Re: Crypt should be based on MD5 (was: the Crypt 16 discussion)

Thread View: sci.crypt

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Rodent of Unusual Size Thu, 23 Jul 1992 13:45

#481

Author: Rodent of Unusual Size
Date: Thu, 23 Jul 1992 13:45

27 lines
2029 bytes

    Well, having a password expiration can limit exposure under some
    circumstances.  If passwords are fairly well chosen (none of this 91Jan,
    91Feb, 91Mar stuff), and one should happen to be revealed accidentally
    (NOT deduced or decrypted), the account is exposed only until the next
    time the password must be changed.  The actual window of exposure can be
    anywhere from 0 to T (where T is the password lifetime), depending upon
    when the password was disclosed.

    I'm not sure of the value of this, but it seemed reasonable to bring it
    up.

    Of course, if the lifetime is too long, this window grows.  If it is too
    short, the user will circumvent it by writing the password down in a
    convenient place or otherwise not safeguard it appropriately.  Based upon
    experience, I feel a couple of months is a reasonable value for most
    users.  Your kilometreage may vary..

    Practical security is a balancing act, sailing between the Scylla of
    exposure and the Charybdis of user convenience.

    #ken    :-)}	Jeratol the Chaotic

Coar@Nephi.Enet.DEC.Com	 | All opinions herein contained, stated or implied,
Coar@DECUS.Org		 | are solely those of the author.  And he's fullovem.
Coar@Eisner.DECUS.Org	 | `... it was mine art, ... that made gape the pine 
Massachusetts, USA       | and let thee out.'  - Prospero (_The Tempest_)

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads