic.  I know the horse has been beaten before, but
> I've never understood the bruteforce method.  How does the password cracker
> program *know* when it has found the "clear text" password?  How does it
> know that "WHNPIGSFLY" is correct and "$YEAHRIGHT" or "eW_O7q&-8" or any
> other result is not?  Does not each permutation generate a result, even if
> it's full of hex bytes we'd never be able to type?
>
> db
>
> > -----Original Message-----
> > From: midrange-l-bounces@xxxxxxxxxxxx / Douglas Handy
> > Sent: Wednesday, September 29, 2004 12:46 AM
> >
> > Jim,
> >
> > >is there such a thing as a pwd that cannot be brute forced?
> >
> > Well, there needs to be some mechanism for testing each brute force
> > attempt.  Even with OS/400's silly default restrictions on passwords
> > characters and some technical reasons why 8-10 character passwords are
> > basically the same strength as 7 character passwords, you still have a
> > potential namespace of 126,030,769,230
> > possibilities.
> >
> > Obviously, you wouldn't want to try typing those into a sign-on
> > display, regardless of how many attempts you were allowed before it
> > disabled the user or ws profile.
> >
> > So a prerequisite is that you need to be able to know when the correct
> > answer is discovered.  To do that offline (e.g., with the program Phil
> > and I are talking about), you need the encrypted version of the
> > password and the program needs to know the correct encryption method
> > to use so it can compute a potential ciphertext and compare to the
> > desired ciphertext.
> >
> > On my PC, it can test over 19 million of those per *second*.
> >
> > The same program would not work for systems using the 128-char
> > password support, for at least two reasons:
> >
> >  1) the encryption method is different, so you need a different cracker
> >  2) the possible permutations is many magnitudes of order higher
> >
> > Thus even if you had an equivalent cracker program and knew the
> > encrypted form of the password, it may take a prohibitively long time
> > to discover the correct plaintext form.
> >
> > Social engineering would probably be a faster way of obtaining
> > the password.
> >
> > Doug
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>