T 5.18 Systematic trying-out of passwords

Passwords that are too simple can be discovered by systematic trial-and-error. A distinction should be made here between simply trying out all possible character combinations up to a certain length (known as a brute force attack) and trying out every entry in a list of character combinations (a dictionary attack). The two approaches can also be combined.

Most operating systems store user names and passwords in a file or database (e.g. the passwd or shadow file in Unix or the RACF database in z/OS). However, many operating systems store at least the passwords using cryptographic mechanisms and not as plain text. If the file is not adequately protected against unauthorised access, then an attacker may be able to copy this file and then subject the file to a brute force attack with the help of a high-performance computer without having to worry about the total access time.

The time it takes to discover a password in a brute force attack depends on the following:

• the time it takes to perform a password check,
• the length of the password, and
• the character composition of the password (e.g. letters/numbers).

The time it takes to check a password depends heavily on the corresponding system and its processing and transmission speeds. When attacked, the method and technology used by the attacker also play a role.

However, the length and character composition of the password can be influenced by organisational specifications or even by technical safeguards.

Example:

• Nowadays, with a well-equipped PC, around 400,000 password checks can be performed per second using the standard password encryption functions in Unix and Linux. When the standard password encryption of Windows NT/2000/XP is used, over 6 million checks per second can be performed (source: Hamburg Data Protection Officer, 2003).
  
  For a character set of 26 characters, it would take about six days to work out an 8-character password under Unix or Linux (using standard password encryption). The same task takes only nine hours under Windows.