topic Re: password encryption algorithm in Operating System - HP-UX

password encryption algorithm

Tong Hu_1 — Wed, 04 May 2005 10:47:38 GMT

What kind of encrytion algorithms are used for the trusted and the untrusted password?

Re: password encryption algorithm

RAC_1 — Wed, 04 May 2005 11:01:48 GMT

The DES alogorithms is used for trusted/untrusted mode. The makekey command (which in turn calls crypt) can be used to prepare crypted string. The password basically consists of a hash and salt chars (used for encryptiion)
When a password is entered, a hash is matched and user authenticated if it matches.

Anil

Re: password encryption algorithm

Tong Hu_1 — Wed, 04 May 2005 11:07:05 GMT

how could I eliminate the encrypted password strings more than 13 characters?

Thanks

Re: password encryption algorithm

Patrick Wallek — Wed, 04 May 2005 11:16:25 GMT

The only way I can think of to do that would be to use shorter passwords. A longer password equals a longer encrypted string.

I'm not sure why you would want that though.

Re: password encryption algorithm

RAC_1 — Wed, 04 May 2005 11:18:43 GMT

I do not think that you can control that. While setting a password (non-trusted mode), your max pasword char length is 8 chars. While you can set password char length more than 8 chars in trusted mode, your applications shoould be able to understant it. Rather stick to 8 chars password char length.

man passwd for details.

Anil

Re: password encryption algorithm

Tong Hu_1 — Wed, 04 May 2005 14:18:59 GMT

Sorry for the ambiguous question, I am asking about the encrypted password string in tcb files. Since we are trying to synchronize the encrypted password between the Sun servers and HP servers. Some of the encrpted password strings from HP are more than 13 characters, which won't work on Sun servers.

Re: password encryption algorithm

Patrick Wallek — Wed, 04 May 2005 14:43:43 GMT

Sounds like a jobs for NIS+ or LDAP or something other than just scripts.

Re: password encryption algorithm

Bill Hassell — Wed, 04 May 2005 22:04:22 GMT

The password is always encrypted to exactly 13 characters as long as it it 8 chars or less in length. If the system is not Trusted, then pasword characters longer than 8 are silently ignored. In a Trusted system, long passwords are allowed but can easily be limited with system security policies. Run SAM and change the system security policy to 8 character maximum.

NOTE: This only affects new passwords. All existing long passwords must be changed. You can search the /tcb directory for long passwords and notify those users to change.

Re: password encryption algorithm

Tong Hu_1 — Thu, 05 May 2005 06:48:03 GMT

Thanks for all your help.

Re: password encryption algorithm

Tong Hu_1 — Thu, 05 May 2005 09:16:40 GMT

One more extra question, if you can help please. Why Solaris doesn't care the password length, it always encrypt the password to 13 char length?

Thanks

Re: password encryption algorithm

Bill Hassell — Thu, 05 May 2005 10:58:38 GMT

Try typing the first 8 characters correctly and then adding random characters for 9 and beyond. I think you'll find that Solaris, just like HP-UX (untrusted), silently ignores characters 9 and above. Solaris is only encrypting the first 8, thus the 13 chars in /etc/passwd.

Re: password encryption algorithm

Tong Hu_1 — Thu, 05 May 2005 11:29:44 GMT

Thanks, you are the best.