Thread View: sci.crypt
2 messages
2 total messages
Started by William Hawkins
Thu, 17 Dec 1992 00:15
Exporting password protection
Author: William Hawkins
Date: Thu, 17 Dec 1992 00:15
Date: Thu, 17 Dec 1992 00:15
27 lines
1627 bytes
1627 bytes
My company makes a process control system, used to control levels, temperatures, and pressures in industrial processes. Some industries, like pharmaceuticals, require password protection of access to the control system, so that data cannot be easily stolen (the data is not encrypted) and the controlled process cannot be changed. So far, we have been able to use one version of software for sales around the world. Apparently, the addition of password protection has broken that, as it is necessary to encrypt the passwords for storage. As I understand it, the Arms Regulation law includes cryptographic software, and prohibits its export without a license - _for each shipment_. Our site saves News for a week. I could not find anything in the 82 articles available specifically on the password subject. I'm sure you've discussed this problem, but I have no access to an archive or a FAQ list. How have other people solved this problem? Does anyone ship software containing password encryption outside the US? Is it possible to get an exclusion to the ITAR regulations? Please email replies. It's much more reliable than News. bill@texan.rosemount.com Minneapolis, MN 612 895-2085
Re: Exporting password protection
Author: Carl Ellison
Date: Thu, 17 Dec 1992 21:58
Date: Thu, 17 Dec 1992 21:58
29 lines
1834 bytes
1834 bytes
In article <BzEwLo.DB6@jabba.ess.harris.com> mvm@epg.harris.com (Matt Mahoney) writes: >You should be able to implement password protection using a one-way >hash function instead of encryption. [...] I would recommend the >MD4 or MD5 hash functions, which (as far as I know) are public >domain, freely exportable, and haven't been broken in spite of wide use. I'd consider using both MD2 and MD5 -- maybe as a cascade. There's no reason to make this fast (so MD4 isn't called for) -- and it's better to make it slow. The slower the code, the harder to do brute force attacks. Note that passwords can still be guessed if they're otherwise guessable: eg., a person's name. I recommend password sentences. My preference is for sentences (possibly computer-generated) which are nonsense. There are more nonsense sentences than real ones and they can be strange enough to be easy to remember. Eg., my friend Tom VanVleck coined the following MANY years ago: "Light bulbs are full of water." It shouldn't be hard to generate your own patently false sentences. -- -- <<Disclaimer: All opinions expressed are my own, of course.>> -- Carl Ellison cme@sw.stratus.com -- Stratus Computer Inc. M3-2-BKW TEL: (508)460-2783 -- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298 FAX: (508)624-7488
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads