Re: Saving and Encoding Passwords

["Samuel T. Harris" <sam_harris@hso.link.com>]

Larry Kilgallen wrote:
> 
> In article <87u2m8exf8.fsf@deneb.cygnus.argh.org>, Florian Weimer <fw@s.netic.de> writes:
> 
> > It is considered close to impossible to recover the password from
> > the hash value if the cryptographic hash function is one of the most
> > commonly used and thoroughly analyzed (i.e. MD5 or SHA-1).
> 
> But that consideration is only of interest to mathematicians.
> 
> Security folk realize that passwords freely chosen by humans
> are highly susceptible to brute force guessing attacks.  The
> common defenses are:
> 
>         Include a secret per-user pseudo-random seed number
>         in the hash, to prevent pre-computation of hashes for
>         a particular username.
> 
>         Enforce rules regarding password choice that effectively
>         prevent the use of dictionary words (e.g., punctuation
>         and numeric characters required).
> 
> Larry Kilgallen

A third alternative is to not let the user select the password at all.
I remember using WWMCCS (World Wide Military Command and Control System)
computers and the password was a 20+ character sequence generated
randomly. Classified users had to memory this beast or keep it stored
double sealed in the classified vaults. Some users needed access
to several nodes in the system. Each node had its own password
for that user. What a pain that was, but necessary for a secure
environment. It could take 20 minutes to get your password list
and get logged in, do 5 minutes of work, and then take 10 minutes
resealing your password list and getting back into the safe.

-- 
Samuel T. Harris, Principal Engineer
Raytheon, Scientific and Technical Systems
"If you can make it, We can fake it!"