PSST: the password is...

Passwords are among the oldest and still most commonly used forms of authentication.“We have been using passwords since probably before Roman times as a way to tell friend from foe,” said Bill Burr, manager of the security technology group in the National Institute of Standards and Technology’s IT Lab. “Their great advantage is that they are ubiquitously implemented. All kinds of software comes equipped to do password authentication.”Even in today’s world of biometrics, smart cards and other authentication technologies, passwords play an important role in agencies’ network security plans.The government’s E-Authentication Initiative established four levels of assurance for online applications and services, and it allows passwords as a means of controlling access to many of them. Applications rated at levels one and two can be protected by password only, while those at levels three and four require the addition of physical tokens or digital certificates.“Right now, we are focusing on Internet-based applications,” being accessed by government workers or by citizens obtaining government services, said Chris Louden, E-Authentication’s chief architect.The owner of the application assesses the risk to the application of false positives to determine the appropriate assurance level. Level 2 seems to be the sweet spot now for E-Authentication applications, Louden said.“By no means are we limited to Level 2,” said Louden, who works for E-Authentication contractor Enspier Technologies Corp. of Alexandria, Va. “But we are seeing a lot of applications end up at Level 2.”One reason for this is that users are familiar and comfortable with passwords.Despite their widespread use—in many cases, because of their widespread use—passwords have their limitations. Ensuring that the level of security provided by a password matches that needed by the protected application or system is a challenge being addressed in the initiative.“One of the breakthroughs of E-Authentication has been to determine just how secure a password should be,” Louden said. This has been attempted through a pair of documents issued earlier this year by the E-Authentication program management office: the Credential Assessment Framework (, Quickfind 470) and the Password Credential Assessment Profile (www.gcn.com, Quickfind 471).“It is a great example of how a program like E-Authentication makes contributions to the field of ID management that would not otherwise exist,” Louden said.The E-Authentication Initiative is part of the President’s Management Agenda, intended to standardize remote electronic authentication to federal IT systems. The General Services Administration is the initiative’s managing partner, and the program management office is housed in GSA’s Federal Technology Service.Standardized authentication requires a specified level of trust by each agency in the organizations that provide credentials, including passwords, to end users. The Credential Assessment Framework lays out the policies and procedures for assessing the assurance level of credential service providers.The Password Credential Assessment Profile spells out criteria to evaluate the level of protection provided by passwords.Passwords, which can include personal ID numbers, are one element of a triad of authentication techniques:These elements can be used alone or in combination for additional security.“Generally, you’re better off using two factors rather than one, and three factors rather than two,” Burr said.Because passwords are so common, they usually are used as part of any multifactor authentication process.“They are still perfectly good and an excellent way to augment something else,” Burr said.Perhaps the password’s greatest drawback is caused by its popularity.“The real problem we have with passwords today is simply that we have too many of them,” Burr said. “Too many of us live in a password hell.”The number of passwords and PINs maintained by a single person can easily reach 10, a dozen, or 20 or more.“I’ve got so many log-ins for so many things, it’s bizarre,” Burr said. “I’m supposed to be a professional, and I have a hell of a time. Today was a classic example of what happens.”A manager asked Burr to access an administrative system and sign a purchase order because the manager had lost his own password.“Getting onto the system and signing requires three different passwords,” Burr said. He added that this is only one of several systems he doesn’t use very often, but for which he must maintain secure passwords. “Everybody, one way or another, eventually ends up writing them down. My ultimate fallback is a program called PasswordSafe.”PasswordSafe is a fairly simple manager that provides encrypted storage for passwords and is, itself, password protected.“I remember one awful password,” Burr said. “It is long to type and is complicated,” but by remembering one difficult password he has access to many others.Burr says PasswordSafe’s cryptographic module, which uses the Twofish algorithm, is not FIPS-140-2-approved, but it is better than either trying to remember all his passwords or writing them down somewhere.The problems are caused not only by the sheer number of passwords we must remember, but also by the rules for keeping them secure:“All of these principles are perfectly reasonable,” Burr said. But in the end, these security policies, combined with the number of passwords, can become self-defeating as users write down, reuse and forget the passwords upon which the security of IT resources depend.“I tend to believe there is a point of diminishing returns in asking people to come up with difficult passwords,” Burr said. “We probably need some guidelines from NIST about effective limits of password security.”Burr would like to do research on those limits and help determine just where the point of diminishing returns falls, but “we’ve gotten sidetracked with FIPS-201,” the Federal Information Processing Standard for a common federal ID card mandated by the president.Although the Password Credential As- sessment Profile does not solve the problems created by maintaining multiple secure passwords, it does set standards for what a secure password is.Accessing applications at assurance levels one and two requires a user name and a password that cannot be reused. The user can select the password. The profile does not directly specify length of the password or types of characters required, but it establishes standards for resistance to guessing.Passwords and PINs for assurance Level 1, the lowest level of security, must offer less than one chance in 1,024 that an attacker can guess it over the password’s lifetime. For Level 2, there must be less than one chance in 16,384 that it can be guessed.The Credential Assessment Framework provides a worksheet to figure the chances of a successful guessing attack against a particular password or PIN. One of the primary factors is the level of entropy, or randomness, in the password. Other factors include the password’s length, and the management rules governing how often it is changed and the number of unsuccessful tries allowed before the session is terminated.Limiting the number of unsuccessful attempts at entering a password in a given period of time effectively boosts the password’s resistance against brute-force attacks over its life span. Limiting its life span by requiring periodic replacement can provide additional protection.Such management rules can ease the burden of maintaining high-security passwords by making simpler passwords more acceptable, Burr said.But neither strict management rules nor complex passwords can defend against social engineering, phishing attacks and key-logging by spyware. Such weaknesses ultimately limit the effectiveness of passwords by themselves where higher levels of assurance are needed.