Date: Fri, 13 Mar 2015 15:22:39 -0400
From: Justin Cappos <jcappos@....edu>
To: Jeremy Spilman <jeremy@...link.co>
Cc: discussions <discussions@...sword-hashing.net>, 
	polypasswordhasher-dev <polypasswordhasher-dev@...glegroups.com>
Subject: Re: Password hashing by itself is not enough

>
>
> Key management / Protector account management concerns aside, I think it
> is reasonable to say the result (the resulting security posture) of a
> secret key and PolyPass are fairly similar if not exactly the same?
>

Yes, it is effectively the same.   In both cases, one needs to somehow
recover the key before individual cracking passwords.  So in both cases,
there is something the attacker must obtain before performing traditional
password cracking.


Note, I copied the wrong cracking number from my previous email.  With a
> threshold of 5 on RockYou, and an attacker checking for 123456, the time
> would be hundreds of years w/ stretch to 1 check per second.  (1 check per
> second is sane because the defender will only need to do this operation a
> small number of times, often once, per reboot.)
>
>
> That's a very nice feature, to be able to add latency / cost to the key
> recovery process independent of the latency / cost of a password
> verification after the key has been recovered! I will have to read up on
> how you imposed tunable latency on the Shamir secret recovery process.
>

Right now, we just do key stretching on the hash you use to validate the
recovered secret is correct.  So the attacker either has to do the hash
computation, which is slow, or recover k+1 accounts at once to do
validation (which is usually slower).

If someone knows a better way to do something akin to key stretching with a
scheme like Shamir's Secret Sharing, we'd love to hear about it.  :)

Thanks,
Justin

Content of type "text/html" skipped

Powered by blists - more mailing lists