Re: [TUHS] Recovered /etc/passwd files

On Fri, Oct 18, 2019 at 6:35 AM Arthur Krewat <krewat(a)kilonet.net> wrote: I'd long suspected that someone would have done this; it would be a great way to expand the total keyspace, and extend the life of But given Ken's seminal work in password stretching and keyspace analysis, I always suspected that it was ken, not bill. in 2015, I was intrigued by the idea that he'd left a little puzzle in a hash that he knew would be publicly available. I even went so far as to construct a small FPGA cluster in pursuit of that theory: https://www.techsolvency.com/passwords/ztex/ What original caught my attention was the logic behind enforcing password quality in passwd.c during a specific era of BSD code, which exited ambiguously in a double negative of sorts, where control characters were not disallowed during password entry. (I'll try to dig up the source.) Anyway, I must have made an error in my original work in 2015, in which I found both of ken's: https://twitter.com/TychoTithonus/status/1182181560264491008 ... but managed to miss bill's entirely, thinking that it had already been cracked. In the superset of all CSRG-published distros, there are slightly more than 1400 total hashes, and one of bill's appears to have been lost in the shuffle (the other was trivial). So some hearty (and bittersweet!) kudos for solving this puzzle! It is what drove me into password auditing as a passion (and profession). Royce -- Royce Williams Tech Solvency