RE: change password API

[Tim McCarthy <TimM@xxxxxxxxxxxxxxxxxx>]

Jim,
Firstly, whether OS/400 ever decrypts the password or not is irrelevant
to the situation in hand. If I need to avoid sending a plain text
password over an unprotected channel then I need to encrypt either the
actual password or the hash and I need to be able to recover one of
these values at the other end. Secondly, the basis for any cryptosystem
is that some standard plain text produces a certain output as the result
of a known transformation, otherwise it's plainly useless. And as any
cryptographer will tell you there's nothing that can't be decrypted,
it's just a matter of the time and effort required to do so.
Thus..."Anything that can't be decrypted is garbage." 

> OS/400 never decrypts your password, that is what makes
> it a little more secure.  Please explain why this is "garbage".
> 
> 
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---