{"id":2369,"date":"2012-10-10T19:01:08","date_gmt":"2012-10-10T13:31:08","guid":{"rendered":"https:\/\/www.qadit.com\/blog\/?p=2369"},"modified":"2012-10-10T19:01:08","modified_gmt":"2012-10-10T13:31:08","slug":"splitting-passwords-up-to-increase-security","status":"publish","type":"post","link":"https:\/\/qadit.com\/blog\/splitting-passwords-up-to-increase-security\/","title":{"rendered":"Splitting passwords up to increase security"},"content":{"rendered":"

Splitting passwords up could be the next big thing next to 2-factor authentication schemes which companies such as Google, Facebook or PayPal have offered as an opt-in service to their users. The two solutions use different angles to improve the protection of user account data from attackers. Where 2-factor authentication is entirely the user\u2019s responsibility, splitting up passwords is entirely dependent on the webmaster and company running the server.<\/p>\n

The idea itself is simple: instead of saving passwords in a single location, they are split up and saved in multiple locations. Attackers who attack the server infrastructure of a company therefore need to get into multiple servers instead of just one, and since it is possible to protect the servers in different ways, for instance by using different operating systems, firewalls, security scripts and personal, it reduces the possibility of a potential breach. The technique also protects the data from inside jobs, for instance when an admin downloads data from a database.<\/p>\n

A new software by RSA brings the technology later this year on the market. RSA\u2019s approach is the following. Passwords are broken into pieces during account creation, and then randomly saved to different servers. When a user logs in, the supplied password is split into encrypted strings, which are then sent to the password servers. The password is split into as many pieces as there are password servers, and one part of the string is randomly sent to each password server.<\/p>\n

The user string is then combined with the stored password piece, and all the newly created strings are then compared to determine whether the password is correct or not. RSI claims that it is mathematically impossible to determine the password from an individual string or all strings combined.<\/p>\n

\"\"<\/a><\/p>\n

\n

1)\u00a0\u00a0\u00a0\u00a0\u00a0 Before it is stored, the password is transformed with a random number. The random number is stored in one server (\u201cred\u201d server) and the transformed password in a different server (\u201cblue\u201d server). Compromising one server is not sufficient to compromise the password.<\/p>\n

2)\u00a0\u00a0\u00a0\u00a0\u00a0 At regular time intervals, a new random number is generated and both servers are updated with the new random number value, adding a time-based layer of protection:\u00a0 Both servers must be compromised at the same time for the password to be compromised.<\/p>\n

3)\u00a0\u00a0\u00a0\u00a0\u00a0 When an application needs to verify a password, the claimed password transformed with a new random number is sent to the \u201cblue\u201d server while the random number is sent to the \u201cred\u201d server. Each server can execute a new transformation involving the stored data and validate whether the claimed password matches the stored password without exposing the legitimate password<\/p>\n<\/blockquote>\n

RSA calls the approach distributed credential protection, which is a version of long known technique called threshold cryptography<\/a>. What is new is that the technology will be made available to the general public.<\/p>\n

Using multiple servers may be problematic from an availability point of view unless parts of the password are supplied to more servers than necessary so that fallback servers are available when a server goes down.<\/p>\n

You can read about the announcement on the official RSA blog<\/a>.<\/p>\n

<\/p>\n

\n

Original news article at https:\/\/www.ghacks.net<\/a> on October 10, 2012 at 06:29PM<\/p>\n","protected":false},"excerpt":{"rendered":"

Splitting passwords up could be the next big thing next to 2-factor authentication schemes which companies such as Google, Facebook or PayPal have offered as an opt-in service to their users. The two solutions use different angles to improve the protection of user account data from attackers. Where 2-factor authentication is entirely the user\u2019s responsibility, … <\/p>\n

Continue reading “Splitting passwords up to increase security”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[4],"class_list":["post-2369","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-it-security"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9AH7Q-Cd","_links":{"self":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/2369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/comments?post=2369"}],"version-history":[{"count":0,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/2369\/revisions"}],"wp:attachment":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/media?parent=2369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/categories?post=2369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/tags?post=2369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}