🚀 go-pugleaf

[Note the Followup-To:.  The (ridiculously long) list of newsgroups all
seem irrelevant to technical password issues.  If you know of a better
place than comp.misc, feel free to move this there.]

> That reminds me of a question I had:

> Is it possible for a person to have 2 passwords for 1 account?

> Here is my reasoning:
> When your password is checked, what you type (as your password) is
> encrypted and compared with the entry in /etc/passwd.  (There is no
> decryption algorithm.)

Or rather, decryption is computationally expensive; the security of it
depends on the assumption that it's sufficiently expensive to be
infeasible.  A trivial decryption algorithm exists; just try all 128^8
possible passwords.  (Yes, I know the number is actually a bit less
than 128^8.  The exact number is irrelevant to my point.)

> If the encryption guaranteed that no 2 passwords would have identical
> encrypted forms, that would seem to make it easier to crack.

Would it?  I'm not enough of a cryppie to be sure, but it's not clear
to me that it would.

> So it seems more likely that no such guarantee exists.  Therefore 2
> passwords might work for the same account.

> Am I right?

As I understand it, you are correct in that no attention has been paid
to the possibility that two typed strings may generate the same hashed
password.  Aside from the trivial observation that all strings are
truncated to eight characters and thus characters past the eighth are
ignored, though, finding the second string would be as hard as breaking
the original password (harder, in fact, since the original password is
probably something relatively easy to type, while the "other" password
is likely to contain garbage like control characters).

It is unlikely, though, since the password hash takes a 56-bit typed
password and generates a 64-bit hash.  With a hash space 256 times as
large as the input space, it's extremely unlikely that any given input
string will have an "alias", another string that hashes to the same
thing.

Thus, it's a theoretical possibility, but not exactly something you
should lose any sleep over.

					der Mouse

			    mouse@collatz.mcrcim.mcgill.edu