Showing papers on "Password cracking published in 2001"
8 Apr 2001
TL;DR: This work presents a multi-server roaming protocol in a simpler model without this need for a prior secure channel, which requires fewer security assumptions, improves performance with comparable cryptographic assumptions, and better handles human errors in password entry.
Abstract: Safe long-term storage of user private keys is a problem in client/server systems. The problem can be addressed with a roaming system that retrieves keys on demand from remote credential servers, using password authentication protocols that prevent password guessing attacks from the network. Ford and Kaliski's methods [11] use multiple servers to further prevent guessing attacks by an enemy that compromises all but one server. Their methods use a previously authenticated channel which requires client-stored keys and certificates, and may be vulnerable to offine guessing in server spoofing attacks when people must positively identify servers, but don't. We present a multi-server roaming protocol in a simpler model without this need for a prior secure channel. This system requires fewer security assumptions, improves performance with comparable cryptographic assumptions, and better handles human errors in password entry.
124 citations
10 Sep 2001
TL;DR: A new approach is proposed to deal with a new class of weak passwords by (roughly) measuring entropy by exploiting effective patterns to prevent low-entropy passwords as the first step of entropy-based proactive password checking.
Abstract: Nowadays, proactive password checking algorithms are based on the philosophy of the dictionary attack, and they often fail to prevent some weak passwords with low entropy. In this paper, a new approach is proposed to deal with this new class of weak passwords by (roughly) measuring entropy. A simple example is given to exploit effective patterns to prevent low-entropy passwords as the first step of entropy-based proactive password checking.
108 citations
Patent•
28 Mar 2001TL;DR: In this article, the authors proposed a one-time password mechanism on top of secure socket layer (SSL) to authenticate a user in a remote computer access facility using two dedicated computers outside the firewall.
Abstract: A remote computer access facility uses two dedicated computers outside the firewall. To ensure security the system makes use of biometrics features and a one-time password mechanism on top of secure socket layer (SSL) to authenticate a user. The system also provides three layers of security levels for transmission. The first layer establishes an SSL connection, the second layer periodically asks for a one-time password (OTP), and the third layer uses any kind of conventional encryption. The combination of the biometric, OTP and encryption key forms a strong password. The system also uses a mechanism for secure file accesses within the organization based on the security privileges assigned to various users. Based on the user's access privileges, the server side software module sends the requested file in an encrypted form along with the key to decrypt that file—this key is encrypted by the user's strong password.
89 citations
Proceedings Article•
13 Aug 2001TL;DR: SC-CFS is developed, a file system that encrypts files and takes advantage of a smartcard for per-file key generation and minimizes the damage caused by physical attack and bug exploitation.
Abstract: Storing information securely is one of the most important roles expected for computer systems, but it is difficult to achieve with current commodity computers The computers may yield secrets through physical breach, software bug exploitation, or password guessing attack Even file systems that provide strong security, such as the cryptographic file system, are not perfect against these attacks We have developed SC-CFS, a file system that encrypts files and takes advantage of a smartcard for per-file key generation SC-CFS counters password guessing attack, and minimizes the damage caused by physical attack and bug exploitation The performance of the system is not yet satisfactory, taking 300 ms for accessing a file
20 citations
5 Nov 2001
TL;DR: This paper extends proposals to enable dynamic delegation from one server to another to enable Dynamic delegation of private key operations from one device to another, i.e., the device can subsequently use the second server to secure its privateKey operations.
Abstract: A device that performs private key operations (signatures or decryptions), and whose private key operations are protected by a password, can be immunized against offline dictionary attacks in case of capture by forcing the device to confirm a password guess with a designated remote server in order to perform a private key operation. Recent proposals for achieving this allow untrusted servers and require no server initialization per device. In this paper we extend these proposals to enable dynamic delegation from one server to another; i.e., the device can subsequently use the second server to secure its private key operations. One application is to allow a user who is traveling to a foreign country to temporarily delegate to a server local to that country the ability to confirm password guesses and aid the user's device in performing private key operations, or in the limit, to temporarily delegate this ability to a token in the user's possession. Another application is proactive security for the device's private key, i.e., proactive updates to the device and servers to eliminate any threat of offline password guessing attacks due to previously compromised servers.
18 citations
TL;DR: It is shown that the enhanced version of the generalized key agreement and password authentication protocol, proposed by Kwon and Song, is insecure against off-line password guessing attacks.
Abstract: We show that the enhanced version of the generalized key agreement and password authentication protocol, proposed by Kwon and Song (see IEICE Trans. Commun., vol.E83-B, no.9, p.2044-50, Sept. 2000), is insecure against off-line password guessing attacks.
14 citations