631 lines
35 KiB
Plaintext
631 lines
35 KiB
Plaintext
|
|
=====================================
|
|
Passphrase FAQ Version 1.04
|
|
Last update: 16 June, 1995
|
|
Copyright 1995-96 Randall T. Williams
|
|
=====================================
|
|
|
|
*****************************************************************************
|
|
|
|
Contents
|
|
========
|
|
1.0 Introduction
|
|
1.0.1 Where do I find the Passphrase FAQ?
|
|
1.1 How things are used in this document
|
|
1.2 How do I get random numbers?
|
|
1.2.1 Psuedo-random number generators
|
|
1.2.2 Hardware random number generators
|
|
1.3 How hard is it to crack the IDEA key?
|
|
1.4 How hard is it to crack RSA?
|
|
1.5 What is MD5?
|
|
2.0 How long should the passphrase be?
|
|
2.0.1 What if I use another language?
|
|
2.1 What if I use common phrases or quotes?
|
|
2.2 What happens if I combine phrases and nonsense phrases?
|
|
2.3 Does odd spelling, punctuation and capitalization help?
|
|
2.4 What if I use random words?
|
|
2.4.1 Can I use a key generator dictionary?
|
|
2.5 What if I use all random letters?
|
|
2.6 What if I use all random characters?
|
|
2.7 How long does it take to attack a passphrase?
|
|
2.7.1 Something anyone can do
|
|
3.0 How do I make a strong passphrase?
|
|
4.0 How strong is my passphrase?
|
|
4.1 Passphrase examples
|
|
5.0 Who might try to get my passphrase and how?
|
|
5.1 Law enforcement and the government
|
|
5.2 Multitasking systems
|
|
5.3 Multi-user systems
|
|
5.4 Tempest and electronic surveillance
|
|
6.0 How do I securely store my passphrase?
|
|
6.1 Should I write my passphrase down?
|
|
7.0 The really big numbers
|
|
7.1 glossary
|
|
8.0 Copyrights and such
|
|
9.0 References
|
|
|
|
*****************************************************************************
|
|
|
|
|
|
|
|
1.0 Introduction
|
|
================
|
|
This is The Passphrase FAQ for PGP. I tried to include everything
|
|
I've seen asked on alt.security.pgp along with some extras to cover other
|
|
things like passwords and different key lengths. Most people who have had
|
|
college algebra or higher should be able to follow the math. Check the
|
|
glossary in section 7.1 to help with some of the terms and how they are
|
|
used.
|
|
MD5 and IDEA are based on 128 bit blocks. It should be trivial to change
|
|
to a 56 bit DES key or keys of other sizes. Passwords are different than
|
|
passphrases due to length. The same ideas will work for analyzing your
|
|
password or passphrase.
|
|
This FAQ is under construction (aren't they all?). Changes will be made
|
|
as I learn about them, generate them or have time. Applied Cryptography [1]
|
|
leads me to believe that there hasn't been much published research in this
|
|
area. Password cracking is covered, but little is said about passphrases.
|
|
Some of the math involved is not normally a part of what I do. I'm an
|
|
electronics engineer by training. Cryptography is just a hobby. Forgive
|
|
anything that may seem trivial that was overlooked. I created most of this
|
|
from my head. Comments, corrections, additions, encouragement and positive
|
|
criticism can be emailed to ac387@yfn.ysu.edu, but don't expect much of a
|
|
reply. Flames should be sent to /dev/null.
|
|
|
|
1.0.1 Where do I find the Passphrase FAQ?
|
|
=======================================
|
|
This is a catch 22. Since you are reading this, you found it. If you
|
|
can't find it, this section probably won't help. So far there is only
|
|
three official places you can find the Passphrase FAQ. Thanks go to
|
|
Galactus, Don Henson and Patrick Finerty for the web sites. A PGP signed
|
|
copy of the FAQ also gets posted to alt.security.pgp about the middle of
|
|
every month (most of the time).
|
|
|
|
They are:
|
|
http://www.stack.urc.tue.nl/~galactus/remailers/passphrase-faq.html
|
|
http://colossus.net/wepinsto/wsft_f/wspp_f/passfraz.html
|
|
http://zifi.genetics.utah.edu/crypto/crypto.html
|
|
|
|
1.1 How things are used in this document
|
|
=========================================
|
|
The first thing is about the numbers used in this document. Most math
|
|
here was performed on a Texas Instruments TI-60 pocket calculator and a
|
|
couple programs on my PC for verification. The number of significant digits
|
|
is limited to just a few places because a string of almost 40 digits isn't
|
|
needed and they are really beyond the comprehension of many. Look at section
|
|
6.0 for the exact value of some of the big numbers used here. I use the
|
|
notation where 3.4E38 = 3.4 * 10^38 = 2^128. This was easier to type and
|
|
it saves a little space. Also note that log(x) (base 10) is being used here.
|
|
Since we are just using the exponents, don't worry about using ln(x)
|
|
(base 2.718 or e) if you don't have log(x).
|
|
Rounding where it effects security are rounded up to the next highest
|
|
whole number to be safe. Other numbers are just rounded to the nearest
|
|
decimal place. The text should be clear on this in most cases.
|
|
References are numbered and enclosed in []. Sub references have a lower
|
|
case letter added. So with that out of the way, on to other things.
|
|
|
|
1.2 How do I get random numbers?
|
|
================================
|
|
Random numbers are very hard to generate. Quite often non-random events
|
|
effect the randomness of devices or circuits. A suggestion would be to make
|
|
1 to N markers and place them in a very good mixer. You might want to try
|
|
coin flipping, but if you have a person involved, a coin flip can be biased
|
|
enough to skew the results over the long term. A ball method like several
|
|
lotteries use is a good random source, but don't use the numbers from the
|
|
lottery. Lottery numbers are a little to obvious and it is easy to try them.
|
|
A pool/billiards game uses a set of balls in a bottle that allows only one
|
|
ball to be extracted at a time. This is a cheap and inexpensive source for
|
|
random numbers. I leave it to the reader to figure out how to get the 16
|
|
balls translated to something useful for any particular application. Those
|
|
who are familiar with Dungeons and Dragons and the other role playing games
|
|
may already have a set of dice numbered in a variety of sizes. The one
|
|
caution with dice is that adding dice (Eg. 2 six sided dice) will change the
|
|
output to a median number (odds of 7 are 1 in 6) and the extremes (odds of
|
|
2 and 12 are 1 in 36) are less likely to occur, losing some randomness.
|
|
Be sure that you have random dice. The quality is sometimes not very good
|
|
and may cause non-random results. You might want to look at RFC1750 [6]
|
|
for more information on generating random numbers for secure purposes.
|
|
|
|
1.2.1 Psuedo-random number generators
|
|
=====================================
|
|
Using a PRNG is in most cases a bad way to generate random numbers.
|
|
The problem with PRNGs is the numbers are generated by a function.
|
|
This includes the BASIC RND() function, the C rand() function or any
|
|
other language that has a random function. Programmers have used this
|
|
simple and relatively fast method in programs and games for years.
|
|
The reason for this is because of the way PRNGs work. A simple PRNG
|
|
will use code something like R = (A * R1 + B) mod(C): R1 = R: R = R / C.
|
|
Primes are usually used for constants A, B, and C. Most languages have
|
|
provisions for placing a seed value in R1 before calling the PRNG but it
|
|
isn't needed and some PRNGs may not bother with the additive constant B.
|
|
What makes a PRNG easy to break is that many only use 16 bits to store the
|
|
values. That means we can brute force a 16 bit PRNG key space in 65536 * N
|
|
attempts where N is the number of psuedo-random elements used. Almost anyone
|
|
can probably search a standard PRNG key space in a day. A worst case search
|
|
will probably last less than a week even on the average home computer.
|
|
If you are lucky and have a good PRNG, then the search space may be
|
|
2^32 which isn't a whole lot better. Note that 40 bit keys can be brute
|
|
forced by an individual with access to enough computing power in about a
|
|
week or less and places like the NSA don't mind 40 bit keys. Look at [1e]
|
|
for more information and other references on random sequence generators.
|
|
|
|
1.2.2 Hardware random number generators
|
|
=======================================
|
|
Hardware generators can be made using the noise from a variety of
|
|
semiconductor PN junctions. A good example of this is simply amplified
|
|
noise from a zener diode. Other noise sources are high value resistors and
|
|
a number of commercial chips that use a variety techniques to make noise.
|
|
A caution with hardware sources of random information is that they could
|
|
be influenced by noise or other signals that are not random. Most places
|
|
are saturated with 50 or 60 Hz noise from power, clock signals and other
|
|
digital noise from computers, television and radio, and a variety of other
|
|
types of electronic equipment. For safety, you may want to encrypt or hash
|
|
the output of a hardware source. A good hash function or encryption will
|
|
hide any undiscovered patterns. An inexpensive random bit source can be
|
|
built for $10.00 (U.S.) [7] and mass produced for under $5.00 (U.S.).
|
|
|
|
1.3 How hard is it to crack the IDEA key?
|
|
=========================================
|
|
PGP uses IDEA as the conventional cipher. The key for IDEA is 128 bits.
|
|
We can calculate the brute force key space with 2^128 = 3.4E38. A special
|
|
hardware based key cracker for IDEA that can try one billion (1E9) keys
|
|
per second will take 1.08E22 years to go through all possible keys.
|
|
You can expect to get most keys in about half that time which will take
|
|
5.39E21 years. It is estimated that the sun will go nova in 1E9 years.
|
|
Since the algorithm is secure, the cryptanalyst has to go after other things
|
|
like RSA or your passphrase. It is currently beyond our technology to crack
|
|
an IDEA key by brute force.
|
|
|
|
1.4 How hard is it to crack RSA?
|
|
================================
|
|
Factoring is an easier problem than brute force search of the key space.
|
|
The only current practical factoring methods for RSA size numbers are the
|
|
Multiple Polynomial Quadratic Sieve (MPQS) and it's variations, and the
|
|
Number Field Sieve (NFS). Estimates for the MPQS run around 3.7E9 years
|
|
for a 200 digit/664 bit number [1d]. I should include that no one knows
|
|
how long it will take to factor numbers larger than about 130 digits/429 bits
|
|
except for some special cases. Some net references on numbers that have been
|
|
factored are RSA129 and The 384 Bit Blacknet Key. You should note that it
|
|
took a lot less time and computing power to factor a 116 digit/384 bit key
|
|
than it took to factor a 129 digit/426 bit key. The NFS factored RSA130 a
|
|
130 digit/430 bit key even faster than RSA129 was factored. RSA is probably
|
|
the weakest link in PGP, but currently no one knows a good way to factor
|
|
numbers over 155 digits/512 bits without building special hardware.
|
|
|
|
1.5 What is MD5?
|
|
================
|
|
MD5 is what takes your passphrase and scrambles it into an IDEA key.
|
|
In theory, MD5 should generate a different output for every possible
|
|
bit combination as long as your key space is equal to or larger than 2^128.
|
|
Proving that MD5 will generate all 2^128 outputs from a given key space
|
|
equal to 2^128 is practically impossible. This would be about the same as a
|
|
brute force search on the IDEA key. An interesting problem is that
|
|
theoretically you can produce an equivalent passphrase by searching any given
|
|
key space that is 2^128 or larger.
|
|
In light of the recent attack on MD5, wait and watch. While a weakness
|
|
has been found, the jury is still out on using unmodified MD5. A move to
|
|
SHA or other hash function may be in the future for PGP.
|
|
|
|
2.0 How long should the passphrase be?
|
|
======================================
|
|
The rule of thumb is that you use one character per bit of key needed.
|
|
You really get about 1.2 bits per English text character [1c] for key usage.
|
|
Modifying the key size means 128 / 1.2 = 106.667 or 107 letters of text are
|
|
needed. This assumes normal English structure, only lower case letters and
|
|
spaces for the passphrase and for the calculation purposes, all spaces are
|
|
ignored in the passphrase [1a]. Few of us are willing to type out a line and
|
|
a half of text every time we use PGP though. This is where security fails
|
|
and we use weak passphrases.
|
|
|
|
2.0.1 What if I use another language?
|
|
=====================================
|
|
Using your native language is probably an obvious choice. Throughout
|
|
this FAQ, data and statistics apply to English text. Using another language
|
|
or combining languages will change the numbers some. It will not make your
|
|
passphrase harder to guess. Attacking a different language or even multiple
|
|
languages is still the same. The search space is roughly the size of the
|
|
language or grows by adding the size of the average size of the vocabulary
|
|
of the added language. Dictionary attacks in another language would run in
|
|
the same manner as a dictionary attack in English.
|
|
|
|
2.1 What if I use common phrases or quotes?
|
|
===========================================
|
|
The short version on common phrases is don't use them ever. A book of
|
|
quotes may contain 40,000 quotes [5]. You could probably set an old PC XT
|
|
in a corner and have common phrases checked in a relatively short amount
|
|
of time without any special hardware. Simple phrases will be the first
|
|
ones checked. If you are a Star Trek fan, "Beam me up Scottie" is a bad
|
|
phrase to use. If you can find the phrase in any published work then don't
|
|
use it. A simple background search will reveal what kind of music, books,
|
|
TV shows, movies, games, hobbies, and everything else you might use. All
|
|
the common phrases will be tried on the first pass of a key search. You can
|
|
try 40,000 quotes using unmodified PGP in about 2.4 days. See section 2.7.1
|
|
|
|
2.2 What happens if I combine phrases and nonsense phrases?
|
|
===========================================================
|
|
Combining phrases extends the phrase search some. Nonsense phrases will
|
|
also slow down a brute force search [4]. A smart attack would take advantage
|
|
of normal phrase structure. Ordering nouns, verbs, adverbs, adjectives
|
|
and all the other components of a sentence would be tried in a natural
|
|
order. A good nonsense phrase begins to appear to be random as far as a
|
|
brute force search goes, but it isn't really random.
|
|
|
|
2.3 Does Odd spelling, punctuation and capitalization help?
|
|
===========================================================
|
|
Using "0dd sp3LLing5 and CaPitaliZaTiOn" will extend the search by about
|
|
1 million tries [1b] per word. Modifying the numbers for passphrases means
|
|
you probably get more than 8 million (1 million per word) for a decent
|
|
passphrase. Capitalization at random will cause word length dependent
|
|
permutations. Adding a single digit 0-9 to a word multiplies the dictionary
|
|
size by 10. This is a small gain but in some cases may be worth the trouble.
|
|
Substituting 3 for E, 1 for I, 5 for S and 2 for Z adds the numbers to the
|
|
possible alphabet. Adding the numbers 0-9 increases the alphabet to 36
|
|
characters. Switching letters, letter rotations, letter shifts, and other
|
|
word scrambling won't help the randomness but they do slow the brute force
|
|
search some. You can approach a random looking passphrase in this
|
|
manner.
|
|
|
|
2.4 What if I use random words?
|
|
===============================
|
|
A dictionary [3] has around 74,000 words in it. Using the 128 bit key
|
|
size we then need, log(2^128) / log(74,000) = 7.91, random words from
|
|
our dictionary. Rounding up, you will then need 8 random words to make
|
|
the passphrase harder than the IDEA key. A brute force dictionary attack
|
|
will then take slightly longer than a brute force attack on the IDEA key.
|
|
This is a decent way to generate a passphrase except that it is kind of
|
|
hard to remember sometimes. This is pretty easy to type though.
|
|
|
|
2.4.1 Can I use a key generator dictionary?
|
|
===========================================
|
|
A smaller dictionary can be searched much faster. Just having one around
|
|
is enough of a clue to start with that instead of the normal searches.
|
|
So, you better be sure your key generation system is really random. Programs
|
|
can be compromised, written poorly or simply monitored. Try Diceware [8] for
|
|
a good random passphrase generation system. It is irrelevant if the
|
|
dictionary has any tricks that make the construction of the words more
|
|
random. In the end, the search space is all that counts. The random number
|
|
source may not be random and further reduce the search. For these reasons,
|
|
you need to be sure your key generator is really random.
|
|
Here is what effect different size dictionaries have. Using a 10,000
|
|
word dictionary, (from section 2.7) log(3.16E13) / log(10,000) = 3.37 or
|
|
about 4 words are needed to last more than the average 6 months. Using the
|
|
same dictionary to create an IDEA equivalent passphrase gives us
|
|
log(2^128) / log(10,000) = 9.63 or 10 words are needed. Using a 25,000 word
|
|
dictionary means log(2^128) / log(25,000) = 8.76 or 9 words. A 50,000 word
|
|
dictionary needs log(2^128) / log(50,000) = 8.20 or 9 words.
|
|
|
|
2.5 What if I use all random letters?
|
|
=====================================
|
|
The standard alphabet has 26 letters in it. Doing the math again we get
|
|
log(2^128) / log(26) = 27.23 random letters are needed. Rounding up will mean u
|
|
sing 28 letters to make it harder than the IDEA key. Memorizing
|
|
the 28 random letters would be tough to do, but it isn't impossible. This
|
|
isn't to bad to type though.
|
|
|
|
2.6 What if I use all random characters?
|
|
========================================
|
|
If we use all possible printable ASCII characters we end up with 95
|
|
possible characters to work with. Punching buttons we end up needing
|
|
log(2^128) / log(95) = 19.48 random characters for this method.
|
|
Rounding up again, 20 random characters are needed to make this method
|
|
harder than the IDEA key. Memorizing 20 random characters is still a tough
|
|
job, and it is kind of hard to type.
|
|
|
|
2.7 How long does it take to attack a passphrase?
|
|
=================================================
|
|
We can assume that a 1 million key per second key cracker is possible.
|
|
A Pentium executes about 1 instruction per clock cycle with pipelining [3].
|
|
Using a 200Mhz Pentium and minimal instructions shows us that a small
|
|
program will run 1 million times per second. The Cyrix 6x86 is faster for
|
|
an identical clock speed and RISC chips are even faster. This means that
|
|
without stretching current technology much, we can program a desk top
|
|
computer and try 1E6 * 60 * 60 * 24 * 365.25 = 3.15576E13 keys per year.
|
|
A key of random words must be log(3.16E13) / log(74,000) = 2.77 or 3 words
|
|
to last longer than an average of 6 months. The random 3 word key has all
|
|
keys searched in about 1 year. In the end, what we are really trying to do
|
|
is stop a dumb computer attack. The smarter the computer gets, the slower
|
|
the computer gets. We can always build custom hardware and just use the
|
|
computer as a monitor or controller.
|
|
|
|
2.7.1 Something anyone can do
|
|
=============================
|
|
In an experiment on a 486DX2-66 w/128k cache, a RAM drive was set up,
|
|
Smartdrv, an *unmodified* copy of MIT PGP262, and all other files needed
|
|
were loaded. RAM shadows were enabled, video and BIOS cacheable and any
|
|
other setting that made it all run faster. A program was written in QBASIC
|
|
(it comes with DOS 5 and 6.x) to try a passphrase using the passphrase
|
|
environment variable to send new passphrases to PGP and check exit error
|
|
codes. PGP was executed with +batchmode.
|
|
Using this method, It is possible to try almost two passphrases every
|
|
second (1.8125 actually). PGP has beeps and delays when errors are detected,
|
|
but were minimized by some of the settings used. In order to seriously
|
|
attack a passphrase, you would need to modify PGP to eliminate the delays
|
|
and speed it up.
|
|
The moral is anyone can get a single random word from a small dictionary
|
|
in about an hour. Most larger dictionaries can be searched in less than a
|
|
day. Just about anyone has all the tools needed for this attack. The program
|
|
and the settings needed to do the work are simple enough for any decent high
|
|
school hacker.
|
|
|
|
3.0 How do I make a strong passphrase?
|
|
======================================
|
|
The answer depends on how secure your passphrase needs to be. Start with
|
|
a normal phrase and then with a bit of random help, distort it. Make a
|
|
nonsense phrase by changing words. Remember to switch the sentence
|
|
structure around in a random fashion. Add a few random words or characters
|
|
to enhance the security. The goal is to create something you can
|
|
remember and last as long as a brute force attack on the IDEA key.
|
|
The phrase, "my unbreakable super pass phrase can't be beat", is weak
|
|
by itself. So what if we change it some? "mile unbraking stupor past froze
|
|
can tent bee beets" is all well and good except that in an attack,
|
|
a homophone dictionary may be used. On the other hand, in one pass we have
|
|
a nonsense phrase that has a different structure and words that don't
|
|
quite logically connect. Add several random characters to make it impossible
|
|
to guess by any means other than brute force and you are done. The phrase
|
|
is fairly easy to remember because you used a normal phrase to construct it.
|
|
If you forget the actual phrase you will probably be able to reconstruct it.
|
|
Being human, we tend to do things the same in a predictable manner.
|
|
For more security, you can generate fully random phrases or character
|
|
sequences. This will take time and may be difficult to remember. Your
|
|
level of security is easy to control by limiting the key length. One nearly
|
|
foolproof method is Diceware [8].
|
|
|
|
4.0 How strong is my passphrase?
|
|
===================================
|
|
Now using what we know of absolute minimums and maximums of a
|
|
passphrase, we can make up a little formula to calculate how secure any
|
|
given passphrase is. For purposes here, random means really random.
|
|
Psuedo-random methods like rnd() and linear congruential generators
|
|
don't count here. The constants are based on the needs of PGP. You may
|
|
need to change them for your use.
|
|
|
|
PS = passphrase security
|
|
FF = fudge factor
|
|
this is an attempt to include variables like nonsense phrases,
|
|
odd spelling, punctuation, capitalization and numbers.
|
|
RW = random words (Don't count as a nonsense phrase)
|
|
RC = random characters
|
|
RL = random letters
|
|
OC = odd characters (other than lower case letters)
|
|
LC = total character count
|
|
(letters in whole words, spaces ignored)
|
|
(don't count if a totally random system is used.)
|
|
|
|
Note: fudge factors may change when more work is done.
|
|
F1 = 0.5 = nonsensical phrases hooked together
|
|
F2 = ? = odd spelling/misspelling, punctuation and capitalization
|
|
This is a permutation dependent on the number of characters
|
|
changed and the length of the words used.
|
|
To simplify use F2 = 4 * OC / LC
|
|
F3 = .09 = random numbers (exclude if F2 is used)
|
|
|
|
FF = 1 + F1 + F2 + F3
|
|
|
|
PS = RW/8 + RC/20 + RL/28 + LC/107 * FF
|
|
|
|
Calculating the passphrase security (PS) should be a simple matter for
|
|
most people. A PS > 1 means it will be easier to attack the IDEA key before
|
|
your passphrase will crack. A PS < 1 means that it is probably easier to
|
|
attack your passphrase instead of the IDEA key. If you have a PS under 1,
|
|
you may still have a secure passphrase. An estimate is that PS values less
|
|
than .35 can be broken in less than a year. The formula is under construction
|
|
and is only a guide number. There is hope that any errors are on the
|
|
conservative side and it is probably possible to fool the formula.
|
|
|
|
4.1 Passphrase examples
|
|
=======================
|
|
These are examples of passphrases and the PS numbers associated with
|
|
them. If you can work through these and get the same numbers, then you are
|
|
well on your way to understanding how to make passphrases good or bad.
|
|
|
|
.855 Nonsense phrase
|
|
betty was smoking tires in her peace of pipe organs and playing tuna fish.
|
|
1.05 A random bunch of characters.
|
|
A6:o@6 Ls+\` uGX%3y[k
|
|
1.34 Odd capitalization/punctuation and nonsense.
|
|
Web oF thE Trust is BrokEn cAn You Glue it Back ToGether? and give it xRays.
|
|
.280 An average phrase
|
|
There is a sucker born every minute.
|
|
1.125 Random words
|
|
paper factors difference votes behind chain treaties never group
|
|
.761 Phrases with some random letters.
|
|
Ignorance is bliss. spgemxk Education cures ignorance.
|
|
|
|
5.0 Who might try to get my passphrase and how?
|
|
===============================================
|
|
Why would anyone want your passphrase? For almost all of us, no one
|
|
is really interested in what we encrypt. The worst "enemy" we might normally
|
|
face is a family member that is poking around where they don't belong or
|
|
maybe the system administrator where your internet account is. Most family
|
|
members these days probably wouldn't know where to begin attacking a
|
|
passphrase and even 256 bit RSA would be safe from the computer illiterate
|
|
crowd. For the really paranoid or fringes of society, the FBI or other major
|
|
law enforcement agency might be looking. Everyone who knows what they are
|
|
doing will try to get the passphrase without trying a brute force attack.
|
|
|
|
5.1 Law enforcement and the government
|
|
======================================
|
|
If you are investigated by a law enforcement agency, then this is what
|
|
you might get from the various sources. All your communications would be
|
|
monitored. When they think they have enough information, the law
|
|
enforcement agency will hand you a search warrant and they will go away
|
|
with your computer and disks and probably a lot of other stuff as
|
|
evidence. They will probably already have copies of plaintext traffic
|
|
from and to you. While they are at it, they will probably take you in for
|
|
questions. Once they have your computer, they will make copies and search
|
|
the hard drive. If any or all of it is encrypted, they will try to
|
|
decrypt it including any deleted files that might remain on the hard
|
|
drive. If your passphrase is anywhere on the hard drive then they have
|
|
the key to all of the files encrypted to you. Law enforcement has
|
|
their own computer experts and can call in professionals as needed.
|
|
Your individual experiences may vary depending on what country you are in.
|
|
|
|
5.2 Multitasking systems
|
|
========================
|
|
You can't trust Windows 3.x, Windows 95, OS/2, and any other operating
|
|
system that swaps memory to the hard drive or that uses virtual memory.
|
|
For Mac users, the RAM disk may be saved to the hard drive automatically.
|
|
Several windows users have found their passphrase in the swap file. It
|
|
should be safe to run PGP in a DOS shell from Windows as long as Windows
|
|
is inactive or in other words, no DOS windows. Windows programs that shell
|
|
to DOS seem to directly write the passphrase into the swap file. There are
|
|
several programs that will search the entire surface of a disk with little
|
|
more than point and click. It is also pretty trivial to write a simple
|
|
program that searches a file for text strings. More serious attacks and
|
|
deleted files may require one of the many services that recover data from
|
|
an unreadable disk. The main problem with multitasking systems is one of
|
|
control. You simply can't effectively control what happens with the things
|
|
in memory.
|
|
|
|
5.3 Multi-user systems
|
|
======================
|
|
On the bigger multi-user systems, it is trivial for anyone with
|
|
enough access to install snooping programs, make copies of files,
|
|
and in some cases even directly monitor a user. You can also include
|
|
networked PCs. On a network, you can control things remotely with
|
|
the right software. Some network software may even come with programs
|
|
that allow limited snooping. Using the computer at work could be
|
|
handing your passphrase to a variety of people. Many people try to get
|
|
around this problem by using a separate key on the multi-user system
|
|
and a secure home key.
|
|
|
|
5.4 Tempest and electronic surveillance
|
|
======================================
|
|
It is pretty well known that the electronic noise from computers
|
|
can be monitored and even used. Every wire acts as an antenna radiating
|
|
any signals that might be on it. The tricky part could be finding the
|
|
one computer among several identical computers. If there is only one
|
|
computer, then the spy job is pretty easy. In some cases, it is much
|
|
easier to shield a room than to buy specially shielded equipment.
|
|
The hardest part may be identifying the leaks and plugging them.
|
|
Every wire into a room could carry a signal out of the room no matter
|
|
how well the shielding is constructed. You would have to be pretty
|
|
important to a major government or corporation before you need to worry
|
|
about a tempest attack. Some tests with some really basic equipment
|
|
showed that quite a bit of noise came from a monitor, very little noise
|
|
was around a steel cased computer, and the keyboard allowed some noise.
|
|
All cables used during the testing appeared to be shielded and the
|
|
computer was idle with a variety of data shown on the screen.
|
|
The detection equipment wasn't very sensitive so there may be more
|
|
noise than was actually detected.
|
|
|
|
6.0 How do I securely store my passphrase(s)?
|
|
=============================================
|
|
The best way is probably a key splitting technique. You need to
|
|
distribute pieces of a passphrase that protects all your regular
|
|
passphrases. There is a number of ways to do this that will safeguard
|
|
your keys even if you lose a few friends. A simple method would be to
|
|
break up the key passphrase into 3 pieces. Then give the pieces to
|
|
6 different friends. To reconstruct your passphrase you need only 3
|
|
of your friends and you have backups. Do the same thing with your
|
|
actual passphrase file. The individual friends can't reconstruct your
|
|
passphrase and they can't assemble the pieces unless all 3 of them
|
|
cooperate. The security of this method improves if you use more people,
|
|
but the most important part is having copies of your keys distributed in a
|
|
way that you can recover them and no one else can. You should have at least
|
|
one copy of PGP and your keys some place other than your house. Remember
|
|
to limit your risks. See [1] for more on key splitting techniques and
|
|
other references.
|
|
|
|
6.1 Should I write my passphrase down?
|
|
======================================
|
|
I'll contradict myself now. For total security, you shouldn't write
|
|
your passphrase down anywhere in any form, ever. Using the above key
|
|
splitting technique isn't perfectly safe.
|
|
Writing your passphrase is a breach of security if care is not taken.
|
|
Many ordinary disposal methods hand your written passphrase to anyone
|
|
looking. A simple technique with an ordinary pencil will grab a passphrase
|
|
from a pad of paper after the top sheet where the actual writing took place
|
|
is removed. Throwing the copy of your passphrase in the trash gives your
|
|
passphrase to the dumpster divers. Even trash from your house can be
|
|
searched without much trouble. A wallet isn't a good place if you get
|
|
hurt or your wallet gets stolen. There are many other problems with things
|
|
that are written down.
|
|
|
|
7.0 The really big numbers and other numbers
|
|
============================================
|
|
These are here to show how big these numbers really are. They are
|
|
hard to work with and there is no good reason to use them other than to
|
|
try and put things into scale. You need more than a pocket calculator
|
|
to work with them in this form. Take note of the length of 2^128.
|
|
This is the size of a 128 bit number. A 512 bit modulus is about 4
|
|
times as long.
|
|
|
|
1 million = 1,000,000
|
|
1 billion = 1,000,000,000
|
|
1 trillion = 1,000,000,000,000
|
|
3.15576E13 = 31,557,600,000,000
|
|
2^128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
|
|
74,000^8 = 899,194,740,203,776,000,000,000,000,000,000,000,000
|
|
95^20 = 3,584,859,224,085,422,343,574,104,404,449,462,890,625
|
|
26^28 = 4,161,536,836,220,038,342,098,551,818,958,537,752,576
|
|
|
|
These are the log(x) numbers used through out the FAQ. Mostly it is an
|
|
attempt to make the math easier even if you don't understand what log(x) is.
|
|
|
|
log(2^128) = 38.53183945
|
|
log(3.16E13) = 13.49910397
|
|
log(74,000) = 4.86923172
|
|
log(50,000) = 4.69897004
|
|
log(25,000) = 4.397940009
|
|
log(10,000) = 4.0
|
|
log(95) = 1.977723605
|
|
log(26) = 1.414973348
|
|
|
|
7.1 Glossary
|
|
============
|
|
This is to clear up a few things in case the context isn't clear.
|
|
More definitions will be added as needed.
|
|
|
|
brute force search = This is a search of the entire key space. Every possible
|
|
combination will be tried in sequence. Eg. Briefcase combination locks
|
|
have a key space of 1000 and will be searched (000, 001, 002... 999).
|
|
key size = The actual size of the key. Eg. IDEA has a key size of 128 bits.
|
|
key space = The number of possible combinations a key can have. Key space
|
|
is sometimes tricky to compute if there are methods of attack other than
|
|
trying every possible combination. Eg. IDEA has a key space of 2^128.
|
|
psuedo-random = a mathematical sequence or other repeatable sequence that
|
|
appears to be random.
|
|
random = A sequence that can not be reproduced by any means other than
|
|
replaying a recording of the sequence.
|
|
search space = The size of the search needed to break a key. Sometimes keys
|
|
have a much smaller search space than the key size might dictate.
|
|
Eg. A 40 digit/130 bit hard number, (toy RSA), is bigger than the 39
|
|
digit key space of IDEA but can be factored in a few minutes or less
|
|
using one of the faster factoring methods.
|
|
|
|
8.0 Copyrights and such
|
|
=======================
|
|
Copyright 1995 by Randall T. Williams <ac387@yfn.ysu.edu>
|
|
This is free to distribute where it might be useful and not
|
|
for profit as long as this notice remains attached.
|
|
|
|
9.0 References
|
|
==============
|
|
There are other books that could be included like statistics and books
|
|
on calculating odds. I also may have missed a few references. I used [1] a
|
|
lot in this document because of it's encyclopedic nature instead of
|
|
including a long list of separate references.
|
|
|
|
[1] Bruce Schneier, Applied Cryptography. John Wiley & Sons, 1994
|
|
(page numbers are for the 1st edition paperback)
|
|
[1a] p. 144-5 and p. 190-91
|
|
[1b] p. 141-3
|
|
[1c] p. 190 (attributed to Shannon)
|
|
[1d] p. 212
|
|
[1e] p. 347 Chapter 15
|
|
[2] The Random House Dictionary. Ballantine Books, 1980
|
|
(paperback, about 1.5 inches (3.8cm) thick
|
|
with "over 74,000 entries")
|
|
[3] Nick Stam, Inside the Chips. PC Magazine Feb. 21, 1995
|
|
p. 190-199
|
|
[4] Grady Ward, Creating Passphrases From Shocking Nonsense
|
|
[5] The Oxford Dictionary of Quotations. ???
|
|
("over 40,000 quotations" from a sales add)
|
|
[6] RFC1750 Randomness Recommendations For Security
|
|
One source is: http://www.clark.net/pub/cme/html/ranno.html
|
|
[7] Randall T. Williams, A Simple Random Noise Source, July 01, 1995
|
|
Posted to sci.crypt and alt.security.pgp 9/95 and 10/95
|
|
[8] Arnold Reinhold, Diceware (A Passphrase generation system)
|
|
http://world.std.com/~reinhold/diceware.html
|
|
|