From owner-freebsd-questions  Tue Feb 20 17:32:15 1996
Return-Path: owner-questions
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id RAA22901
          for questions-outgoing; Tue, 20 Feb 1996 17:32:15 -0800 (PST)
Received: from baygull.rtd.com (baygull.rtd.com [198.102.68.5])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id RAA22896
          for <questions@freebsd.org>; Tue, 20 Feb 1996 17:32:12 -0800 (PST)
Received: (from news@localhost) by baygull.rtd.com (8.6.9/8.6.9.1) id SAA09112; Tue, 20 Feb 1996 18:31:59 -0700
To: questions@freebsd.org
Path: freefall.freebsd.org!owner-freebsd-questions
From: nate@sri.MT.net (Nate Williams)
Newsgroups: rtd.freebsd.questions
Subject: Re: Q: exportable DES library ...
Date: Tue, 20 Feb 1996 16:35:28 -0700
Lines: 37
Message-ID: <199602202335.QAA12323@rocky.sri.MT.net>
NNTP-Posting-Host: seagull.rtd.com
Sender: owner-questions@freebsd.org
Precedence: bulk

[ Removed -stable from the list ]

> >  The default password "encryption" with 1.x
> > was a simple scrambler and about as difficult to break as a Captain
> > Midnight decoder ring, fresh from a box of cereal.
> 
> 	Cute - yet more motivation to solve this.. :/

Well, it wasn't *quite* that bad. :)

> > That might actually work to your advantage, however.  Nate - what was
> > the algorithm you used?  I don't have any 1.x sources around to check.
> 
> 	From the 1.1 srcdist I've got, it appears that 1.1 libcrypt sources
> call MD5 routines, yet there are references to the need for DES
> routines in the libc crypt.. Confusion reigns, could someone help me
> identify the actual default/original passwd encryption routines used
> by 1.1.5.1-RELEASE, with what src distrib they're in, etc?

The default crypt exists in /usr/src/lib/libc/*/crypt.c, which I'm
pretty sure has the DES comments in it, but it has been awhile.

> > It may well be that you can write a perl script to descramble the
> > puppies and then re-DES or MD5 encrypt them.

Unfortunately, it's not that easy.  The scrambler routine was stolen
from a Minix posting from the mid 80's which was written because the
default Minix password encrypter which could be reversed.

Now, the scrambler routine might be reversable, but I don't know of any
script to do that.  When we first installed it it was pretty easy to
'reverse' the default encryption since the default was plain-text
passwords, but moving from the scrambler to MD5 or DES might be
difficult.


Nate