of Volume 22 the ACM Number 11 36 62 passwords or passwords chosen from a larger character 26 lower-case alpha- 95 all 128 set, or the system could itself choose passwords for the lower-case letters numeric printable ASCII n letters and digits characters characters characters users. 1 30 msec. 40 msec. 80 msec. 120 msec. 160 msec. 2 800 msec. 2 sec. 5 sec, 11 sec. 20 sec. An Anecdote 3 22 sec. 58 sec. 5 min. 17 min. 44 min. 4 10 min. 35 min. 5 hrs. 28 hrs. 93 hrs. 5 4 hrs. 21 hrs. 318 hrs. 112 days 500 days An entertaining and instructive example is the at- 6 107 hrs. 760 hrs. 2.2 yrs. 29 yrs. 174 yrs. tempt made at one installation to force users to use less predictable passwords. The users did not choose their One has to conclude that it is no great matter for someone own passwords; the system supplied them. The supplied with access to a PDP-11 to test all lower-case alphabetic passwords were eight characters long and were taken strings up to length five and, given access to the machine from the character set consisting of lower-case letters and for, say, several weekends, to test all such strings up to digits. They were generated by a pseudorandom number six characters in length. By using such a program against generator with only 21~ starting values. The time required a collection of actual encrypted passwords, a substantial to search (again on a PDP-11/70) through all character fraction of all the passwords will be found. strings of length 8 from a 36-character alphabet is 112 Another profitable approach for the bad guy is to use years. the word list from a d!ctionary or to use a list of names. Unfortunately, only 21~ of them need be looked at, For example, a large commercial dictionary contains because that is the number of possible outputs of the typically about 250,000 words; these words can be random number generator. The bad guy did, in fact, checked in about five minutes. Again, a noticeable frac- generate and test each of these strings and found every tion of any collection of passwords will be found. Im- one of the system-generated passwords using a total of provements and extensions will be (and have been) found only about one minute of machine time. In this case, no by a determined bad guy. Some "good" things to try harm was done, as the bad guy happened to be a friendly are: user. - - T h e dictionary with the words spelled backwards. - - A list of first names (best obtained from some Improvements to the First Approach mailing list). Last names, street names, and city names also work well. 1. Slower Encryption - - T h e above with initial upper-case letters. Obviously, the first algorithm used was far too fast. - - A l l valid license plate numbers in your state. (This The announcement of the DES encryption algorithm [2] takes about five hours in New Jersey.) by the National Bureau of Standards was timely and - - R o o m numbers, social security numbers, telephone fortunate. The DES is, by design, hard to invert, but numbers, and the like. equally valuable is the fact that it is extremely slow when The authors have conducted experiments to try to implemented in software. The DES was implemented determine typical users' habits in the choice of passwords and used in the following way: The first eight characters when no constraint is put on their choice. The results of the user's password are used as a key for the DES; were disappointing, except to the bad guy. In a collection then the algorithm is used to encrypt a constant. Al- of 3,289 passwords gathered from many users over a though this constant is zero at the moment, it is easily long period of time, accessible and can be made installation-dependent. Then the DES algorithm is iterated 25 times and the resulting 15 were a single ASCII character; 64 bits are repacked to become a string of 11 printable 72 were strings of two ASCII characters; characters. 464 were strings of three ASCII characters; 477 were strings of four alphamerics; 2. Less Predictable Passwords 706 were five letters, all upper-case or all lower-case; The password entry program was modified so as to 605 were six letters, all lower-case. urge the user to use more obscure passwords. If the user An additional 492 passwords appeared in various avail- enters an alphabetic password (all upper-case or all able dictionaries, name lists, and the like. A total of 2,831 lower-case) shorter than six characters, or a password or 86 percent of this sample of passwords fell into one of from a larger character set shorter than five characters, these classes. then the program asks him to enter a longer password. There was, of course, considerable overlap between This further reduces the efficacy of key search. the dictionary results and the character string searches. These improvements make it exceedingly difficult to The dictionary search alone, which required only five find any individual password. The user is warned of the minutes to run, produced about one third of the pass- risks and if he cooperates, he is very safe indeed. On the words. other hand, he is not prevented from using his spouse's Users could be urged (or forced) to use either longer name if he wants to.
596 Communications N ove mbe r 1979
of Volume 22 the A C M N u m b e r 11 3. Salted Passwords mented, the encryption was done only if the user name The key search technique is still likely to turn up a was valid, because otherwise there was no encrypted few passwords when it is used on a large collection of password to compare with the supplied password. The passwords, and it seemed wise to make this task as result was that the response was delayed by about one- difficult as possible. To this end, when a password is first half second if the name was valid, but was immediate if entered, the password program obtains a 12-bit random invalid. The bad guy could find out whether a particular number (by reading the real-time clock) and appends user name was valid. The routine was modified to do the this to the password typed in by the user. The concate- encryption in either case. nated string is encrypted and both the 12-bit random quantity (called the salt) and the 64-bit result of the Conclusions encryption are entered into the password file. On the issue of password security, UNIX is probably When the user later logs in to the system, the 12-bit better than most systems. The use of encrypted pass- quantity is extracted from the password file and ap- words appears reasonably secure in the absence of seri- pended to the typed password. The encrypted result is ous attention of experts in the field. required, as before, to be the same as the remaining 64 It is also worth some effort to conceal even the bits in the password file. This modification does not encrypted passwords. Some UNIX systems have insti- increase the task of finding any individual password, tuted what is called an "external security code" that must starting from scratch, but now the work of testing a given be typed when dialing into the system, but before logging character string against a large collection of encrypted in. If this code is changed periodically, then someone passwords has been multiplied by 4,096 (212). The reason with an old password will likely be prevented from using for this is that there are 4,096 encrypted versions of each it. password and one of them has b e e n picked more or less Whenever any security procedure is set up to deny at random by the system. access to unauthorized persons, it is wise to keep a record With this modification, it is likely that the bad guy of both successful and unsuccessful attempts to get at the can spend days of computer time trying to find a pass- secured resource. For example, an out-of-hours visitor to word on a system with hundreds of passwords, and find a computer center normally must not only identify him- none at all. More important is the fact that it becomes self, but a record is usually also kept of his entry. Just so, impractical to prepare an encrypted dictionary in ad- it is a wise precaution to make and keep a record of all vance. Such an encrypted dictionary could be used to attempts to log into a remote-access time-sharing system, crack new passwords in milliseconds when they appear. and certainly all unsuccessful attempts. There is a (not inadvertent) side effect of this modi- Bad guys fall on a spectrum whose one end is some- fication. It becomes nearly impossible to find out whether one with ordinary access to a system and whose goal is a person with passwords on two or more systems has to find out a particular password (usually that of the used the same password on all of them, unless you super-user) and, at the other end, someone who wishes already know that. to collect as much password information as possible from as many systems as possible. Most of the work reported 4. The Threat of the DES Chip here serves to frustrate the latter type; our experience Chips to perform the DES encryption are already indicates that the former type of bad guy never Was very commercially available and they are very fast. The use successful. of such a chip speeds up the process of password hunting We recognize that a time-sharing system must oper- by three orders of magnitude. To avert this possibility, ate in a hostile environment. We did not attempt to hide one of the internal tables of the DES algorithm (in the security aspects of the operating system, thereby particular, the so-called E-table) is changed in a way that playing the customary make-believe game in which depends on the 12-bit random number. The E-table is weaknesses of the system are not discussed no matter inseparably wired into the DES chip, so that the com- how apparent. Rather we advertised the password algo- mercial chip cannot be used. Obviously, the bad guy rithm and invited attack in the belief that this approach could have his own chip designed and built, but the cost would minimize future trouble. The approach has been would be very high. successful. 5. A Subtle Point Received August 1978; revised August 1979 To log in successfully on the UNIX system, it is necessary after dialing in to type a valid user name, and References then the correct password for that user name. It is poor i. Hagelin, B. Ciphering Machine (M-209), U.S. Patent No. 2,089,603, Aug. 10, 1937. design to write the login command in such a way that it 2. Proposed federal information processing data encryption tells an interloper when he has typed i n an invalid user standard. Federal Register (40FR12134), March 17, 1975. name. The response to an invalid name should be iden- 3. Ritchie, D.M., and Thompson, K. The UNIX time-sharing system. Comm. ACM 17, 7 (July 1974), 365-375. tical to that for a valid name. 4. Wilkes, M.V. Time-Sharing Computer Systems. American When the slow encryption algorithm was first imple- Elsevier, New York, 1968.