CS 231: Computer Security

Playing with passwords, round 1

In class, Oct 12

Password files

Password files on Unix systems look something like this. This particular password file has one line per user, with a colon-delimited set of fields. The first field is the user name, and the second field is the MD5 hash of the user's password. As we'll see, this is not an ideal format for a variety of reasons, but it's certainly an improvement on storing the passwords themselves.

Today, your job is twofold:

A little help

I'll give you a big hint for this exercise. Every one of the passwords is either one all-lowercase word taken from this file of words, or two words from the same file concatenated together. So "moose" or "goatlizard" are both possible passwords.

Another hint, to help you get your code sorted out: the password for "jondich" is "moose".

You can load the words file into a python3 list quickly using this line:

words = [line.strip().lower() for line in open('words.txt')]

Finally, working in python3 (which I recommend) means that you have to do some pretty nutty type conversions between the password string and the hash value, etc. Here's a short sample program to help you get started.

Have fun!