Re: AS/400 Rewarding Challenge

[leif@xxxxxxx]

There is nothing wrong as such with the DES. It is the way IBM has
applied it that is crummy. Trust them to screw up MD5 as well.
BTW: IBM already knows all of this (and have for months). It is
just that they ain't telling their customers that. I had kind of
expected that they a long time ago would have taken out a front
page add in the Wall Street Journal, alerting their customers
to this serious flaw, and promising an immediate fix downloadable
on the spot. But no, that didn't happen.

----- Original Message -----
From: Steve Glanstein <mic@aloha.com>
To: mr <midrange-l@midrange.com>
Cc: Leif Svalgaard <leif@ibm.net>
Sent: Tuesday, September 21, 1999 2:17 PM
Subject: AS/400 Rewarding Challenge


> >-----------------------------
> >
> >>Date: Mon, 20 Sep 1999 20:14:50 -0500
> >>From: leif@ibm.net
> >>Subject: Re: Rewarding Challenge AS/400
> >
> >>From: Steve Glanstein <mic@aloha.com>
> >
> >> The answer to people who can crack the AS/400 password...I'll send them
> the
> >> encrypted password and see if they can decrypt it! This was done several
> >> times with PGP and the network went silent.
> >
> >you are awfully silent right now, Steve.
> >What gives?
>
> Leif et al:
>
> I've read some information that shows that the AS/400 password encryption
> is not cryptographically sound. I am currently in contact with an
> individual who says he can brute-force crack the password. He has a sample
> and I expect a result in about a day. Based upon what I have read, I expect
> the gentleman to succeed. After receiving physical proof of this, I can
> pass it on to the world.
>
> I certainly hope that IBM can fix it...even a simple MD5 encryption would
> be better than what I've read.
>
> Steve Glanstein
> mic@aloha.com
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---