Zum Inhalt springen
L

Das Video kommt von YouTube: erst beim Abspielen verbindet sich die Seite mit YouTube (Google).

Passwords, Hashes and Salt (ITS335, Lecture 8, 2013)

Steven Gordon1:21:29 11.522 Aufrufe veröffentlicht Auf YouTube

Das Wichtigste aus dem Video

Tipp auf eine Zeit – das Video springt genau dorthin.

Transkriptautomatisch erstellt · 356 Zeilen
Herunterladen
  1. recall that we normally store at least the some user identity a username for example and we need to store something about the user's password so that and
  2. that information is created when the user registers for the system and then later when the user wants to login they supply their username and password and
  3. the system checks it does a match between those stored values and the supplied values if they're the same everything is OK they log in the problem
  4. we're working on is that what if some malicious user if we say that we store the passwords in a database just a list of IDs and passwords so for every user
  5. their ID and password if a malicious user gets access to our system through other means maybe through some other security floor if they can get access to
  6. the system and read the database then the malicious user has discovered everyone's password and that's a problem because we should try and design our
  7. system and especially our authentication system such that even if there are other flaws in the security and malicious user cannot find the passwords of our users
  8. so what we'd like to do is not store the password in clear well that's easy once the attacker finds that database first approach encrypt the password the
  9. problem with that is that we need a key so encrypt with symmetric key encryption for example then if the malicious user gets this database it can read these
  10. values it needs the key to find the password but the problem with that is that we need to store the key somewhere so if we store the key on the system in
  11. some file then the malicious user can access that file get the key and therefore decrypt all the passwords so it's not much of an improvement in this
  12. case we need to somehow keep that key secure we can't require the user to type in the part at the key all the time it needs to be stored somewhere store in
  13. memory on disk somewhere so this doesn't help because we need to store the secret key if we can't keep the database secret
  14. then there's not much chance that we can keep the secret key secret either so the next approach is to store a hash of the password and this takes advantage of the
  15. fact that their hash function is hard to calculate the inverse it's easy to calculate the hash of the password and get the hash value but it's hard given
  16. just their hash value to go back and find the original password that's our characteristic or property of our hash function it's a one-way function in this
  17. case if the attacker can gain gain access to our database which is our list of ID's and hash values then it's hard for them to find out the original
  18. password and we started doing a little bit of analysis and move to a towards an attack on such a case and I'll just summarize some of the numbers we were
  19. looking at so the idea is don't store the user name and password like the top table instead store the username and the hash of the password the hash value so
  20. these are the md5 hashes of these passwords such that if the attacker can read this database what they need to do is take the hash value and find the
  21. corresponding password that's the attackers aim now now the first way the attacker can try to take the hash value and find the password is to do an attack
  22. on the hash function and effectively try and find the inverse so we say it's practically impossible to find the inverse of the hash that is given the
  23. hash value find the password well the the solution for general hash functions takes amount of effort which is related to the length of the hash value
  24. okay so if you analyze hash functions for the amount of time it takes to take a hash value and find the input where the N bit hash takes two to the power of
  25. n operations so that's effectively a brute-force attack on on the hash function it takes two to the power of n operations for n bit hash value in my
  26. example with a hundred and twenty eight bit md5 hash value what the attacker would need to do given the hash value to find the password is to do two ^ 128
  27. attempts if we can make attempts at the rate of ten to the power of nine per second then that takes ten to the power of 21 years okay so that's why we say
  28. that it's practically impossible given the hash value to go back and find the password in a brute-force approach okay this is practically impossible because
  29. it's too long even if it was a thousand times faster then there's not much changed here okay so even if we can use a thousand computers to do this all at
  30. once still we don't improve the time much so breaking the hash function by calculating the inverse is not possible in practice but one thing is possible
  31. and that is using the fact that the input is a password assuming the passwords are fixed in length and let's say that eight characters let's say that
  32. we've designed the system such the user must choose an eight character password so every user chooses one of exactly a character eight characters not more not
  33. less and they choose from the characters on the keyboard what are the characters on the keyboard I said there were 94 but I listed them
  34. before to show you quickly there's the main set of characters you can type on the keyboard on a standard Keeble okay different keyboards may have other
  35. character sets but 26 lowercase 26 uppercase 10 letters that's 62 characters plus another 32 punctuation characters I've listed the men so let's
  36. say our passwords are selected from these 94 characters so and now let's say a user chooses a random password alright they're not going to in most cases but
  37. let's assume they choose a random password then how many possible values that can they can choose from well 8 characters the first character I choose
  38. in my password is one of these 94 so I've got 94 choices the second character in my password is one of these 94 it may be the same one so I've got another 94
  39. choices for the second character the third character is one of the 94 and the 8th character is one of these 94 characters if I choose randomly so the
  40. number of possible choices in that case is 94 x 94 x 94 eight times which is 94 to the power of eight so if we have an eight character password 94 possible
  41. characters to choose from the number of possible passwords is 94 to the power of eight so now from an attackers perspective what they do is that they
  42. consider all possible passwords remember they have hash values they need to find the corresponding password for a particular user so what they can do is
  43. if we list all of those possible passwords I've listed here password P 1 P 2 P 94 ^ 8 if we have a lot large list here then the attacker takes the first
  44. one calculates the hash of that they'll get a hash value and now they compare that hash value to
  45. the hash value here that we're looking for okay this is 0-6 C 2 so on if it matches that means P 1 is the password that was used as an input to the hash
  46. function here that is the password is what do we have at the top my secret if it doesn't match they try the next password get a hash value compare if
  47. match good we've found the password if not keep moving keep trying other passwords the worst case from the attackers perspective is that have to
  48. try all the possible passwords the number of attempts is 94 ^ 8 so how long does this take from the attackers perspective well it depends upon how
  49. many passwords they need to try and how long each attempt takes and the main or the most time-consuming part of each attempt is calculating the hash if you
  50. think what we need to do is take some password calculate the hash compared to some given value comparison operators are quite fast relative to calculating
  51. the hash so the time it takes to try all 94 ^ 8 really depends upon the number of passwords and how long one hash takes because that's the slowest operation how
  52. longs it take to calculate hash values it depends upon the hash function you can try it you can use open SSL to do a speed test on your computer to see how
  53. long or how many hashes your computer can calculate per second there are websites that were tell us some information about them
  54. depends upon your computer I'll go to most computers are slower than that so most CPUs are slower than GPUs so most
  55. people nowadays use graphical graphics cards to calculate hashes they are designed in such a way that they work very well with calculating hashes so
  56. this is a webpage gives some data of different GPUs and so the different models and some different hash functions and the speed so we're looking at md5
  57. just for our example and the speed for md5 for this for these GPUs the maximum here is about one thousand four hundred and fifty-one million hashes per second
  58. about one point four billion hashes per second okay that's the speed that you can do hashes with that device and there's some other devices listed there
  59. the fastest ones are that the AMD Radeon cards see if I can find the maximum approaching here 10 billion hashes per second for this card okay so that's 10
  60. to the poor yeah 10 to the power of 10 hashes per second so with this card if you buy it and you use it to try and calculate md5 hashes you can do about 10
  61. to the power of 10 hashes per second of course if you have different Hardware different speeds so now we have 94 ^ 8 passwords to try we can do it at a speed
  62. of 10 to the power of 10 hashes per second how many seconds is a take simply 94 to the power of 8 divided by 10 to the power of 10
  63. calculator we have 94 ^ 8 hash values or passwords to try for each password we calculate the hash at a speed of 10 to the power of 10 hashes per second so the
  64. answer here will give us the number of seconds it takes convert seconds to hours and convert hours to days divided by 24 seven days okay so if you run that
  65. hardware calculating hashes it takes about seven days to find the password in the worst case that's the worst case which is not so bad okay if you want to
  66. go faster buy more hardware buy 10 devices and you go 10 times faster seven days compared to ten to the power of 21 years okay so this is practical using
  67. the brute force on the hash is not practical so what the attacker must do if you store the hash of passwords the attacker can
  68. try all possible passwords seven days not too bad how can we make it harder for the attacker so it took seven days in this example how can we make it so
  69. it's longer for the attacker seven years so that's not reasonable for them to do the attack what can we do some simple things now to make this slower sorry
  70. longer password okay so let's say my password was nine characters not eight everything else the same it becomes 94 to the power of nine or
  71. this value times by 94 okay we have 94 times the number of passwords to try so it takes 94 times longer so 94 times 7 days it now takes 2 years for the
  72. attacker by adding one more character then it's about 100 times slower of 94 times flow which is I think 600 days or to about 2 years so that solves the
  73. problem effectively 2 years no one's going to try all right again we can increase the hardware but we no longer passwords are more inconvenient for
  74. users so it's not always a possible solution 9 characters think about your passwords think about how many of them are 9 characters long ok not everyone
  75. how many are random ok this is assuming passwords of random @ Zeke it's much easier when they're structured what else can we do
  76. okay yes increasing the password length increases the time it takes what else how can we slow it down yep sorry
  77. okay this this is what we call an offline attack so the delay that the the attempts at the the youth the attacker can take we're assuming the attacker
  78. let's say has downloaded the database of hash values they have the hash values then they go with their own computer and try to calculate the hash of many
  79. passwords so we cannot control the number of attempts they make this is an offline attack where the attacker can do whatever they like we do not have some
  80. control over how many attempts they can make because they're doing on their own computer but we still can slow it down how how can we slow this down increase
  81. the password length or increase that decrease the speed at which the attacker can try hashes or how different algorithms can be performed at different
  82. speeds these results you see they it's hard to read I know but this speed is for md5
  83. one hash function this is for sha-1 a different hash function md5 is three or four times faster than sha-1 and there are other hash functions so you can
  84. choose hash functions which are slower which makes it longer for the attacker to try them in fact some some hash functions now especially for passwords
  85. allow you to set a parameter such effectively they don't do a hash once they repeat the hash multiple times which makes it even slower so if you can
  86. slow down the speed at which the attacker can try then you increase the time it takes them and that's a common thing today to use one that is slow to
  87. calculate not to slow that it takes ten seconds to do one hash but slow enough if you reduce this slow it down by a factor of 100 you've increased this by a
  88. factor of 100 so slow down the calculator calculation of hashes or increase the number of hashes to calculate of course those two approaches
  89. are not very useful if we're already using md5 or if we've got no control of the hash function or we cannot slow down the attack so another approach is to
  90. introduce a new value called a salt ah no we skip one thing let's let's come back to our attack that takes seven days
  91. so this attack takes seven days okay not too bad let's make it faster what we do is we calculate the hashes of all these ninety-four ^ 8 passwords store them in
  92. a big database the next time we want to break a hash value we just do a look-up on that database and a lookup for the value that is we store these values a
  93. password and the hash value now when I have a hash value as an attacker all I do is take my hash value look through this column until I find the value I've
  94. immediately found the password I don't need to recalculate the hash it's been calculated for me already so what we do is we have a large table that stores
  95. these values and to find the password for a particular hash if you know the hash you just look up and find the password and a lookup in some database
  96. or in some data structure is much much faster than calculating a hash instead of 10 to the power of 10 per second it may be a thousand times faster breaking
  97. bringing this down to seconds minutes and that's what happens in practice someone goes away and they spend a lot
  98. of money and seven days or a month to calculate all these values and then they sell it to other people so that the other people don't have to recalculate
  99. the other people just go and buy a database that stores all of these values and then they can quickly look up the values here's a website that sells and
  100. we'll talk about rainbow tables in a moment but effectively sells a list of passwords and their hash values the one that we were looking at md5 eight
  101. characters actually this is one to a character so passwords of one two three and eight characters the number of values is about this six by ten to the
  102. power of fifteen possible passwords which is 94 to the power of eight approximately and you can they will you can't download this database but they
  103. created a database that stores all these values you can pay them $1,000 so they'll send you a hard disk and what you do is the attacker then is just do a
  104. lookup which is very very fast and it doesn't take seven days they've got results to take five minutes three minutes to find the password so that's a
  105. problem because you can reuse this database only take seven days on the first case let's look at how big this database is I want to store all these
  106. values of password and hash value in some database how BIG's the database let's let's calculate
  107. and we'll turn to that website what do we have we have 94 ^ 8 entries in our database because that's the number of passwords in our example each entry we
  108. store a password and a hash value 1 entry a password how long's our password 8 bytes 8 or 8 characters ok the password we assume is 8 characters to
  109. store that how many bytes do we need let's say 1 by 1 character so 8 bytes and we also store the hash of the password the hash value how big is the
  110. hash value if we're using md5 it's 128 bits which is 16 bytes md5 always produces a hundred and twenty 8-bit hash or a 16 byte hash what we do
  111. is for every password which is eight bytes in length we calculate the hash value and we store them password hash password hash store them in a database
  112. so every entry we have 24 bytes and there are 94 ^ 8 entries so how many bytes do we need total size of our database is 94 ^ 8 times 24 bytes per
  113. entry calculator 24 bytes times 94 ^ 8 that's how many bytes we need in our database let's convert it to terabytes ok hard disks measured in terabytes
  114. what's a terabyte 10 to the power of 12 bytes a gigabyte 10 to the power of 9 a terabyte 10 to the power of 12 so that's the number of terabytes we need to store
  115. this database anyone got a hard drive this size 146 thousand terabytes not practical about 146 thousand terabytes so this attack in the very
  116. basic way of calculating all hash values for all possible passwords storing them in a database and then looking up the database to find the password in theory
  117. works but in practice if we need to store a 150 146,000 terabytes of data it's not practical all right compress the data okay
  118. this assumes we don't have any compression so we can apply some compression how good is compression you compress a file how much smaller is it
  119. after you compress if it's text let's say we have a factor of 1,000 we compress all this data and it's down 146 terabytes
  120. much less but still who has 146 terabytes you need a lot of money to even have that amount okay so it's not something
  121. you can do at home but it turns out there are special ways to compress or to store this data such that it can be stored in a very very small space
  122. relative to the the total amount needed and we're not going to go through the approach but there are some data structures that allow you to store the
  123. password and hash values such that it gets much much smaller and those data structures are called rainbow tables so it's a way to store this information in
  124. a very compressed form so the raw form 146 thousand terabytes you can use a what's called a rainbow table that allows to store the same information in
  125. much smaller space our map space let's have a look at this website
  126. this website has done that I've calculated and let's zoom in a little bit we're looking for md5 in the second row here they've calculated the hashes
  127. of all passwords of one character in length two characters three characters harp until eight characters in length okay which is about the same size as our
  128. example so the total number of passwords is this number six to the power of six by ten to the fifteen which is about ninety four to the power of eight so
  129. it's about the same number of passwords as our example we calculated in the raw form that would need about one hundred and forty six thousand terabytes they
  130. have stored in a rainbow table 576 gigabytes and they'll sell that to you on a hard disk for the cost of a hard disk plus the cost of them selling that
  131. service it's about a thousand dollars to buy that maybe there's others as well so rainbow tables are a data structure that allow us to store the hash values and
  132. passwords in a much much more compressed form which makes it easier for the attacker and that's just one example 576 gigabytes
  133. and it varies on different data sets so now what does the attacker do if they've got your database of hash values so they know the hash value they want to find
  134. the password for your users they go and either generate their own rainbow table maybe it takes them seven days to do so or even faster they buy a rainbow table
  135. or they bought it before and they're reusing it and they just do a lookup and a lookup from a 576 gigabyte database the website gives some statistics it
  136. takes in the order of five to thirty minutes in most cases depending upon your hardware so a lookup for that part hash value is closer to let's say less
  137. than one hour that is given a hash value search through the database for that hash value
  138. once you've found it you found the password it depends on the value but less than an hour to find the password that so really what an attacker needs to
  139. do if they already have a rainbow table takes him an hour to find your password not very secure okay so we still have a problem from the system designers
  140. perspective we want to make it such that the attacker cannot find your password using these approaches of trying all passwords and more importantly using a
  141. table that someone's already created of all passwords we can get from the attackers point of view down to less than an hour which leads to the next
  142. solution the next solution tries to defeat this attack to make it longer for the attacker so it's not possible
  143. and the next solution is let's go back to our slides yeah a brute-force attack we saw took about
  144. seven days how to speed that up is to pre calculate the hash values get someone else to do it for us and we just download or buy the database that's
  145. where we talked about pre calculated hash values and then we just need to do lookup which is much much faster than calculating the hash values and we
  146. talked about if we don't do any compression the problem with pre calculated hash values is that the data structure is in the order of thousands
  147. of terabytes but with special compression techniques called rainbow tables that amount of data is usually in the order of terabytes or less that's
  148. manageable okay we can buy a terabyte disk quite easily so the effect is that using rainbow tables from the attackers perspective it reduces the search time
  149. much faster to find the password but at the increased cost of storage we need to store some large database how do we stop that longer passwords or slower hash
  150. algorithms and or using a salt let's look at the third approach and the final approach and the recommended approach for storing
  151. passwords instead of storing a hash of the password we take the ID of the user we generate a random value when the user registers so the user has their ID and
  152. password the system generates a random value we'll call this the salt and we store the salt this random value and we store a hash of the password combined
  153. with a salt concatenated so just take the password of the user the value they chose take this random value combine them together and hash that and in our
  154. database on our system we store the ID the salt and the hash of the password combined with a salt this salt is some random s bit value don't worry about the
  155. the meaning of the name at the moment but just think of it some random value now when the user logs in this is stored in the database what happens when the
  156. user logs in let's go back to our example here's an example so coming back to our first case first case store the password
  157. in the clear top table not very good second case store the hash of the password much better but you with the use of rainbow tables it's still
  158. possible for attackers to work out the corresponding password third approach store three values in our database the username that John selected that's given
  159. to John the system generates a random salt value in this example of taking some random characters five characters here so the system generates its the
  160. user does not select this the user selected a password John selected the password my secret the system combines his password with the generated salt
  161. that calculates the hash of them and stores that here and same for the other users so that's what we store in our database now now John tries to login
  162. what happens let's draw and see what happens when John attempt to login John submits
  163. John when he logs into the system so here's our system stalls the database he sends his ID and password his ID is John or his user name is John his
  164. password was my secret he sends that in a secure channel to the system and that system needs to check is this really John that's the goal here
  165. so what the system does is with the ID it looks up in its database here okay the ID actually Oh his ID was John his password was my secret
  166. the system looks for the ID in the database okay John that's his first row so now we extract the salt value a 4h star one just some random characters the
  167. system does that and combines this provided password with the salt value just to concatenate them so we get my secret the provider password combined
  168. with those characters and the system then calculates the hash of those values they get a hash value as
  169. an output if it matches this value we pass we have authenticated if it doesn't match then we're not authenticated because if we have the same password as
  170. the registered password it should be the same hash value because we have the same inputs we're using the same salt we don't use a different value we always
  171. use this same salt but for John so we'll be able to login in this case so that's the normal case
  172. now how does this help us what does an ass hacker need to do to find the password same as before the attacker we assume has access to this database what
  173. we want to do is make it hard for the attacker given this database to find the password first thing that they can do is try all possible passwords again that is
  174. they have their 94 ^ 8 passwords what they do is that they take the salt value in the database password p1 calculate the hash compare against this one if it
  175. matches we've found the password if not try the next password that is do the normal attack of try all passwords calculate the hash it takes seven days
  176. we've calculated it's the same as before nothing has changed from that perspective the attacker still has to try all possible passwords let's make
  177. that a bit clearer so the first attack the attack
  178. takes password p1 some 8 characters combines it with the salt for John which was this five characters and then calculates the hash they get a hash
  179. value if it matches the stored hash value be a 5/8 so on if this value matches the store value then we've found John's password because p1 must be the
  180. original password if not we try another password p2 and then we do it for write it all out then we try for p2 and then for p3 and we keep going and we try in
  181. the worst case there are 94 ^ 8 passwords okay so there's the first attack try all possible passwords with this fixed salt note that the attacker
  182. knows the salt gets stored in the database it's not secret how long does it take well 94 ^ 8 passwords at hash speed of 10 to the power of 10 per
  183. second the same as before it's still about 7 days it's the same as before so we haven't defeated that attack the attacker could still find it in 7 days
  184. but what using the salt does is it defeats the attack of using this pre-calculated set of hash values of using the rainbow table the rainbow
  185. table cut the time down to about less than one hour but can we use a rainbow table
  186. so they attack a different attack is to try rainbow table so a rainbow table stores all possible hash values of all possible stores the hash values of all
  187. passwords but a single rainbow table will not use the same or not include a salt value in it if we want to have a
  188. rainbow table for every possible salt we need many rainbow tables the number of rainbow tables depends upon the number of possible salt values let's try and
  189. calculate that and see if it's a bit clearer let's go back remember our rainbow table I just noted here was our data structure that allowed
  190. the attacker it was about 576 gigabytes that's the size and allowed of this attacker to break in less than one hour by doing a lookup so less than an hour
  191. about and what it does is it effectively stores p1 and the hash of p1 and p2 and the hash of p2 all for all possible passwords
  192. so that was our rainbow table that stored the hash values for all passwords and we stored it in such a data structure called a rainbow table so that
  193. the size is small and then we just look up the hash value in this column and we find the password it takes less than an hour that attack but we can't use this
  194. in the attack now because the rainbow table doesn't include the salt value we've got a different input by introducing the salt we need to have a
  195. rainbow table that doesn't have a hash of the password but has a hash of the password concatenated with the salt the attacker doesn't know in advance what
  196. the salt will be it's random so to use pre calculated values for such to download to buy a rainbow table you need to buy one for each possible salt value
  197. because you don't know in advance what salt was used so that means if we go to this website which sells rainbow tables they have a rainbow table for a set of
  198. passwords with no salt value but if I want a rainbow table for the salt value a 4h star 1 then it must have been calculated with that specific salt value
  199. fine that's easy but I don't know which salt value I need it for so what an attacker would need to do would be able to calculate the rainbow tables for all
  200. possible salt values then they would sell them on their website rainbow table for salt one rainbow table for salt - salt 3 and then we could perform an
  201. attack but the number of possible salt values depends upon the length of our salt if I have a salt value which is
  202. mine was five characters five characters is about six bits sorry no five characters are calculated before
  203. is about equivalent to 32 bits in my example I used a 32-bit salt that is I choose to chose our 32 bit random number I just represented it in these
  204. characters 32-bit binary value is chosen how many possible salt values are there 2 to the power of 32 about 4 billion
  205. now from the attackers point of view if they want to precalculate rainbow tables they need to pre calculate for each possible salt value because we don't
  206. know the value in advance so an attacker like that website that's pre calculated the rainbow tables would need to do one for salt one salt - salt three and four
  207. all four billion salt values which is not possible because we've just increased the time to pre calculate by a factor of four billion not seven days
  208. but do that four billion times and we've increased the size to store by a factor of four billion so not 576 gigabytes about 576 a year by its times four
  209. billion so the attacker cannot pre calculate all possible hash values with all possible salts they can do it for one value yes but when I have my
  210. password chosen when I register I may have a different salt value and therefore we cannot use the pre calculated bit every 100 percent clear
  211. on this questions okay when we so when we combine the salt and the password how do we combine it the front or the end it doesn't matter as long as it's defined
  212. and it doesn't have to be mixed remember we take say my password my secret and the salt which was those characters we combine them just at the end if we take
  213. the hash we'll get a random hash value it doesn't matter if they're front or the end it will give us different values but it doesn't add any security as to
  214. where it is it makes no difference we have an example we had
  215. but do we have my secret and we took the md5 sum and I think originally we got the value of zero this is the hash value of my secret but now we combine it with
  216. this salt what was it a 4h star one we get this hash value so that's all we say when I combine just add the salt at the end we get a different hash value what
  217. the attacker would need to do with pre-calculated values is that have to have all possible passwords all possible eight character passwords with this
  218. particular salt value stored in a database but they don't know what salt value I have in advance because maybe I have a different random value so
  219. therefore they cannot have all those pre-calculated solvents so back to your question doesn't matter where you join them as long as it's defined if you join
  220. at the start we'll get a different hash value but the security comes in the fact that the attacker cannot pre calculate the hash values they cannot download a
  221. database that or buy a database that has all the hash values because we need a database for each salt value
  222. further questions we have a quiz when next lecture Thursday okay first quiz in the class
  223. this is an important concept it's quite can be quite confusing yes but it's important concept because it's a major security flaw practical security flaw in
  224. many especially online systems many websites don't use this approach and at an attacker gets access to their database and the attacker releases
  225. millions of users passwords as some on a website so it makes all these passwords available so many large companies have been attacked in such a way a dog Sony
  226. and others people have gained access to their database of passwords and if they're not stored in the right way then someone now has access to all of those
  227. users register - passwords not using rainbow tables so let's look at the numbers for that the idea of a
  228. rainbow table is that we can speed up the time to find the password by storing the values that have been calculated by someone else they still need to be
  229. calculated but let's say someone else did it for us if we need to calculate themselves we saw it takes about seven days but if someone's done it for me it
  230. takes me less than one hour let's say I'm not prepared to wait for seven days one hours okay so we said it takes about half a terabyte to store
  231. this information but with a salt what we'd need to do is to have a rainbow table using every possible salt value and then what I would do is I'll choose
  232. the rainbow table that uses this salt value because I don't know in advance that the attacker what salt value the user has so I would choose the rainbow
  233. table that uses this salt value and then do a lookup and it would take less than one hour but the problem is that we need to generate rainbow tables for every
  234. possible salt value there are in this example four billion possible salt values I would need four billion tables of this size four billion half terabyte
  235. tables in ten years still not gonna help and to generate those four billion tables would have took someone else four
  236. billion times seven days again not possible effectively the salt increases the password length but it doesn't make it inconvenient for the user because the
  237. user doesn't know or care about the salt value that's generated by the system but it's effectively increasing the password length making it much harder to pre
  238. calculate if we don't use the stop value and just use the hash yes we can do that so if we go back to this approach if we do this then the attack is possible if
  239. someone has pre calculated values it's possible if we have a small password we saw it takes about seven days to do an attack takes less than one hour if
  240. someone pre calculated the values if we use a hash only shift what value well we've gone through we said that if the password is eight
  241. eight characters we can try all possible passwords there's no random value here okay if you want to include some random characters in there without the user
  242. knowing importantly the user doesn't know the salt they don't care so it doesn't make the users password longer it's not more inconvenient the system
  243. creates the salt and stores itself then that effectively increases the length of the path password that an attacker needs to try at least in pre-calculated
  244. so if you want to add some random characters that's effectively what the salt is doing here it's just the name of it a salt it's random characters random
  245. bit we still can't stop an attacker trying all passwords okay that attack that took
  246. seven days is still possible it hasn't changed here we've just stopped the attacker using pre-calculated rainbow tables stop them from just
  247. buying a hard disk from some company with pre calculated values once I buy it and have it then they can use it to attack any password we can stop that by
  248. using salts a salt value because the attacker would need the rainbow table with the correct salt value which they don't know
  249. let's summarize the best of the recommended practice for storing passwords so when you create your website you usually will have a list of
  250. users a set of users for your website you need to store their username and their password how do you store it well when storing login information always
  251. store a hash of a salted password we could say we salt the password and the concept is take the users password generate a random value and combine the
  252. password and the random value and hash that store the hash value the random value the salt and the ID we'll come back to passwords in a moment what about
  253. the salt how long should it be it should be random 32 bits are longer it's fine see 32 bits increases the time by a factor of four billion some systems are
  254. shorter but still okay so the longer the salt the harder it is for the attacker 32 bits is fine and it's generated by the system and stored so it stays the
  255. same when you create your account the salt is created and it just stays in the database choose a hash function which is
  256. slow so we don't want a fast hash function because then it makes it easier for the attacker not to slow that it takes a long time to create and check
  257. the password but there are some functions which are slow and you can adapt the speed so that when someone logs in maybe it just takes a second to
  258. check their password but it makes it very hard for the attacker to try all possible password them so they're a special so some functions bcrypt
  259. a script passed password-based key derivation function number two there's another one that recommended for generating power for storing and hashing
  260. passwords md5 is not recommended sha sha 256 is maybe okay but there are other ones recommended importantly designed for failure all of the
  261. discussion we've had assumed the attacker can find the password database don't think that you can keep your password database secure design your
  262. system assuming that someone can break into it and find the duck password database because there are many avenues ability of attack we need to design
  263. systems that have multiple security mechanisms we don't rely on just one security mechanism because if that fails the whole system fails so assume someone
  264. can find the database make it secure but if they do find it use a salt and a hash so that it makes it very very hard for them to find the password
  265. any final questions on salts and passwords or storing passwords try and get your head around that those concepts may be if you don't follow try and
  266. repeat the calculations I've done of how many passwords what would it take for an attacker to find the password if you're one you can try with smaller examples I
  267. use 8 characters try with let's say a three character password chosen from the letters ABCDE it is from five letters and look at all combinations and then
  268. apply that to a more real realistic scenario the last few slides about passwords just to some examples alright that's about
  269. storing passwords but all of this is about we've assumed random passwords but users don't choose random passwords so how do users choose passwords anyone
  270. recommendations not off what's a good what's your password but what's a good way to choose a password how do you choose a sorry name how do you choose so
  271. you use your name as your password okay use a name but I have a I have a dictionary okay as an attacker what I've done is I've gone and downloaded
  272. databases of names in every language okay so what I do as an attacker when I have and I'm trying to guess your password I try first I don't try random
  273. passwords I try a list of words from a dictionary and then combinations of those words and then I try a list of names of people and there's not many
  274. okay there are not billions and billions even then we need with a fast with fast hardware to try many attempts then it doesn't take long to try all possible
  275. names and even combinations of names it may stop someone from guessing while they try to log into your system but it doesn't stop someone from guessing if
  276. they have the password database from trying many many attempts what else can you use as a scheme any other suggestions different suggestions
  277. don't tell me how you chose don't tell me your password but you may think of how did you choose your password and he said ideas or recommendations to the
  278. other students how do you choose a strong password hmm birthday okay how many possible birthdays are there in the world
  279. not many okay all right consider the last 50 years over the last 70 years 365 days in the year so over the last 100 years there's 36 thousand values to try
  280. not many takes me a second to try them all right combine that with other information so choosing values it's not easy and there's two really two
  281. different avenues of an attack one is if someone can try all possible values the other is if someone knows you and they're trying selected values we spoke
  282. about the different vulnerabilities if someone knows you they know your birthday they can get they don't have to guess your birthday they know our this
  283. person uses his birthday to choose his password I'm going to try a few words in his birthday and maybe they'll get it so you need to think of different
  284. strategies for selecting passwords and it's not easy you need to consider the different vulnerabilities that were reported or listed in the previous
  285. lecture and try and select passwords that defeats those vulnerabilities this is just a couple of slides that someone has done analysis of leaked passwords
  286. that is people have found a password database released it on the internet and then people have done some analysis and looked at statistics of the words or the
  287. structure of those passwords chosen this was one from a leak of who of about 300,000 a list of 300,000 passwords I'm not sure which company they were leaked
  288. from I can't remember I've done some analysis of those 300,000 passwords people chose and about a quarter were dictionary words a
  289. dictionary word is something that's in a dictionary there's only about a hundred thousand words in the English dictionary consider other languages still not many
  290. so many people choose passwords using words from dictionaries 8% names of places 14% names of people okay so this is just and the other big one is numbers
  291. okay not one two three four I hope but other numbers were chosen and other things so 31% they couldn't recognize any pattern so maybe they were good
  292. passwords so this is not saying what to select they're saying some trends of what people do select and the fact that using
  293. dictionary words makes it much easier for the attacker because all the attacker needs to do is try all the values in the dictionary 100 thousand
  294. values very fast an analysis of passwords leaked from Sony the length so typically six to
  295. eight characters or the length of passwords some are longer some are shorter it depends upon the system maybe it has constraints some other
  296. characteristics most people use only alphanumeric characters letters and numbers a to Z 0 to 9 they don't use punctuation characters so
  297. therefore an attacker when they try passwords will try first passwords which have just letters and numbers they don't need to try the passwords with
  298. characters because it's most likely someone has a news character their punctuation characters it's most likely someone has a news punctuation character
  299. most passwords are in dictionaries or what you can download what's called password dictionaries not just normal dictionaries but a list of words which
  300. combine normal words combined dates the dates of the year combine different names combined characters in different ways like check replacing the letter L
  301. with a letter with a character one so there are dictionaries that attackers can use that have all these values to try if you look at the lists of leaked
  302. passwords usually the most common ones they include these one two three four five six password and so on so they are very common passwords in some of the
  303. leaks what about used Thai Thai language does it help not really against dictionary attacks because you just get
  304. a dictionary in time they're available okay if you know so using a different language if someone knows you then they can guess the language you've used one
  305. of several so it may increase the effort by a factor but it may double the effort to check it can help a little bit if you start to combine different languages but
  306. just using everything in Thai is not much better than using everything in English because someone can just try the dot Thai dictionary but there may be
  307. other ways to improve another thing usually or some systems require you to change your password on a regular basis most users when they're forced to change
  308. their password change it by a single letter okay their password was password the system automatically requires them to change it every month so the second
  309. month they set it to password one the next month password - password three and coming back to January next year password one again
  310. so changing passwords doesn't necessarily help because users don't like to change their password sorry forcing users to change passwords
  311. doesn't necessarily help changing passwords does but users usually choose the same one or similar so how do you select passwords we will not discuss
  312. other than just listing some different strategies make sure users are aware of the issues of selecting bad passwords they know that if they select a easy to
  313. guess password there can be consequences so inform and educate users of sort of choosing good passwords advise them on strategies for choosing good passwords
  314. computer generated passwords the user doesn't get to choose the password when you create your account the system creates one for you anyone seen those
  315. systems before has anyone had that where you create an account you can't choose a password but the system creates one a random password for you yeah when you
  316. got your first account on ICT server I think you got an email from me or from the admin with a random password in there okay
  317. can you remember that value unlikely generating random passwords is not very easy or convenient for the users so it can be more secure for guessing but
  318. harder for the users pronounceable words so you can have some constraints on those random characters such that for example we have consonants followed by
  319. vowels so it's a little bit easier to pronounce something that you can pronounce may be easier to remember but still not very convenient
  320. check passwords either reactively or proactively reactively is you all the users on the Moodle system choose their passwords I let you choose your own
  321. password and then I have a check every month and I check the strength of your passwords that is I try to crack your passwords and if I find a weak one that
  322. I can find easily then I inform you saying your password is weak try and update it change it so if I see that all the users have chosen one two three four
  323. five six as their password maybe I can inform them try and use a new one or proactively when the user is selecting the password advise them on the strength
  324. and many websites do this now you type in your password the website gives some feedback this is a weak password either try again or this is a very strong good
  325. you can proceed so give some feedback when they select the password there are other issues with passwords the main thing we're focusing on is
  326. storing passwords any questions or discussion on passwords before we stop there
  327. think about your passwords that you have for all your systems think about their length are they long enough they dictionary words are they easy to guess
  328. are they reused across many systems that is you use your password for your ICT Moodle account and the same password is used for your email for your bank and
  329. for other accounts maybe someone hacks into the ICT server gets your password now they have your password for the bank ok or maybe you don't trust me I'm the
  330. admin for the ICT server I set up a server that it reads your password when you log in next and now I know your password and your password to your bank
  331. your email and everything else so reusing passwords across systems is troublesome so think about what passwords you use and think about how
  332. you can improve your password usage if you have an old password and you add more characters to the end it maybe
  333. depends a little bit about on what your original password was and what characters you add but generally the longer it is the more secure it is okay
  334. so making it long enough or long is a good approach but of course choosing a password which is password password is even though it's what 16 characters long
  335. it's not very secure so you can't just choose any 16 characters choose 16 characters which are unlikely to be in a dictionary or hard to guess we're
  336. focused we're focused on how to authenticate users a user wants to access a computer system the computer system needs to check that this is the
  337. right user the main form is passwords there are other forms and we will not really go through them I think with with time token-based is to use some for
  338. example some some swipe card some USB token that provides some other form of authentication for the user something that identifies that user so there are
  339. different types of tokens for example Bank cards now have in inbuilt processes embedded processes on them that can do some exchange with the reader to perform
  340. some authentication some are contact that is you need to touch them others and have an inbuilt antenna contactless so you're starting now with mobile
  341. phones to get there's near field communications NFC such that you can bring two mobile phones to get together or a mobile phone near a reader and they
  342. talk to each other wirelessly to do some form of authentication so the phone is the token in that case the object that identifies
  343. bank cards ATM cards and so on and examples but not very good for replacing passwords because they require some reader if you lose the token if you lose
  344. the card it's inconvenient so use for some systems but not used for many online systems similarly smart cards the other form of
  345. authentication is biometric fingerprint voice recognition eyes and so on so based upon the unique physical characteristics of the user and the main
  346. ones your face shape of your face your fingerprints your hand your retina and your iris okay the characteristics of them are usually unique to the to a
  347. human your your voice your voice and your your written signature a common biometric authentication techniques and some are easier than others and the
  348. general trade-off is some are more accurate and identifying someone but some are more costly in terms of implementing the devices that perform
  349. the authentication so iris detection is very accurate but expensive to implement a system so looking at your iris and okay scanning it you need some expensive
  350. hardware to scan your iris but if it works it will accurately identify the user there's not much chance that you'll get the wrong person voice relatively
  351. easy or cheap to implement just measure someone's voice some audio but it's harder to distinguish users it's more likely you'll get two users that are
  352. identified as the same person by the system and I think that's all we'll say about them there's a few other slides but not
  353. for our coverage we care about what you know passwords we've looked at others include what you possess and what you are or do biometrics and tokens try and
  354. understand the main concepts of passwords passwords storage and think about how to select passwords on Thursday we'll have a quiz in class quiz
  355. paper quiz answer some questions over 10 minutes what copic sever ething i think everything that we know so far
  356. passwords and some cryptographic techniques okay so it's something about the concepts of cryptography and passwords and password storage

Zum Nachlesen

InternetMit Social-Media-Plattformen wie Facebook, Twitter oder YouTube trat das bidirektionale Austauschen von Inhalten unter den Nutzern (sogenanntem user …