🚀 go-pugleaf

bdiesel@aztec.co.za@aztec.co.za writes:

>In <NEWTNews.807898837.21140.shah@shah.wg.com>, shah@wg.com writes:
>>
>>Hi there !
>>
>>I am developing a windows 3.1 app.  This app needs to authenticate a user 
>>login by the user name and his/her password.  I need to store this password in 
>>some sort of a format in some sort of a file (maybe an ini file).  But first I 
>>need to encrypt this password and later on de-crypt to check against the 
>>entered password (or maybe there is a better way - I just don't know yet).  
>>Could any of you please point me in a better way or point me to some known 
>>used technique for this procedure ?

> The best way I know of is to use a one-way function or a hash
> function.  This is essentially an algorithm that takes some data and
> encrypts it in such a fashion that the original information cannot
> be recovered in any way (hence the name one-way function).
Right.
> The ciphered data is unique!! ie there is a one to one mapping from
> input to output.

Wrong. This is not necessary and usually won't be true. It doesn't
really matter whether MySecretPassword and d2kj32#Ag$a1 both are coded
to 3df3df20.@An35.  The point is that you can't (in a reasonable
time) get any of them given only the encrypted string, 3df3df20.@An35. 

>  Thus when a user sets a password, the cipher text
> is computed and stored (in a clear file).  When the user then enters
> his password, the password is passed through the same algorithm and
> then compared with the stored cipher text.  If they are the same the
> password is accepted.  This means that the ciphered password never
> has to be deciphered which means that it is difficult to break.  I
> believe this technique is used extensively for storing and checking
> passwords in Unix.

Right.

If you have access to the encrypted strings, the scheme CAN be broken
simply by encoding EVERY possible password (up till say 8 characters)
and comparing the resulting values with the encrypted strings. The
only problem is that there are a LOT of 8 character strings, so it'll
take a bit of time.

Of course, you could start by trying every word in the dictionary, all
the names from the Atlas and all the characters in "Lord of the
Rings". This is feasable and have been done. 

Some systems even check this when the user is changing his password and disallows these words.

Therefore, dear user: 

1. Never use an existing word or name as a password. Use something
unintelligible, like mine: "preKrof"

2. Never reveal your password to anyone.


>Cheers
>   Bruce Diesel 

-- 
   Niels Ull Jacobsen, Dep. of CS, U of Copenhagen (null@diku.dk)
   Roenne Alle 3 st.th, 2860 Soeborg, Denmark, tel. +45 39 66 39 86