// COMPLETE THREAD

Unix User Password File Encryption

3 expanded posts ยท every known parent and child

NODE 077699f2Unix User Password File Encryption
Ok, I realize that you cannot reverse the encryption process for a Unix
password..  But --  Explain to me why the following wouldn't work.  And if
it could work, I am willing to do the algorithms and math for this...  I'm
no good at coding and such..  But I can do algorithms and a lot of math
easily enough *shrug*....  And if anybody uses this idea ---  Please give
me credit for the idea..  If it has already been tried --  Can someone
please refer me to where it was tried, adn if there are any texts on it..
I would like to read them..  Thanks ok here it is:

Normal Programs for Cracking a Unix password file, such as CrackerJack
take a word, use the salt in the password file for that password, encrypt
the word using that salt, and then compare what it comes out as.  If it
isn't the same, it moves on to the next word.   My idea is similar to
this, but is a bit different.

Basically it would take a beginning word and encrypt it with the same salt
as used on the password in the passwd file.  So let us say that for an
example our salt is aa, our outcome encrypted password is X8mfjs53D ...
Ok now let us say that we take this salt of aa and run through the
following into it and getting these patterns from it (these aren't the
true patterns etc, I'm just making htese things up, but would it be
possible?)  

salt aa  --  inputed password  0001  --  outcome encryption  Zkdrj234S
salt aa  --  inputed password  0002  --  outcome encryption  Rksjr342s
salt aa  --  inputed password  0003  --  outcome encryption  25Svj43zY

(For the following process we'd obviously use mor ethan three, we would
probalby use a thousand at least, nad have them be all sizes of passwords
and combiantions..  like aaaab or abababababab and so on...)

Compare the outcomed encryptions --  And find a pattern in them..  Now in
the above I'm just going to say like it comes out as 
8x + 4/y - SQ(2z) + 4a = encrypted password..  Where xyza are each of the
characters respectively such as   0000 
                                  xyza  based on a 255 or however many
ascii char system..  I know this is completely wrong for what I've done
here, but I'm not doing the math or anything right now, I'm just making it
up as I go for an example...  Now say that since we have found the
pattern...  We take the outcome --  Do the algebra to figure out what the
xyza would be..  And ther eya go woopity doo there is the password..
Not as simple as I've said here of course..  It would be a lot more
complex..  But that is the basic idea...   What is wrong with this idea?
--  If it is something I have thought of, and havent' mentioned --  I'll
inform you when you point it out..  But please do point it out..  Or I'll
grasp at straws and say a lot of buts *laugh*...

Anyways,  What is wrong with this idea?  How could it work?
Would someone mind explaining for me, is much appreciated...

Erp


---------------------------
E'gads, ideas can be hell at time..
NODE 5c8f4b7eRe: Unix User Password File Encryption
-----BEGIN PGP SIGNED MESSAGE-----

On Sat, 2 Nov 1996, Erp wrote:

> Basically it would take a beginning word and encrypt it with the same salt
> as used on the password in the passwd file.  So let us say that for an
> example our salt is aa, our outcome encrypted password is X8mfjs53D ...
> Ok now let us say that we take this salt of aa and run through the
> following into it and getting these patterns from it (these aren't the
> true patterns etc, I'm just making htese things up, but would it be
> possible?)  
> 
> salt aa  --  inputed password  0001  --  outcome encryption  Zkdrj234S
> salt aa  --  inputed password  0002  --  outcome encryption  Rksjr342s
> salt aa  --  inputed password  0003  --  outcome encryption  25Svj43zY
[rest deleted]

There aren't any known patterns that can be exploited.  The output of DES
encryption 25 times generates pseudo-random output.  If a pattern did exist,
cryptanalysis of DES would be very easy.

Mark
- -- 
finger -l for PGP key
PGP encrypted mail prefered.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQEVAwUBMnuMoSzIPc7jvyFpAQFePAgAjOfKSSjpXE20g4+3t6PSz1bD+7tSd5Yi
mTjt5zlS/D9NGEXoVkuYI/j7KS+Iic7eNhEUTr8KuUpIS+MUIB0BKHLM0LyaFHmG
dgd2LoqVHoC8vEIwFDxXR/vE+Jt51bFXs2/eKksyqJKLrI6g1i+foANLOBhhxobI
I07Z+mQ7XEsKe6C7eEuElvd4qY6Zis0WJD7lj/c9tOPg3wjGCIohgeclwgByqBvd
6kuxu9b2unFpbcsaICqtxJiHqgJAWjuE0FEz3wkKakIKAwmDmJ1mpru4dP73OwCc
qt5TCytlKq7VN75QawK/YlNX3h24QnyXB/Zo6MOSQCcYGn7UmB/3nA==
=fv2A
-----END PGP SIGNATURE-----
NODE 9d84c3f7Re: Unix User Password File Encryption
**what I said deleted**
> 
> There aren't any known patterns that can be exploited.  The output of DES
> encryption 25 times generates pseudo-random output.  If a pattern did exist,
> cryptanalysis of DES would be very easy.
> 
> Mark

But But But *laugh* ---  Ok, here is my only straw in this lousy bushel of
confusion >) ---  What about a Fuzzy Pattern?  ----  Ya I know, that is a
pretty big staw...  The thought of it is fuzzy, let alone a fuzzy pattern.

I've done a lot of reading on Fuzzy Sets and Fuzzy Logic in general..  I
see how it could work 'maybe' But, yes it is a very indefinite field..  To
many people don't believe in its possible existance...
Ok --  Any replys would be nice thanks bye.