Re: Password protection

How about a list or word/text culled from somewhere, and you use a
formula derived around the date (eg day of year multiplied by year
divided by month) to pick a word from the list, and then use the
resulting word along with the date as a seed to generate a key. If just
generating a password, you could intersperse parts of the date (or a
calculation from it) into calculable positions within the word, this
would ensure when the word was re-used, certain (possibly different)
positions of it would be replaced with a different number (or
representation of that number)

If the words are contained in the program (which in turn probably wants
to encrypt or at least scramble them, to prevent any dump being useful)
then you have removed the external object references, the word list
removes the date only key.

Doubtless someone better at maths/crypto than me can find the flaw with
this!

Ben

-----Original Message-----
On Jun 11, 2010, at 5:07 PM, "Simon Coulter" <shc-Q/[email protected]>
wrote:

>
> Looking for suggestions:
>
> I want to protect access to an application via a password. I want the
> password to automatically change daily. I want the application to be
> able to determine today's password without having to read it from an
> external source (i.e., algorithmically/programmatically derived). This
> last requirement means:
>
>    o no special profile with password changed daily
>    o no validation list use
>    o no encrypted password stored in external object such as *FILE or
> *DTAARA
>
> I envisage:
>    o Application objects are *PUBLIC *EXCLUDE
>    o Application objects are authorised to a specific group profile
>    o Password generator is *PUBLIC *EXCLUDE
>    o Password generator is authorised to a specific profile (different
> from the above)
>
> In actual use a user who is a member of the application group AND who
> needs to use this particular application will request the password
> from an authorised issuer. The issuer will use the password generator
> to determine today's password. The user will then use the application.
>
> The "automatic daily change" requirement means the password  
> generation/
> validation is tied to the date but obviously simple encryption linked
> to the date will not be very secure nor will each daily password be
> sufficiently different from the previous one.
>
> I have some ideas but thought I would see what others suggest--always
> presuming you think this sufficiently interesting to bother with :)
>
> Regards,
> Simon Coulter.
> --------------------------------------------------------------------
>    FlyByNight Software         OS/400, i5/OS Technical Specialists
>
>    http://www.flybynight.com.au/
>    Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
>    Fax:   +61 2 6657 8251                                   \ /
>                                                              X
>                  ASCII Ribbon campaign against HTML E-Mail  / \
> --------------------------------------------------------------------
>
>
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries  
> (Security400) mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/security400.
>



**********************************************************************
This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity to
whom they are addressed.  If you have received this email
in error please reply to the sender of the message.

The views expressed in this correspondence may not
reflect the views of Prime, Inc.

This footnote also confirms that this email message has
been scanned for the presence of computer viruses.
http://www.primeinc.com
**********************************************************************

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400)
mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.


No virus found in this incoming message.
Checked by AVG - www.avg.com 
Version: 9.0.829 / Virus Database: 271.1.1/2931 - Release Date: 06/11/10
20:35:00
_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.