Re: Password protection

On 12/06/2010, at 8:30 AM, DrFranken wrote:

> I like the concept but your requirement to NOT store the Password Of  
> the
> Day and generate it every time it's needed means you can't pick other
> external inputs to feed the process. For example you could call a web
> service to check the temperature in some known location as one bit of
> the seed, then check the water level in some river, toss in the  
> cycle of
> the moon, and the date, mix in the percent full of the disks, and  
> add a
> pinch of the faulting rate for the *BASE pool. Oh but all of those
> things change constantly except the date, rats.

Tongue firmly in cheek ... well I could use the date to calculate the  
moon's phase, distance, and position, and use those values to generate  
a seed, an offset and a range, then encrypt program constants at that  
offset and range giving the password. Varying how the calculated  
values are used will change the algorithm. Not cryptographically  
secure but difficult enough to make it not worth the effort.

> Maybe you could
> architect it so the P.O.D. is kept in a running program only and
> requested from that program. Each time the program starts or when some
> magic time each day occurs it generates the P.O.D and holds it. Just a
> thought.....

Not ideal in this case. I've got a bunch of one-time password stuff to  
read up on. That might give me a solution.

Regards,
Simon Coulter.
--------------------------------------------------------------------
    FlyByNight Software         OS/400, i5/OS Technical Specialists

    http://www.flybynight.com.au/
    Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
    Fax:   +61 2 6657 8251                                   \ /
                                                              X
                  ASCII Ribbon campaign against HTML E-Mail  / \
--------------------------------------------------------------------



_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.