Abstract
We mathematically explore a model for the shortness and security for passwords that are stored in hashed form. The model is implicitly in the NIST publication [8] and is based on conditions of the Shannon, Guessing and Min Entropy. We establish various new relations between these three notions of entropy, providing strong improvements on existing bounds such as the McEliece-Yu bound from [7] and the Min entropy lowerbound on Shannon entropy [3]. As an application we present an algorithm generating near optimally short passwords given certain security restrictions. Such passwords are specifically applicable in the context of one time passwords (e.g. initial passwords, activation codes).
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Arikan, E.: An inequality on guessing and its application to sequential decoding. IEEE Trans. Inform. Theory 42, 99–105 (1996)
Bosselaers, A.: Even faster hashing on the Pentium. In: Fumy, W. (ed.) EUROCRYPT 1997. LNCS, vol. 1233. Springer, Heidelberg (1997)
Cachin, C.: Entropy Measures and Unconditional Security in Cryptography. ETH Series in Information Security and Cryptography, vol. 1. Hartung-Gorre Verlag, Konstanz (1997) (Reprint of Ph.D. dissertation No. 12187, ETH Zürich)
Huffman, D.A.: A method for the construction of minimum-redundancy codes. In: Proceedings of the I.R.E., pp. 1098–1102 (1952)
Malone, D., Sullivan, W.G.: Guesswork and entropy. IEEE Transactions on Information Theory 50(3), 525–526 (2004)
Massey, J.L.: Guessing and entropy. In: Proc. 1994 IEEE International Symposium on Information Theory, p. 204 (1994)
McEliece, R.J., Yu, Z.: An inequality on entropy. In: Proc. 1995 IEEE International Symposium on Information Theory, p. 329 (1995)
NIST, Electronic Authentication Guideline, Special Publication 800-63 (2004)
Royden, H.L.: Real analysis. Macmillan Publishing company, New York (1988)
Sci. crypt crypto FAQ, http://www.faqs.org/faqs/cryptography-faq/part04
van de Vel, M.L.J.: Theory of Convex Structures. North-Holland, Amsterdam (1993)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Verheul, E.R. (2006). Selecting Secure Passwords. In: Abe, M. (eds) Topics in Cryptology – CT-RSA 2007. CT-RSA 2007. Lecture Notes in Computer Science, vol 4377. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11967668_4
Download citation
DOI: https://doi.org/10.1007/11967668_4
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-69327-7
Online ISBN: 978-3-540-69328-4
eBook Packages: Computer ScienceComputer Science (R0)