From owner-freebsd-doc Tue May 23 15:20:12 2000 Delivered-To: freebsd-doc@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21]) by hub.freebsd.org (Postfix) with ESMTP id 073A737B8B8 for ; Tue, 23 May 2000 15:20:02 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.9.3/8.9.2) id PAA90737; Tue, 23 May 2000 15:20:02 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from be-well.ilk.org (lowellg.ne.mediaone.net [24.147.184.128]) by hub.freebsd.org (Postfix) with ESMTP id AAB6F37B661 for ; Tue, 23 May 2000 15:14:03 -0700 (PDT) (envelope-from lowell@be-well.ilk.org) Received: (from lowell@localhost) by be-well.ilk.org (8.9.3/8.9.3) id SAA72870; Tue, 23 May 2000 18:14:02 -0400 (EDT) (envelope-from lowell) Message-Id: <200005232214.SAA72870@be-well.ilk.org> Date: Tue, 23 May 2000 18:14:02 -0400 (EDT) From: Lowell Gilbert Reply-To: Lowell Gilbert To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.2 Subject: docs/18783: more password-format text Sender: owner-freebsd-doc@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >Number: 18783 >Category: docs >Synopsis: more hammering on the DES-vs-MD5 text >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-doc >State: open >Quarter: >Keywords: >Date-Required: >Class: doc-bug >Submitter-Id: current-users >Arrival-Date: Tue May 23 15:20:01 PDT 2000 >Closed-Date: >Last-Modified: >Originator: Lowell Gilbert >Release: FreeBSD 4.0-STABLE i386 >Organization: the Ilk >Environment: handbook security chapter >Description: Further explanation of a couple of points that have come up lately on the mailing lists (or was it newsgroup?). Also, I fixed a few grammar nits. This covers some of the same ground as my year-and-a-half-old PR docs/8765, but mostly not. That one probably belongs in the FAQ, anyway. >How-To-Repeat: n/a >Fix: *** chapter.sgml~ Sat May 6 16:21:57 2000 --- chapter.sgml Tue May 23 18:09:19 2000 *************** *** 742,755 **** Parts rewritten and updated by &a.unfurl;, 21 March 2000. ! Every user on a UNIX system has a password associated with their ! account, obviously these passwords need to be known only to ! the user and the actual operating system. In order to keep ! these passwords secret, they are encrypted with what is known ! as a 'one-way hash', that is, they can only be easily encrypted ! but not decrypted. The only way to get the password is by ! brute force searching the space of possible passwords. ! Unfortunately the only secure way to encrypt passwords when UNIX came into being was based on DES, the Data Encryption Standard. This is not such a problem for users that live in the US, but since the source code for DES cannot be exported --- 742,762 ---- Parts rewritten and updated by &a.unfurl;, 21 March 2000. ! Every user on a UNIX system has a password associated with ! their account. It seems obvious that these passwords need to be ! known only to the user and the actual operating system. In ! order to keep these passwords secret, they are encrypted with ! what is known as a 'one-way hash', that is, they can only be ! easily encrypted but not decrypted. In other words, what we ! told you a moment ago was obvious isn't even true: the operating ! system itself doesn't really know the ! password. It only knows the encrypted form ! of the password. The only way to get the 'plain-text' password ! is by a brute force search of the space of possible ! passwords. ! ! ! Unfortunately the only secure way to encrypt passwords when UNIX came into being was based on DES, the Data Encryption Standard. This is not such a problem for users that live in the US, but since the source code for DES cannot be exported *************** *** 761,767 **** so that US users could install the DES libraries and use DES but international users still had an encryption method that could be exported abroad. This is how FreeBSD came to ! use MD5 as it's default encryption method. Recognizing your crypt mechanism --- 768,776 ---- so that US users could install the DES libraries and use DES but international users still had an encryption method that could be exported abroad. This is how FreeBSD came to ! use MD5 as its default encryption method. MD5 is believed to ! be more secure than DES, so installing DES is offered primarily ! for compatibility reasons. Recognizing your crypt mechanism *************** *** 777,782 **** --- 786,799 ---- alphabet which does not include the $ character, so a relatively short string which does not begin with a dollar sign is very likely a DES password. + + The libraries can identify the passwords this way as + well. As a result, the DES libraries are able to identify MD5 + passwords, and use MD5 to check passwords that were encrypted + that way, and DES for the rest. They are able to do this + because the DES libraries also contain MD5. Unfortunately, + the reverse is not true, so the MD5 libraries can't + authenticate passwords that were encrypted with DES. Identifying which library is being used by the programs on your system is easy as well. Any program that uses crypt is linked >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-doc" in the body of the message