🚀 go-pugleaf

erc@cinenet.net (Eric Smith) writes:

>In article <409t0n$45p@odin.diku.dk>, Niels Ull Jacobsen <null@diku.dk> wrote:
>>shah@wg.com writes:
>>In this way, noone can get the original password even if they have
>>access to the encrypted version.

>But they don't need the original password to crack it.  All they need
>is any password that encrypts to the same result.  Can't they just
>look at the result and determine what pattern is needed in a password
>to generate that result?

The point of the encryption algorithm is to make this *hard*. A
(hypothetical) example:

You take the CRC32 of the first half and the last half of the password.
Now you use these values as seeds to two instances of your (custom)
random generator.  You generate two large numbers, mulitply them and
store the result.

This will (probably) make it rather hard to guess a password which
fits.

For a more scientific approach, check sci.crypt.
-- 
   Niels Ull Jacobsen, Dep. of CS, U of Copenhagen (null@diku.dk)
   Roenne Alle 3 st.th, 2860 Soeborg, Denmark, tel. +45 39 66 39 86