Security Implications of Novell eDirectory.

From: steven.sporenat_private
Date: Thu May 30 2002 - 01:56:30 PDT

  • Next message: bugzillaat_private: "[RHSA-2002:094-08] Updated tcpdump packages fix buffer overflow"

    Hi,
    
    I was wondering what people's thoughts were regarding the product Novell
    eDirectory. I've had a quick look at the implementation and have found that
    eDirectory's passwords are case-insensitive. Comparing this to case
    sensitive
    passwords this radically reduces the number of passwords the system can
    use.
    
    ie.
    
      Case Sensitive         Case Insensitive
      26                     52                 Alpha
      10                     10                 Numeric
      26                     26                 Special
      ----                   ----
      62                     88
    
    Thus for a password 8 characters long we get the following number of
    combinations respectively.
    
      62^8-1                 88^8-1
    
    This means that case sensitive passwords are 16.47 times stronger than case
    insensitive.
    
    Could I deduce that from this using Active Directory vs. eDirectory, AD is
    16.47
    times stronger with passwords than secure in a password sense? Is this a
    fair
    statement?
    
    Regards
      Steven
    ----------------------------------------------------------------
    The information transmitted is intended only for the person or entity to
    which it is addressed and may contain confidential and/or privileged
    material.  Any review, retransmission, dissemination or other use of, or
    taking of any action in reliance upon, this information by persons or
    entities other than the intended recipient is prohibited.   If you received
    this in error, please contact the sender and delete the material from any
    computer.
    



    This archive was generated by hypermail 2b30 : Thu May 30 2002 - 11:42:05 PDT