From:	CSBVAX::CSBVAX::MRGATE::"SMTP::CRVAX.SRI.COM::RELAY-INFO-VAX" 18-NOV-1988 06:01
To:	MRGATE::"ARISIA::EVERHART"
Subj:	All this talk about passwords


Received: From KL.SRI.COM by CRVAX.SRI.COM with TCP; Wed, 16 NOV 88 19:54:21 PDT
Received: from mis.arizona.edu (misvax.mis.arizona.edu) by KL.SRI.COM with TCP; Wed, 16 Nov 88 19:43:50 PST
Received: by mis.arizona.edu id <20800F8C0A1@mis.arizona.edu> ;
       Wed, 16 Nov 88 20:20:50 MST
Date: Wed, 16 Nov 88 19:58:28 MST
From: Could be worse. Could be MVS. <JMS@mis.arizona.edu>
Subject: All this talk about passwords
To: info-vax@kl.sri.com
X-VMS-Mail-To: EXOS%"info-vax@kl.sri.com"
Message-ID: <881116195828.20800F8C0A1@mis.arizona.edu>

All of this talk about passwords in VMS and secrecy is bothersome.
No one learns anything, and no one is more secure because someone
is hiding the information.  Anyone that believes in "security
by ignorance" is an idiot.

My belief is that the HPWD.MAR (Hash Password) code from Digital
is copyright, but I'll excerpt parts of it here so that everyone
can see (1) that VMS is a reasonably secure one-way encryption
and (2) there's nothing to be afraid of, no magic, nothing that
isn't explained (although not always transparently...):

HPWD is the password encryption routine.  In order to get the
encrypted password (or passwords) in SYSUAF, you call HPWD with
the following four arguments:

;	PWDDSC - Address of password descriptor
;	ENCRYPT - Encryption algorithm index (byte)
;	SALT - Random number (word)
;	USRDSC - Address of username descriptor

And you get out:
;	OUTDSC - Address of output buffer descriptor

The output of HPWD is what gets stored.

In VMS, there are two password encryption algorithms.  One is
left-over from the days of VMS V1, and the other is the current
one.  VMS still supports both algorithms (via a flag in the UAF
record, which tells what this password is encrypted with).

One is referred to as the "AUTODIN-II polynomial  
CRC algorithm."  It has a series of "magic numbers" which
are designed to make the one-way encryption harder to decrypt:

AUTODIN:
	.LONG	^O00000000000,^O03555610144,^O07333420310,^O04666230254
	.LONG	^O16667040620,^O15332650764,^O11554460530,^O12001270474
	.LONG	^O35556101440,^O36003711504,^O32665521750,^O31330331614
	.LONG	^O23331141260,^O20664751324,^O24002561170,^O27557371034

The other one is called the "Purdy polynomial algorithm."  It also
has a series of magic numbers:

C:	.LONG	-83,	-1		; C1
	.LONG	-179,	-1		; C2
	.LONG	-257,	-1		; C3
	.LONG	-323,	-1		; C4
	.LONG	-363,	-1		; C5

VMS always encrypts using the new algorithm, but if there's
a password in your UAF which hasn't been changed since VMS V1,
it will be able to decrypt according to the old algorithm. 
In addition, if you want to, you can patch SET PASSWORD to
use the old algorithm.  
The Purdy algorithm looks something like this:

; This routine computes f(u) = p(u) mod P.  Where P is a prime of the form
; P = 2^64 - a.  The function p is the following polynomial:
;
;	X^n0 + X^n1*C1 + X^3*C2 + X^2*C3 + X*C4 + C5
;
; The input U is an unsigned quadword. 

U is generated from the password, plus has the "salt" value stuffed
into the middle, plus your username.

The Autodin-II algorithm looks like this:

	MNEGL	#1, R0			; initial CRC
	MOVAQ	@PWDDSC(AP), R1		; get address of password descriptor
	CRC	AUTODIN, R0, (R1), @4(R1)
					; convert password to 32 bit number
	CLRL	R1			; high order longword will be zero
	MOVQ	R0, (R4)		; copy result to output buffer

Autodin doesn't use the salt, or your username.

jms

	TTCALL	3,[ASCIZ /
Joel M Snyder, Univ of Arizona Dep't of MIS, Tucson, AZ, 85721  
BITNET: jms@arizmis  Internet: jms@mis.arizona.edu Phone: 602.621.2748 /]


