[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: The problem of visible hashes for protection keys
We know that, using XML documents, it is easy to subvert a lock on text or spreadsheet documents that involves locking material against changes (but not reading). When the lock is itself locked against removal using a password hash, this exposes the password used for the hash to compromise. The problem is the desire by folks to reuse familiar, memorable passwords for this purpose when the memorable password is also used to protect something that is of serious high value. (That is to say, the password is more valuable than the trivial-to-break lock in the document.) Some bad news: < http://www.ciozone.com/index.php/Security/Cracking-14-Character-Complex-Pass words-in-5-Seconds.html> Note that memorable passwords are not the hard ones to crack, and increasing the strength of the hash will not do much to protect memorable passwords from discovery against this kind of computational power. Note: This attack does not work against the PBKDF2 methods used for ODF 1.2 encryption, because the start password is never revealed. On the other hand, the techniques by which the password-hash attack were accelerated so much is probably a reason for concern that the various vulnerabilities of the ODF 1.2 encryption will be too-soon exploitable as a practical matter. My personal assumption is that no well-informed government body or commercial entity that is concerned about document confidentiality will allow use of the ODF 1.x encryption and would require very strong whole-package encryption techniques, whether defined for ODF documents or not. In that regard, the ETSI draft that we have been asked to comment on has moved ahead of us in the level of confidentiality-by-encryption that it attains for Zip-packaged documents. - Dennis Dennis E. Hamilton ------------------ NuovoDoc: Design for Document System Interoperability mailto:Dennis.Hamilton@acm.org | gsm:+1-206.779.9430 http://NuovoDoc.com http://ODMA.info/dev/ http://nfoWorks.org
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]