SYSKEY2. Request For Comments

[Luke Kenneth Casson Leighton]

On Mon, 7 Feb 100 jeremy at varesearch.com wrote:

> > sorry ppl, fed up with arguing and explaining this, my hands are now
> > constantly hurting.  i'm creating a syskey2, it's going in the source
> > code, if you don't like it, jeremy, well, work it out for yourself as to
> > why it's needed.
> 
> Luke, this is *not* going into the shipping source, for reasons I
> have already explained. This is why I don't like you running off
> in a branch.

neither do i.

> This is why your branches get abandoned.

yeah, it pisses me off.
 
> You have not demonstrated a need for this, you have not demonstrated
> how it improves security in *any* way. You are just adding this as
> NT does it. This is not a good enough reason.

ok.  exaplain to me exactly what you think i am attempting to do.  problem
to be solved, and proposed solution.

because i can guarantee to you that the problem you think i am attempting
to solve is not the one you think.

if i was just proposing a stupid microsoft-like syskey algorithm, you
think i'd actually bother???  me, who's been knee-deep in microsoft's
*abysmal* track record on the use of rc4.

let's see.  places where microsoft messed up with rc4 that i can think of
in under 1 minute...

NetrSamSync
SamrSetUserInfo - info levels 0x23 and 0x24
SYSKEY
tick... tick... tick...
damn, there's one more, i know it...
SamrChgUserPassword
... sure there's another.

anyway, you get the picture?  i'm not about to bother with somestupid
algorithm if i didn't think it was necessarey, yes?