<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">On 04/03/2020 13:16, Peter Gutmann wrote:<br class=""><blockquote type="cite" class="">There has been some speculation in the past over why we have so many cargo-<br class="">cult password security rules that make no sense in any modern context, the<br class="">prime example being the need to change passwords periodically. I've found one<br class="">possible explanation, the Ware Report, which talks about authentication words<br class="">more than passwords, and in a manner in which they resemble military<br class="">countersigns rather than what we'd think of today as passwords: …</blockquote><br class=""><div class="">Another historical source is the now obsolete FIPS PUB 112, from May 30, 1985: </div><div class=""><br class=""></div><div class=""> <a href="https://nvlpubs.nist.gov/nistpubs/Legacy/FIPS/fipspub112.pdf" class="">https://nvlpubs.nist.gov/nistpubs/Legacy/FIPS/fipspub112.pdf</a></div><div class=""><br class=""></div><div class="">Its Appendix E.3, Determining Password Length (p. 44 ff), includes formulas for calculating needed password size based on allowed life, and acceptable probability of penetration. It assumes the threat is repeated login attempts and that the rate at which passwords can be tried is fixed. In their worked example they assume "8.5 guesses per minute (guess rate possible with 300-baud service)” They calculate a password length of 8 or 9 characters or 3 dictionary words, depending on assumptions, including 1 year and 6 month password life.</div><div class=""><br class=""></div><div class="">RFC 1750, December 1994, also obsolete, contains a similar calculation in section 8. They assume a fixed delay (e.g. 6 seconds) is imposed between successive attempts and that passwords are changed yearly and they then derive a minimum password size. They mention the possibility of detecting large numbers of failed attempts, but assume conservatively that this will be done infrequently by inspecting log files. Its replacement RFC 4086 section 8 has a similar but lengthier analysis, but still assumes a fixed rate. Interestingly, the later document assumes an acceptable probability of getting access as 1 in 1000, whereas RFC 1750 assumes 1 in 1,000,000. </div><div class=""><br class=""></div><div class="">What is missing in both models is the notion of limiting the rate of attempts by progressively increasing the delay after each failure, i.e. throttling. (NIST SP 800-63B Section 5.2.2) It would be interesting to know when throttling was introduced. Also is there any standard or other text that does the same calculations assuming a throttling profile?</div><div class=""><br class=""></div><div class="">More broadly, there seems to be a lack of accepted best practices for password security. NIST Special Publication 800-63B “Digital Identity Guidelines Authentication and Lifecycle Management,” is a recent attempt, but this large document crams the issues we are talking about into just one section, 5.1.1.1. The document is relatively recent (June 2017) and not widely followed, as far as I can tell. It does not include many topics I believe are needed. Here is my list:</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">o Larger minimum password length (SP 800 63B requires 8 characters, but this is to few. 10 or 12 should be the minimum)</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">o Only using computationally and memory hard hash or hardware security for verification data</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""><div style="margin: 0px; font-stretch: normal; line-height: normal;" class="">o Special treatment required for password reset answers (e.g. segregated server with separate backup and restricted connectivity)</div><div class=""><br class=""></div></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">o including algorithm versioning to allow password verification storage upgrades</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue"; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">o Disclosure to consumers by public-facing, password-protected systems of the protective measures in use , including, salt size, hash function and repetition count</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">o Offering system generated password or passphrases, preferably in several formats, e.g.</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> Random pass phrase with different word lists</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> Random letters with mnemonic sentences</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> Random pronounceable syllable groups </div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue"; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">o Smart throttling </div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> Higher limit for longer passwords </div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> No dings for blank password or repeat of previous try</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> Non bricking — no extreme lockout (>6 hours)</div></div><div class=""><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> Notification of possible caps lock</div></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">o Encouraging people to use password managers, at least for most passwords</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">o Encouraging people to write down non-managed passwords, with suggestions for safe places. It’s no longer reasonable to expect ordinary users to memorize all the passwords or passphrases users need, if they are to be strong enough. </div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">Other suggestions welcome.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Arnold Reinhold</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>