| 1 | | What exists already (from the 1984 PNT version 2 work) |
| 2 | | |
| 3 | | - **The PNT can store long passwords.** `pnt_entry.incl.pl1` declares |
| 4 | | `password` and `network_password` as `char (32)`, with flags `short_pw` and |
| 5 | | `short_network_pw` meaning "this is an 8-character password scrambled the |
| 6 | | old way". |
| 7 | | - **The header comment describes the intended design:** "Since the 32 |
| 8 | | character scrambling algorithm will not give the same results, the |
| 9 | | short_XX flags indicate that the old scrambler should be used. The short |
| 10 | | flags are automatically turned off by calls to update the password with |
| 11 | | the long-scrambled form." |
| 12 | | - **The PNT already compares long passwords.** `pnt_db_util_` |
| 13 | | (`bound_pnt_interface_`) compares the first 8 characters when `short_pw` |
| 14 | | is on, and all 32 otherwise. |
| 15 | | |
| 16 | | What is missing: |
| 17 | | |
| 18 | | 1. **A 32-character scrambler.** `scramble_` (`bound_user_ctl_`) takes and |
| 19 | | returns `char (8)`. No long form was ever written. A new routine is needed |
| 20 | | (for example `scramble_$long`). It should be a one-way hash of up to 32 |
| 21 | | characters into 32 characters (or the stored form's 256 bits). Ideally it |
| 22 | | would be a modern construction; something DES-based like `encipher_` |
| 23 | | would at least match the existing style. The choice affects security and |
| 24 | | is permanent once passwords are stored. |
| 25 | | 2. **Every place that reads, scrambles or compares a password must handle |
| 26 | | 32 characters.** Each of these calls `scramble_` or `read_password_` |
| 27 | | with 8-character variables (found by grep; each needs review): |
| 28 | | |
| 29 | | ||= Area =|| Programs || |
| 30 | | ||Login (answering service)||`bound_user_ctl_`: `lg_ctl_.pl1`, `dialup_.pl1`; `bound_ls_user_ctl_`: `uc_login_.pl1`; `bound_login_server_`: `ls_validate_user_.pl1`|| |
| 31 | | ||FTP and network logins||`bound_ftp_ctl_`: `ftp_dialup_.pl1` | |
| 32 | | || Password administration || `bound_admin_rtnes_`: `new_user.pl1`; `bound_admin_tools_`: `set_special_password.pl1`; `bound_pnt_interface_`: `pnt_db_util_.pl1`, `convert_v2_pnt_.pl1` || |
| 33 | | || Operator/admin modes || `bound_system_control_`: `sc_admin_mode_.pl1`, `sc_requests_.pl1` || |
| 34 | | || Card input, remote I/O, I/O daemon || `bound_card_input_`: `read_cards_.pl1`, `cards_overseer_.pl1`; `bound_remote_io_`: `remote_driver_.pl1`; `bound_iodd_`: `iodd_.pl1` || |
| 35 | | || Reading passwords || `bound_cipher_`: `read_password_.pl1` (input length) || |
| 36 | | || Others, which use their own passwords, not the PNT || `encode`, `intermultics_copy`, `user_ftp_requests_`, `cftp_`, `exp_getpw_`, COBOL MCS, APL || |
| 37 | | |
| 38 | | Also: the login dialogue's password masking, the `-change_password` |
| 39 | | handling (old/new password prompts, the length check), and the messages |
| 40 | | that say a password may have at most 8 characters. |
| 41 | | |
| 42 | | 3. **Migration.** Existing 8-character passwords keep `short_pw` on and are |
| 43 | | checked with the old scrambler. When a user changes a password, it is |
| 44 | | stored in the long form and `short_pw` is turned off. That is what the |
| 45 | | 1984 design intended, so no conversion pass is needed. |
| 46 | | |
| 47 | | Suggested plan |
| 48 | | |
| 49 | | 1. Choose the long scrambling algorithm and write `scramble_$long` (with a |
| 50 | | test program). |
| 51 | | 2. Change the PNT update path (`pnt_manager_`/`pnt_db_util_` and |
| 52 | | `new_user`/password changes) to store long passwords and clear |
| 53 | | `short_pw`. |
| 54 | | 3. Change each login path in the table to read up to 32 characters, and |
| 55 | | compare with the scrambler matching the entry's `short_pw` flag. |
| 56 | | 4. Update the documentation (`login`, `new_proc`, `change_password`, |
| 57 | | `new_user`, AG/AK manuals) for the new limit. |
| 58 | | |
| 59 | | All of these are standard-system and answering-service changes, so this |
| 60 | | needs a set of MCRs and careful testing on a test system, including the |
| 61 | | login server and FTP logins. |
