0
$\begingroup$

I have this question I am struggling about:

For example, someone suggested improving UNIX authentication by defining 3 different passwords for a user that are stored in the shadow file. All three passwords are stored with the same salt value.

When a user wants to authenticate to some system, he must provide in the $i$ attempt to login, the $i$ mod 3 password. For example, in the first attempt he will provide the first password, in the second and fifth attempt he will provide the second password. Is such alteration to UNIX system increases security or not? And what happens when all passwords are stored with different salt value?

$\endgroup$
  • $\begingroup$ "Security" against whom? $\endgroup$ – fkraiem Jun 9 '16 at 12:27
  • 1
    $\begingroup$ Is i updated whenever a person actually logs in or for every login attempt? $\endgroup$ – Daan Bakker Jun 9 '16 at 12:48
  • $\begingroup$ security against different attacks. i updated on each attempt. $\endgroup$ – Mark Rotman Jun 9 '16 at 13:56
  • 3
    $\begingroup$ This sounds like a significant decrease in usability for only a negligible increase in security. If someone compromises one of my passwords, it just means they might have to try up to three logins before they get in. $\endgroup$ – Gordon Davisson Jun 9 '16 at 14:31
3
$\begingroup$

For example, someone suggested improving UNIX authentication by defining 3 different passwords for a user that are stored in the shadow file. All three passwords are stored with the same salt value. When a user wants to authenticate to some system, he must provide in the i attempt to login, the i mod 3 password. For example, in the first attempt he will provide the first password, in the second and fifth attempt he will provide the second password. Is such alteration to UNIX system increases security or not?

I cannot see how it increases security. As long as you don't limit the amount of attempts the attack surface only increases.

what happens when all passwords are stored with different salt value?

You cannot see if one of the three passwords is identical to one of the other three. The reason to choose an identical salt is presumably to make sure that each password is different from each other.

Note that the passwords could still be very similar. The only way to check that is to compare the three passwords and for that you need all passwords at the same time.

It would also decrease attack speed by a factor of three (as an attacker cannot check a candidate password against all three hashes). This is of course assuming that the attacker obtained the hashes in the first place or that the password validation is sufficiently fast.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.