🚀 go-pugleaf

shulick@navajo.ucs.indiana.edu (Sam Hulick) writes:


>Someone said that they, provided an encrypted DES password
>(e.g. nC25oUpKKpq83), can take that encrypted password and DECRYPT IT,
>resulting in the actual user's password.  How possible is this?  Can someone
>e-mail me the documentation on how DES works, exactly?

>-- 
>Sam Hulick          | "The worst sin towards our fellow creatures is not to
>shulick@indiana.edu | hate them, but to be indifferent to them: that's the
>(NeXTmail welcome)  | essence of inhumanity."  --George Bernard Shaw

Interesting. Do you know the "Someone"?  Is this someone willing to
share the technique?

The password algorithm is not exactly DES ( Look in for example
Numerical Recipies by Press et al for a description of DES). It uses the
password as the key to encrypt the message 00000000 (doing an extra
permutation using the salt- the first two characters of the encrypted
password). So what this person is claiming is that given the encryption 
of this single known text 00000000 they can recover the key. This of
course would be a stupendous achievement, and would make all banking etc
transactions open. If this someone is a crook, they can make a mint, but
it is your duty to report them to the authorities or you are also liable
for their activity. If they are Honest, they must immediately report
this breakthrough to NSA  and to the world.
Now, of course they may simply mean that they can do a search, trying
all (likely) passwords and seeing if they come up with the encrypted
string. If they do they have guessed the answer. There is even a program
(Crack) to automate this with a large list of likely passwords ( large
but still a factor of a few billions smaller than the set of all
possible passwords--No I didn't calculate that "billions"- Corrections
welcome).). 
Bill Unruh
unruh@physics.ubc.ca