Passwords

Students should be able to

1. Recognize the limitations of the typical password schemes
2. Sketch the cracking algorithms, and use cracking tools

1. Authentication of Users, Services, Servers, Documents, …
2. User Authentication Approaches
   1. What You Know
   2. What You Have
   3. What You Are
3. Password Verification Services
4. One Time Password (OTP) Authentication
5. Two-Factor Authentication
6. Choosing good passwords; What are weak passwords?

1. Passwords, Hashing, Salting
2. Cryptography, MD5, SHA1 Digests
3. DES Encoding of Passwords
4. The Linux Password Shadow System
5. Pluggable Authentication Modules (PAM)
6. ./Linux/passwords-linux.html All the above

1. Passwords are never stored as plain text. Only the results of crypto hashes (and some more mangling known as "salting") are stored.
2. ./Linux/salted-hashes.html Intro to hash functions and salting.
3. There are only two ways to determine the un-encoded password p given the hash r:
4. Keep guessing a password p, compute chash(p) = r, until r is found in the table.
5. Create a list of "all" passwords (column 1) and their hashed results (column 2). This is known as a "lookup table". Such a table will be huge (based on the "all" passwords in your collection), but is very simple to use and is fast. E.g., we can sort the lookup table based on column 2 and use binary search.
6. Note that every password storage depends on the chash() chosen.

1. ./cracking.html All the below

1. https://haveibeenpwned.com/ Check if you have an account that has been compromised in a data breach. Recommended Visit.
2. Lorrie Faith Cranor, What's wrong with your pa$$w0rd?, TEDxCMU, video 17:41, Mar 2014. Required Watch.
3. Prabhaker Mateti, Cryptography, A lecture from Computer Security course. 2013. For 44xx: Required Reading. For 3900: Recommended Reading.
4. http://www.piotrbania.com/all/kon-boot/ "Kon-boot is a chain loader that boots into Windows or Linux and sets up "hooks" at the kernel level that bypasses password checking." Recommended Visit.
5. Joseph Bonneau, Cormac Herley, Paul C. van Oorschot, and Frank Stajano, "The quest to replace passwords: a framework for comparative evaluation of Web authentication schemes", IEEE Security and Privacy Symposium, May 2012. Recommended Reading
6. Fred B. Schneider, "Something You Know, Have, or Are", http://www.cs.cornell.edu/courses/cs513/2005fa/nnlauthpeople.html, 2005. Recommended Reading