Password security - Another idea

[The Beach Bum]

In article <946 at ruuinf.UUCP> piet at ruuinf (Piet van Oostrum) writes:

[ nice, long description ... ]

>Now the input to the encryption algorithm consists of:
>	12 bits 'salt'
>	56 bits DES-key
>	64 bits constant to be encrypted.
>
>that makes a total of 132 bits. If you take each of the above 3
>parts from various bits of the password, then we could accommodate 19
>character passwords.

No - you are still only storing 56 bits of password data.  What you
are doing is providing a multi-way encryption algorithm, you are not
expanding the key space.

Since there are only 2^56 possible outputs, and 2^132 inputs, some of
them must map onto other encrypted passwords - a multi-way encryption.

This reminds me - old VAX/VMS used CRC16 to encrypt their passwords.
Which is about as multi-way as it gets ...  This would mean, if correct,
that only 65,536 different passwords would have to be generated to
break the system.  The successful cracker pre-encrypts several times
this many passwords using the CRC16 instruction to generates a complete
dictionary of all possible output values.
-- 
John F. Haugh II                        +-Quote of the Week:-------------------
VoiceNet: (214) 250-3311   Data: -6272  |"Anything on the road which can be
InterNet: jfh at rpp386.Dallas.TX.US       | hit, will be ..."
UucpNet : <backbone>!killer!rpp386!jfh  +--------------------------------------