Re: Password protection

Just my opinion... Of it is worth doing, it is worth doing right.
We use Rsa tokens which are similar on that the token generates a
number which the user sees and the server knows. We protect
applicaton use with these.

Rsa isn't the only option. There are phone token generator apps.
There are other vendors.

Aladdin makes various devices as well as software.

If you just have one user, look for vendors with development kits.
That can get you in on the cheap and be crypotraphy secure.

Another thing to look at is how encrption key exchange (ssl/wifi wpa)
occurs. You could perhaps borrow sample code and generate a phrase
vs hex characters via ROT.

Just some ideas...



Sent from my iPod

On Jun 11, 2010, at 5:07 PM, "Simon Coulter" <shc@xxxxxxxxxxxxxxxxx>
wrote:

Looking for suggestions:

I want to protect access to an application via a password. I want the
password to automatically change daily. I want the application to be
able to determine today's password without having to read it from an
external source (i.e., algorithmically/programmatically derived). This
last requirement means:

o no special profile with password changed daily
o no validation list use
o no encrypted password stored in external object such as *FILE or
*DTAARA

I envisage:
o Application objects are *PUBLIC *EXCLUDE
o Application objects are authorised to a specific group profile
o Password generator is *PUBLIC *EXCLUDE
o Password generator is authorised to a specific profile (different
from the above)

In actual use a user who is a member of the application group AND who
needs to use this particular application will request the password
from an authorised issuer. The issuer will use the password generator
to determine today's password. The user will then use the application.

The "automatic daily change" requirement means the password
generation/
validation is tied to the date but obviously simple encryption linked
to the date will not be very secure nor will each daily password be
sufficiently different from the previous one.

I have some ideas but thought I would see what others suggest--always
presuming you think this sufficiently interesting to bother with :)

Regards,
Simon Coulter.
--------------------------------------------------------------------
FlyByNight Software OS/400, i5/OS Technical Specialists

http://www.flybynight.com.au/
Phone: +61 2 6657 8251 Mobile: +61 0411 091 400 /"\
Fax: +61 2 6657 8251 \ /
X
ASCII Ribbon campaign against HTML E-Mail / \
--------------------------------------------------------------------



_______________________________________________
This is the Security Administration on the AS400 / iSeries
(Security400) mailing list
To post a message email: Security400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.

**********************************************************************
This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity to
whom they are addressed. If you have received this email
in error please reply to the sender of the message.

The views expressed in this correspondence may not
reflect the views of Prime, Inc.

This footnote also confirms that this email message has
been scanned for the presence of computer viruses.
http://www.primeinc.com
**********************************************************************