Subject: Re: Passwords over 8 letters

From: [email-masked]
Date: Wed, 6 Nov 1996 01:17:54 EST

** Reply to note from [email-masked] Tue, 5 Nov 1996 09:04:55 -0600 (CST) 
>    
>    
> Up to 8 character passwords is standard crypt() behaviour.  The only 
> options I know of for extending that are to go to doublewide shadow 
> passwords, but that seems to actually ease the process of breaking the 
> encryption.  I know there are other schemes available for longer pass 
> phrases, but they would require source hacks. 
>    
>    -- Michael 
 
Honestly? How is this possible? I thought that with an increase of 
password size, you also increased the difficulty? Is this just with 
the doublewide shadow implementation? 

========================================================================= 
= Clifton Wood       | "Tis better to worry for nothing than to not worry   
- Software Engineer  |  and meet Mr. Murphy when you are the least  
- TeleWorks, Inc.    |  unprepared for him." - Overheard at a bar.

---

From: Michael Brennen <[email-masked]>
Date: Wed, 6 Nov 1996 09:26:13 -0600 (CST)

I'm not a cryptographer at all, but I do try to at least follow the issues
a bit to stay up with where the weaknesses are.  The problem is the way
the doublewide encryption is done. Per the shadow password docs, it is
done in two stages, and the way it is done leaves a more predictable text
pattern in the encrypted password so that cracking it can become easier. 
I do not know the effort to do so; DES cracking is already essentially out
of range for all but the very largest companies and governments, and I
don't know how quantifiably easier this makes it. 

   -- Michael