Selecting Secure Passwords

  • Eric R. Verheul
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4377)


We mathematically explore a model for the shortness and security for passwords that are stored in hashed form. The model is implicitly in the NIST publication [8] and is based on conditions of the Shannon, Guessing and Min Entropy. We establish various new relations between these three notions of entropy, providing strong improvements on existing bounds such as the McEliece-Yu bound from [7] and the Min entropy lowerbound on Shannon entropy [3]. As an application we present an algorithm generating near optimally short passwords given certain security restrictions. Such passwords are specifically applicable in the context of one time passwords (e.g. initial passwords, activation codes).


Convex Hull Extreme Point Shannon Entropy Activation Code Strong Improvement 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Arikan, E.: An inequality on guessing and its application to sequential decoding. IEEE Trans. Inform. Theory 42, 99–105 (1996)zbMATHCrossRefMathSciNetGoogle Scholar
  2. 2.
    Bosselaers, A.: Even faster hashing on the Pentium. In: Fumy, W. (ed.) EUROCRYPT 1997. LNCS, vol. 1233. Springer, Heidelberg (1997)Google Scholar
  3. 3.
    Cachin, C.: Entropy Measures and Unconditional Security in Cryptography. ETH Series in Information Security and Cryptography, vol. 1. Hartung-Gorre Verlag, Konstanz (1997) (Reprint of Ph.D. dissertation No. 12187, ETH Zürich)Google Scholar
  4. 4.
    Huffman, D.A.: A method for the construction of minimum-redundancy codes. In: Proceedings of the I.R.E., pp. 1098–1102 (1952)Google Scholar
  5. 5.
    Malone, D., Sullivan, W.G.: Guesswork and entropy. IEEE Transactions on Information Theory 50(3), 525–526 (2004)CrossRefMathSciNetGoogle Scholar
  6. 6.
    Massey, J.L.: Guessing and entropy. In: Proc. 1994 IEEE International Symposium on Information Theory, p. 204 (1994)Google Scholar
  7. 7.
    McEliece, R.J., Yu, Z.: An inequality on entropy. In: Proc. 1995 IEEE International Symposium on Information Theory, p. 329 (1995)Google Scholar
  8. 8.
    NIST, Electronic Authentication Guideline, Special Publication 800-63 (2004)Google Scholar
  9. 9.
    Royden, H.L.: Real analysis. Macmillan Publishing company, New York (1988)zbMATHGoogle Scholar
  10. 10.
  11. 11.
    van de Vel, M.L.J.: Theory of Convex Structures. North-Holland, Amsterdam (1993)zbMATHGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Eric R. Verheul
    • 1
  1. 1.Institute for Computing and Information SciencesPricewaterhouseCoopers Advisory, Radboud University NijmegenUtrechtThe Netherlands

Personalised recommendations