Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Heys all I've got a nub question, I was wondering

What does it mean to encrypt a password using another password?

For example I want to encrypt a password foo using a password bar, does it mean that I append bar to foo (barfoo in other words) and then do a HASH("barfoo") ?

Or does the article really mean another thing when it says in Scene II:

This ticket contains a version of your username that has been ENCRYPTED USING the MAIL SERVER'S PASSWORD.

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

This is about real, reversible, symmetric encryption. It is not related to storing a one way hash of a password.

encryptedData = encrypt(data, key)
data = decrypt(encryptedData, key)

The very simple implementation of encrypt("bar", "foo") could return "hpg".

key is the shared secret known to both Charon and the mail service. The linked article calls this key a password.

data of course can be another password. But in this case it is not a password, but some information that Charon wants you to pass on to the mailserver. It is called Ticket. The symmetric encryption ensures that neither you nor anyone else can read it. More needs to be done in order to make it secure, but that is dealt with in later scenes of the play.

By the way Wikipedia has an explanations of Kerberos that is closer to the actual technique. The different way to present it may help to understand it.

share|improve this answer
    
Thanks for the help! –  Pacerier Oct 1 '11 at 22:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.