Showing papers on "Password strength published in 1989"

UNIX Password Security - Ten Years Later

Abstract: Passwords in the UNIX operating system are encrypted with the crypt algorithm and kept in the publicly-readable file /etc/passwd. This paper examines the vulnerability of UNIX to attacks on its password system. Over the past 10 years, improvements in hardware and software have increased the crypts/second/dollai ratio by five orders of magnitude. We reexamine the UNIX password system in light of these advances and point out possible solutions to the problem of easily found passwords. The paper discusses how the authors built some high-speed tools for password cracking and what elements were necessary for their success. These elements are examined to determine if any of them can be removed from the hands of a possible system infiltrator, and thus increase the security of the system. We conclude that the single most important step that can be taken to improve password security is to increase password entropy.

A study of password security

Abstract: Our work is motivated by the question of whether or not the password scheme used in UNIX is secure. The following password scheme is a somewhat simplified version of the actual password scheme used in UNIX. We feel that this simplified version captures the essential features of the actual password scheme used in UNM. When a user logs in for the first time he creates a random password and types his user name together with the password into the system. The system creates an encryption of the password using the Data Encryp- tion Standard (DES) and stores this (only the encryption, not the password) together with the user name in a password file. Thereafter, whenever the user logs in and types in his user name and password the system computes the encryption of the password and only allows the user to successfully log in if the encryption matches the entry stored with the user name in the password file.

Personal identification number base key managing device using common use cryptography

Abstract: PURPOSE: To easily attain individual cryptographic communication and group communication at a high speed by using personal password and identification(ID) number and the ID number of a communication opposite party. CONSTITUTION: When a password and an ID number are inputted, a comparator 2 compares the inputted password and ID number with a reference password and a reference ID number stored in a reference password.reference ID number storing part 1, and when both values coincide with each other, outputs a coincidence signal and a gate circuit 4 outputs a master key inputted from a master key storing part 3. Then a common use cryptography processing part 6 ciphers coupled ID number information obtained from a coupling circuit 5 by the master key passing through the gate circuit 4 to form the common use cryptographic key. COPYRIGHT: (C)1991,JPO&Japio

Password authentication using public-key cryptography

Abstract: Password authentication is one of the most common and elementary applications of encryption techniques, and when these authentication services are embedded into the underlying operating system, their security is usually assured. However, there are an increasing number of systems requiring authentication services which are layered on top of a host operating system. In these cases, the security of the application system is highly dependent on the security of the password file, and, when operating outside the host operating system, compromises of the password file need to be taken seriously. In this paper we propose three different password protection schemes which preserve system security even if the password file is compromised. These schemes are based on the concepts of public-key cryptography: public-key encryption, public-key distribution and quadratic residues. In each scheme the user's password is effectively bound to the user's identification, regardless of the state of the password file, in a time-efficient and simple manner. We discuss the special features, degree of secrecy, advantages and disadvantages for each scheme.

Experience of using a type signature password system for user authentication in a heavily used computing environment

Abstract: This paper describes a user authentication system based around the user's type signature, a statistical measure of the user's typing style. It was tested on two heavily loaded computers. Disciplines Physical Sciences and Mathematics Publication Details Newberry, M and Seberry, J, Experience of using a type signature password system for user authentication in a heavily used computing environment, Computer Security in the Information Age, (W. J. Caelli, (Ed.)), IFIP/ SEC'88 -5th World Computer Security Conference, Elsevier Science Publishers B. V., North Holland, 1989, 303-307. This journal article is available at Research Online: http://ro.uow.edu.au/infopapers/1041 Computer Security in the Age of Information WJ. Caelli (Editor) Elsevier Seience Publish.ers B. V. (North-Holland) © IFIP, 1989 303 Experience of Using a Type Signature Password-5ystem for User Authentication in a Heavily Used Computing Environment Mikt Ntw~rry JtMi[U Stbtrry Department of Computer Science University College, University of NSW

Password authentication based on public-key distribution cryptosystem

Abstract: A password authentication mechanism based on the public-key distribution cryptosystem is proposed. The scheme uses an authentication table to replace the traditional password file. With this scheme, even if the authentication table is comprised, the system security is preserved. The user's password is effectively bound to the user's identification in a timely, efficient, and simple manner. >