Because of the known risks of the UNIX password system, the SunOS-4.0 documentation recommends that the password file be removed and replaced with a publicly readable file called /etc/publickey. An entry in the file for user A consists of a user’s identifier ID_A, the user’s public key, PU_a, and the corresponding private key PR_a. This private key is encrypted using DES with a key derived from the user’s login password P_a. When A logs in, the system decrypts E(P_a, PR_a) to obtain PR_a.

a. The system then verifies that P_a was correctly supplied. How?

b. How can an opponent attack this system?