Path: utzoo!attcan!uunet!samsung!umich!terminator!dabo.ifs.umich.edu!rees
From: rees@dabo.ifs.umich.edu (Jim Rees)
Newsgroups: comp.sys.apollo
Subject: RE: security problems
Message-ID: <1990Jun28.144947.13139@terminator.cc.umich.edu>
Date: 28 Jun 90 14:49:47 GMT
References: <9006281331.AA07122@richter.mit.edu>
Sender: usenet@terminator.cc.umich.edu (usenet news)
Reply-To: rees@citi.umich.edu (Jim Rees)
Organization: University of Michigan IFS Project
Lines: 31

In article <9006281331.AA07122@richter.mit.edu>,
krowitz%richter@UMIX.CC.UMICH.EDU (David Krowitz) writes:
    Actually I have heard very little about the Cryptbreaker workbench.
    Can someone elaborate on this?

I may be confused, but I thought that CBW was intended for breaking the
crypt command, not the crypt call.  The crypt command uses a one-rotor
enigma and has never been considered cryptologically secure, at least not
since the Nazis used it (enigma, not unix) in WWII.

The crypt call uses DES, and as far as I know, DES is still considered
secure in the sense that the only known practical attack is brute-force.

U.S. law prohibits the export of encryption "devices," including software,
without a license, so unix systems intended for export usually have the
crypt command removed.  Interestingly enough, if you cripple DES such that
it becomes one-way only, it is no longer considered an encryption device and
may be freely exported.  So you have the bizarre situation that the
high-tech, secure crypt(3) is OK but the low-tech, insecure crypt(1) is
restricted.

    I don't see much that an average
    system administrator can do about Unix password encryption since
    the *&^%!!! system puts the ^%%HASD&^%%%!!! passwords in a file
    which *MUST* be publicly readable ... it's things like this that
    make me *HATE* Unix.

I think the rationale is that you shouldn't depend on hiding passwords for
security, and that making the password file world readable forces you to use
a secure encryption method instead.  I agree that this is a pain and should
be changed.