Re: Password protection

When I think about generating unpredictable data from a predictable
source, I generally think about hashing a piece of data.  You could take
the binary value of a data field, tweak it some with a bit-or or bit not
based on your application, then perform a SHA1 hash of the data.  Then
BASE64 encoding that data would give you a case sensitive string of 40+
characters that you could make your password.  The beauty of a SHA1 (or
MD5) hash is that a very small change in the source data makes large,
unpredictable changes to the hash output.

-----Original Message-----
From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
[mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Simon Coulter
Sent: Friday, June 11, 2010 6:06 PM
To: Security Administration on the AS400 / iSeries
Subject: [Security400] Password protection


Looking for suggestions:

I want to protect access to an application via a password. I want the  
password to automatically change daily. I want the application to be  
able to determine today's password without having to read it from an  
external source (i.e., algorithmically/programmatically derived). This  
last requirement means:

	o no special profile with password changed daily
	o no validation list use
	o no encrypted password stored in external object such as *FILE
or  
*DTAARA

I envisage:
	o Application objects are *PUBLIC *EXCLUDE
	o Application objects are authorised to a specific group profile
	o Password generator is *PUBLIC *EXCLUDE
	o Password generator is authorised to a specific profile
(different  
from the above)

In actual use a user who is a member of the application group AND who  
needs to use this particular application will request the password  
from an authorised issuer. The issuer will use the password generator  
to determine today's password. The user will then use the application.

The "automatic daily change" requirement means the password generation/ 
validation is tied to the date but obviously simple encryption linked  
to the date will not be very secure nor will each daily password be  
sufficiently different from the previous one.

I have some ideas but thought I would see what others suggest--always  
presuming you think this sufficiently interesting to bother with :)

Regards,
Simon Coulter.
--------------------------------------------------------------------
    FlyByNight Software         OS/400, i5/OS Technical Specialists

    http://www.flybynight.com.au/
    Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
    Fax:   +61 2 6657 8251                                   \ /
                                                              X
                  ASCII Ribbon campaign against HTML E-Mail  / \
--------------------------------------------------------------------



_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400)
mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.