RE: cvspass - obtaining the password

[Jim.Hyslop]

Lee wrote:
> I'm trying to assess our systems security, and I'm looking at 
> CVS right 
> now. I cam across an article, `Securing CVS on OpenBSD` 
> [http://www.blacksheepnetworks.com/security/resources/running-
> a-secure-cvs.pdf] 
> that the password in .cvspass can be obtained easily as the 
> encryption 
> algorithm is well-known and reverisble.
> 
> Can anyone direct me to more information / the algorithm? A Google 
> search isn't helping.
Use the source, Lee!

It's a very simple substitution algorithm. The substitution table is in the
source code, in scramble.c

-- 
Jim Hyslop
Senior Software Designer
Leitch Technology International Inc. (http://www.leitch.com)
Columnist, C/C++ Users Journal (http://www.cuj.com/experts)