Conference noted::hackers_v1

Now, that's a hack.  Does it generalize to N-letter passwords?
I.e., can I set my password to FOO?

Martin.

Ayup, it generalizes.  Just follow the 'normal' password with 16 Us and 8 Vs.

You can get a now letter password in vms V3.7 by the 
following

$set password
OLD PASSWORD:  type old pass
NEW PASSWORD:  hit escape
VERIFICATION:  hit escape

  You will now be able to log on directly from USERNAME:...

Why escape?  Why not return?

tom_p

    If you type return it will call your entry a blank line,
    ignore it, and reprompt.  Try it!

    Dave

I just tried it and I've done it before.  I enter my old password, get 
the 'New password:' prompt and hit a carriage return.  It then prompts 
me for 'Verification:'.  I hit return again.  'SET HOST 0' and log in 
with just a username.

I tried this on OBIWAN which is still running V3.7.

tom_p

Sure...  You don't HAVE to have a password.  That's what happens when you
set your password to an empty string.  I don't think this works, though, if
you have a minimum password length set in the UAF

Dave

But there is no minimum password length on VMS V3.7.  If the <ESC> 
trick works on V4, I think it's a security hole and should be QARed.

tom_p

I'm on V4.1 and have a pwdminimum set to 6.  I tried setting my password
with an escape and it didn't work.

Dave

RE .5 & .6:

    BOY, IS MY FACE RED!  That'll teach me to respond from memory.

    My response (.5) about blank lines appears to be totally inaccurate.
    Please ignore it.

    Dave

Ignore what?...

His response (.5) about blank lines, which appears to be totally inaccurate.

Dave :`)

So, what happens if you set your password to UUUUUUUUUUUUUUUUVVVVVVVV 
(that is, 16 "U"s followed by 8 "V"s)?  Does this result in no password 
at all, or make you actually enter a real password of this 24 character 
string?  Also, anyone going to offer the explanation of why the "U"s and 
"V"s cancel one another out (presumably the one-way encryption algorithm 
in VMS V4.x)?

#6Tom

No, it doesn't work.  I guess VMS is smart (dumb?) enough to know that you
didn't enter a password, therefore to deny access.

-Mike

To understand why this and other password tricks work, it is necessary
to understand how the password encryption algorithm works.

Basically, a text string is mapped to a quadword in a (hopefully)
non-reversible manner.  This quadword is what is stored in the
UAF file.  The entire process is fairly complex, and actually takes
three inputs (password, username, time) to produce its output.

One key part of the algorithm is to collapse the password string into
a quadword (not the final quadword).  This is done by the following
algorithm:

	let s[1..n] be a string of n characters (the password), and
	    r[0..7] be a quadword composed of 8 bytes

	Then r[i] = sum( s[k] | (k mod 8) = i), where 0 <= i <= 7, 1 <= k <= n

In other words, every eighth character in the input string is summed
into the same byte of the quadword, using byte arithmetic (i.e. no overflow
into adjacent bytes).  In the case of xU*16V*8, this works out to

	r[1] = x + U + U + V = x + 85 + 85 + 86 = x + 256 = x
	r[k] = U + U + V = 85 + 85 + 86 = 256 = 0, for k = {0,2,3,4,5,6,7}

which explains why this hack (and many others) works.

For more details, look up HPWD.MAR in the VMS source distribution.

				/X(0f(BM

Lest any hackers think that .-1 tells the whole story, ...

The reason for mashing the password string into a quadword is so that
a trap-door function can be applied to it.  There seems to be no good
way to 'crack' this trap-door function -- the cost is either prohibitive
in space or time, or both (you could just calculate the trap-door function
for all 2^64 different passwords, and crack it with a table look-up).

    re .16
    
    What's a trap door function?
    
    Dave

    
    A "trapdoor" function is a function F:DOMAIN->RANGE such that the
    inverse of F is extremely difficult to compute.
    
    By storing F(PASSWORD) and comparing it to F(GUESS) (rather than
    by storing the password and comparing it to the guess) you make
    it practically useless to have read access to the list of stored
    F(PASSWORD)'s.
    
    /Bevin
    

    re .18:  Example of a trapdoor function is prime factors.  If
    
    	g = F(x,y)
    
    where F is defined as a function on the domain of prime numbers
    which results in their product, it is very easy to compute g given
    x and y, but extremely hard to compute x and y (assuming they are
    large).
    
    Burns