|
USENIX Technical Program - Abstract - USENIX 99
A Future-Adaptable Password Scheme
Niels Provos and David Mazières, The OpenBSD Project
Abstract
Many authentication schemes depend on secret passwords.
Unfortunately, the length and randomness of user-chosen passwords
remain fixed over time. In contrast, hardware improvements constantly
give attackers increasing computational power. As a result, password
schemes such as the traditional UNIX user-authentication system are
failing with time.
This paper discusses ways of building systems in which password
security keeps up with hardware speeds. We formalize the properties
desirable in a good password system, and show that the computational
cost of any secure password scheme must increase as hardware improves.
We present two algorithms with adaptable cost--eksblowfish,
a block cipher with a purposefully expensive key schedule, and
bcrypt, a related hash function. Failing a major
breakthrough in complexity theory, these algorithms should allow
password-based systems to adapt to hardware improvements and remain
secure well into the future.
- You may view the full text of this paper in
HTML form,
PDF form, and
PostScript form.
(This paper is accessible to everyone.)
- If you need the latest Adobe Acrobat Reader, you can download it from Adobe's site.
- To become a USENIX Member, please see our Membership Information.
|
Need help? Use our Contacts page.
FREENIX Technical Program