Assignment 2
Computer Science 349
Spring 2004
Due: Start of class on Thursday February 12
Reading: Singh, Chapters 2, 3; Stinson, Sections 1.1.3 -- 1.1.7, 1.2.1 – 1.2.2.
Exercise 2.0. Read the article by Robert Lemos, “Psst … I known your password”,
ZDNet News, May 22, 2002. URL: http://zdnet.com.com/2100-1105-920092.html and
the article by Rob Shimonski, “Introduction to Password Cracking”, IBM
developerWorks Hacking Techniques, July 2002. URL: http://www-
106.ibm.com/developerworks/security/library/s-crack .
Experiment with John the Ripper (a.k.a. John) in an
attempt to crack (some) passwords contained in a mock
/etc/passwd file which may be downloaded from the course
web page. Source code John may be found from
http://www.openwall.com/john/. Program documentation is
located at the same site as the program. Warning: Under no
circumstances should you attempt to run John on password files
other than those given in this assignment.
By default, John uses the word list in password.lst
in the same directory as the binary file. This is not a very
extensive word list. You may want to combine it with a larger
word list, such as the one in /usr/share/dict/linux.words. You might also
want to include Wellesley-specific words, which you could potentially automatically
generate from some documents about the campus. Note that John takes a long time to run
(we’re talking days) – indeed, it may never terminate on its own and you may have to
manually terminate it.
A gold star goes to the student who cracks the most passwords. As a baseline,
you will have to beat 15, which is how many I cracked after running the program for 10
minutes. Submit your list of cracked passwords and associated users accounts as the
solution to this exercise. Did you recognize any of your own passwords?1
Exercise 2.1. (Stinson 1.6) If an encryption function eK is identical to the decryption
function dK, then the key K is said to be an involutary key. Find all involutory keys in the
Shift Cipher over Z26.
1 The hash function used to create these accounts used only the first eight characters of
your password. It was very bad of me not to tell you this in advance.
