To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.
Course Of The Month
2 days, 15 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
5-
4
- +2
12 Comments
Presumably to make it harder to obtain the key from a brute-force attack. But this is a non-issue for password storage.
The way the password system works is that the cypher is modified so that instead of working as a regular encryptor/decryptor, it can only encrypt, and not decrypt. This is called cryptographic hashing, or one-way hashing.
To test whether a particular password is correct, you encrypt/hash the password presented by the user with a small key called a salt that's stored with the hashed password in the password database. Then you compare the newly generated hashed result with the one stored in the password database. If they're they same, the password is correct. If not, it's incorrect.
The salt is there to make it harder to pre-encrypt/hash a dictionary of popular passwords since you'd have to pre-encrypt/hash the dictionary for each salt value.
So..... Going to tripple-des won't actually help any.
The way the password system works is that the cypher is modified so that instead of working as a regular encryptor/decryptor, it can only encrypt, and not decrypt. This is called cryptographic hashing, or one-way hashing.
To test whether a particular password is correct, you encrypt/hash the password presented by the user with a small key called a salt that's stored with the hashed password in the password database. Then you compare the newly generated hashed result with the one stored in the password database. If they're they same, the password is correct. If not, it's incorrect.
The salt is there to make it harder to pre-encrypt/hash a dictionary of popular passwords since you'd have to pre-encrypt/hash the dictionary for each salt value.
So..... Going to tripple-des won't actually help any.
Im aware of how standard password encryption works. Pretty well actually ;)
However, I want to enforce Triple DES to make bruteforcing using the dictionary method...basically slowing things up.
So Id like some info on it.
Thanks
bluezen
However, I want to enforce Triple DES to make bruteforcing using the dictionary method...basically slowing things up.
So Id like some info on it.
Thanks
bluezen
If slowness is what you're after, what about MD5? I'm not really a Penguin head, but I understead that it's easy enough to use MD5 in the linux password database (hmm, maybe that was OpenBSD I was thinking about, though).
Yup that it is, but Im really interested in triple DES...Ive worked with MD5 a bit, I really want to try triple DES.
Well, in that case I suggest you start with the source code to your favorite Linux distro, start looking at the source to login, and figure out what's happening from there. And don't forget your copy of Applied Cryptography, since you first have to build a MAC function from 3des, which in itself won't be easy.
Actually Im really looking for existing implementations...there might be something really stupid I miss otherwise.
bluezen
bluezen
I don't think you are going to find an existing 3des password implementation and will have to write your own (at least I've never heard of a 3des password implementation). I suspect that if I were going to do something like that, I'd consider writing an pam module to do SASL authentication and write a 3des mech for SASL. At least that way you'd be able to fully test your 3des method before commiting the system to using it and possbily locking yourself out.
When considering alternative encryption methods for passwords, remember that the method has to be able to generate the encrypted password string for the plaintext password for compairsion. With DES passwords that's pretty easy. Use the first two characters of the encrypted password as the salt and feed that and the plaintext to the DES routine. Out will pop the encrypted string which will match if and only if the plaintext password is correct. MD5, CRAM, & DIGEST have similar mechanisms. Consider the essential elements of a password encryption method, which are:
1) The encryption must be one-way. There should be no way to decrypt an encrypted password string.
2) The process of generating the encrypted string from the plaintext must be 100% repeatable when checking passwords.
3) Generated encryption strings must not be unique. I.E., encrypting the same plaintext password multiple times must yield a different encryption string when generating the string to be stored in the authentication database.
So if you want to 'roll your own' you should keep the above in mind. And also consider that the best password encryption method possible is nearly worthless unless good security practices are in use, like only allowing encrypted sessions when users must be authenticated, protecting the password database from prying eyes, and ensuring that all passwords are good (at least 8 random characters) and that they get changed regularly. And of course keeping a system completely up to date w/respect to security fixes is essential.
When considering alternative encryption methods for passwords, remember that the method has to be able to generate the encrypted password string for the plaintext password for compairsion. With DES passwords that's pretty easy. Use the first two characters of the encrypted password as the salt and feed that and the plaintext to the DES routine. Out will pop the encrypted string which will match if and only if the plaintext password is correct. MD5, CRAM, & DIGEST have similar mechanisms. Consider the essential elements of a password encryption method, which are:
1) The encryption must be one-way. There should be no way to decrypt an encrypted password string.
2) The process of generating the encrypted string from the plaintext must be 100% repeatable when checking passwords.
3) Generated encryption strings must not be unique. I.E., encrypting the same plaintext password multiple times must yield a different encryption string when generating the string to be stored in the authentication database.
So if you want to 'roll your own' you should keep the above in mind. And also consider that the best password encryption method possible is nearly worthless unless good security practices are in use, like only allowing encrypted sessions when users must be authenticated, protecting the password database from prying eyes, and ensuring that all passwords are good (at least 8 random characters) and that they get changed regularly. And of course keeping a system completely up to date w/respect to security fixes is essential.
Hmm yeah most of what you say makes sense, and I definitely wouldnt implement the system till I tried it out myself.
I wonder though, if somebody (long long ago) did modify DES to use with the unix password file encryption, how come they havent done the same with 3des (especially in view of the fact that industrial grade machines can be built to decrypt (not crack, but decrypt) DES regular.
bluezen
I wonder though, if somebody (long long ago) did modify DES to use with the unix password file encryption, how come they havent done the same with 3des (especially in view of the fact that industrial grade machines can be built to decrypt (not crack, but decrypt) DES regular.
bluezen
Because the system doesn't simply pass something to DES but first combines a text password with a salt and uses it as a sort of combination key/plaintext to generate the hash.
So, cracking a UNIX password involves either finding the original password, or finding another password that combines with the same salt to generate the same hash.
Yes, the 40 bit keylength of DES implies that it's more likely that you could find another password that works than with 3DES, but there's no simple alghorithm to break the "key" and then produce a workable password. You have to brute force through the entire realm of password choices, combine them with the salts, and then hash them. That means you can't use a general-purpose DES cracking system (such as TINKLE or something). Also, given the small amount of information in the average password, it's likely that there aren't any such collisions anyway, even with 40 bit DES, so you really have to find the original password, in which case it doesn't matter if you have a 40 bit algorithm or a 4000000 bit algorithm.
So, cracking a UNIX password involves either finding the original password, or finding another password that combines with the same salt to generate the same hash.
Yes, the 40 bit keylength of DES implies that it's more likely that you could find another password that works than with 3DES, but there's no simple alghorithm to break the "key" and then produce a workable password. You have to brute force through the entire realm of password choices, combine them with the salts, and then hash them. That means you can't use a general-purpose DES cracking system (such as TINKLE or something). Also, given the small amount of information in the average password, it's likely that there aren't any such collisions anyway, even with 40 bit DES, so you really have to find the original password, in which case it doesn't matter if you have a 40 bit algorithm or a 4000000 bit algorithm.
Featured Post
Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Suggested Solutions
| Title | # Comments | Views | Activity |
|---|---|---|---|
| Redhat upgrade | 1 | 69 | |
| Exchange Server 2010,2013, 2016 ; DNS Linux Server; Reverse Proxy; Smart host Server; DNS | 3 | 120 | |
| Unbreakable Oracle Linux 6.8 installation problem | 9 | 66 | |
| Linux Server mapping drive using SSH key | 9 | 53 |
Introduction
We as admins face situation where we need to redirect websites to another. This may be required as a part of an upgrade keeping the old URL but website should be served from new URL. This document would brief you on different ways ca…
SSH (Secure Shell) - Tips and Tricks
As you all know SSH(Secure Shell) is a network protocol, which we use to access/transfer files securely between two networked devices. SSH was actually designed as a replacement for insecure protocols that sen…
Learn how to find files with the shell using the find and locate commands.
Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Get a first impression of how PRTG looks and learn how it works. This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
- Linux
- Windows OS
- Networking
- Paessler
- Network Management
- Network Analysis, Network Operations
Suggested Courses
Course of the Month2 days, 15 hours left to enroll
752 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.