Legality and ethics of cryptanalysis on password hashes

Question

I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law or anything similar, I'm at a bit of a loss as to where I should start my research on this area. Google searches have so far proven in vain... Where would it be best to start reading about the subject?

Regards, Ian

Answer 1

"Legality" is about laws which change quite a lot depending on the country. Start your search by this site which is a survey on laws about cryptography in various countries. Though the survey is about laws which restrict (or not) the usage for cryptographic tools, it may contain pointers to laws about password cracking tools.

In countries which use Common Law or a variant thereof (e.g. the USA), the authoritative source for legality of password cracking will include cases which have been brought to a judge. This Web page quotes a case of prosecution of someone in 1995 for having run a password cracking tool. Since the perpetrator (technically an invalid qualification, since the records were expunged) was a high profile figure in Internet-related circles, there will probably be extensive documentation on the case (e.g. this page) that will yield a lot of material for your dissertation.

---

As for ethics, I would say that passwords are private data, which the users feel as such. Knowing a password not only gives you access to the system which is protected by that password, but also gives you some insight into the private parts of the life and brain of the password owner. As a simple example, many people will use as password the name of their current or potential future girlfriend/boyfriend (a terrible way of choosing password, but users do that).

I would say that running password cracking tools is ethically valid as long as:

• users have duly been made aware, when they chose their password, that such tools may be run;
• passwords which are thus found are not disclosed to third parties, except under anonymization (no way to link the password back to the user).

There are several moral systems out there; although I believe mine is better than all others (I am not a moral relativist), I acknowledge the fact that some people will not agree with me on this subject.