Re: question on campus computer security

David Jablon (dpj@world.std.com)
Wed, 20 May 1998 09:36:42 -0400

• Next message: Ng Pheng Siong: "RSA Low Encryption Exponent Attack"
• Previous message: David Jablon: "re: question on campus computer security"
• In reply to: Greg Noel: "re: question on campus computer security"

At 11:58 PM 5/20/98, Peter Gutmann wrote:
>>Here are some ways to prevent eavesdropper dictionary attacks on passwords:
>>
>>(1) use one of the SPEKE or EKE-style protocols,
>>(2) use PK encryption with certificates or pre-distributed stored keys, or
>>(3) use challenge/response or Kerberos and force *all* passwords to be
chosen
>>with a method that guarantees large entropy.
>>
>>Some tradeoffs are:
>>
>>(3) is distasteful to users, (2) requires stored public keys or certificates
>>and provides less direct protection for the password, and (1) hasn't been
>>built into many applications ... yet.
>
>Another tradeoff is that there are patent problems with some of the above
>solutions. How much of the EKE-style protocol field is restricted by
patents?
>Isn't most of the field pretty much a lost cause?

"Lost cause"? Geez, that's an awful narrow view.
By that argument one would say that the entire field of
public-key crypto was a "lost cause", at least until last year.
Yet many people in both the academic and business worlds
(including you and I) seem to have found the stuff to be
quite important and useful.

I know of a couple issued patents that cover some EKE-style
methods, and a couple pending patents whose scope is yet-to-be
determined. I also know of a few competing vendors who license
these methods, myself included.

The key concept here is "competition". Noone holds a monopoly on
strong password-authentication. Noone is demanding that
you use a strong method. Yes, patents are a concern here,
and there are tradeoffs, as there are with any technology
in general. It just comes down to a simple business decision.

But the world won't end just because some people want to
be paid for their efforts.

------------------------------------
David Jablon
Integrity Sciences, Inc.
dpj@world.std.com
<http://world.std.com/~dpj/>

• Next message: Ng Pheng Siong: "RSA Low Encryption Exponent Attack"
• Previous message: David Jablon: "re: question on campus computer security"
• In reply to: Greg Noel: "re: question on campus computer security"