1. IIT Indore © Neminah Hubballi
Password Management
Dr. Neminath Hubballi
IIT Indore © Neminah Hubballi

2. Why Password is Required ?
User authentication
Access control
IIT Indore © Neminah Hubballi

3. Password Management Strategies
Store the password in a file and encrypt the file containing passwords
Encrypt the passwords and store it in a file containing encrypted passwords
Hash the passwords
IIT Indore © Neminah Hubballi

4. Password Management in Unix/Linux
Maintains hashed passwords
Procedure
User enters the password and original Unix implementations truncated it to 8 bytes, converted into 56 bits ignoring msb use it as key
Use 12 bit salt value
Used crypt() algorithm to decrypt all zeros of
IIT Indore © Neminah Hubballi

5. Where is Hashed Password Stored ?
Username
Password
UID
GID
User info
Home
Shell
Username
Encrypted Password
Elapsed time
Validity
Due date
Warning date
Expiry date
Disabled time
Reserved
IIT Indore © Neminah Hubballi

6. Where is Hashed Password Stored ?
Password has 3 components
First part – hashing algorithm
Second part – plain text salt value
Third part – actual hash value generated
IIT Indore © Neminah Hubballi

7. IIT Indore © Neminah Hubballi
LAN Manager in Windows
Pad the password with zeros to make it 14 characters long
Convert any lower case letters in password to uppercase letter
Divide the password into 7 characters
56 bits of each part is used as key to encrypt magic string
Concatenate the two hash values to get final hash
IIT Indore © Neminah Hubballi

8. IIT Indore © Neminah Hubballi
NT LAN Manager
IIT Indore © Neminah Hubballi

9. IIT Indore © Neminah Hubballi
Breaking Passwords
Dictionary attack
Bruteforce method
Rainbow table
Pass-the-hash attack
IIT Indore © Neminah Hubballi