Prior Page Next Page This Chapter Prior Chapter

User Authentication

Let's look at another problem related to encryption. This one is used daily by almost everyone and yet it is not usually understood by users, never the less it is a fun idea that deserves your understanding. How does one keep a password file on a system, without fear that someone will decode it?

One could encrypt the password file, but then the person who knows the key could decrypt the whole file exposing everyone's password. Using this system, software would have to decrypt the file to check your password and in doing so someone might find out the password, or be able to read the decrypted versions of the passwords.

Instead it is common to have a public key version of the password. This is done in the following way. Assume you have a program that will encrypt things so well it is difficult to decode them. Then what you do is use the user's password as the key to encode a standard message: `Let this user pass!'. This gets encoded as: `wYdB]eaWLpD[!tZ[b]z' using `xyzzy' as the key (the user's password) combined with the user name it gets put in a file anyone can see.

buz:wYdB]eaWLpD[tZ[b]z:Robert Uzgalis

Note that `xyzzy', the user's password, is nowhere to be found on the system. Now when Robert Uzgalis tries to logon to the system later, he types `buz'. The system finds the line for `buz' in the password file and knows that `buz' is a user of the system. Now it asks Mr. Uzgalis to give his password. He types a password, `xyyxy', and because of clumsy typing gets it wrong. The system encrypts `Let this user pass!' using `xyyxy' as the key and gets: `bP:@kv_#xqONsAjUfF' this does not match what is stored in the password file so the login is rejected. If the next time Mr. Uzgalis types `xyzzy', correctly, the system will recreate the same pattern as the one in the password file and he will log-on.

This system provides a method for validating a user without storing his password. For authentication the encryption system is only used for its one way property, that is it is easy to use the key to encrypt information, but it is difficult to determine the key given the information and in both its clear and encrypted form. Any function that has this easy-one-way-hard-the-other property can be used for user validation.