Is this password scheme legit?

Question

I received an invitation for an IT security fair (https://www.it-sa.de/en).

They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (example values, my translation):

It is often too easy for hackers to acquire personal information. The reason: Passwords that we can easily remember aren't cryptic. They are often common names or words like "Snowden" or "Admin". This card tries to fix this by making easy to remember passwords crpytic.

Input   Start  ABC  DEF  GHI  JKL  MNO  PQRS  TUV  WXYZ
Output  4uR=?  x    1    F    3    Y    i     #    9

Original version in german:

Hintergrund: Passwort-Hackern wird der Zugang zu persönlichen Daten im Internet häufig viel zu leicht gemacht. Der Grund liegt auf der Hand: Passwörter, die wir uns merken können, sind meistens nicht besonders kryptisch, sondern orientieren sich an gängigen Namen oder Wörtern wie "Snowden" oder "Admin".

Everything from the output is random for every single card (66 different characters to choose from). Now we have to choose an "easy" password (they recommend at least 8 characters):

Input:  HELLOWORLD
Output: 4uR=?F133Y9Yi31

They also recommend to use this card for only one password and change it, if you lose the card.

Is this password scheme good? It comes from a big security fair with many experts.

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence), but as long as your card stays unknown, the attacker can't exploit this fact.

Answer 1

Full disclosure: I work for a company, which distributes such cards. This answer however is my own personal opinion of them.

---

The idea of these cards is that some users are just really bad at remembering passwords or pass phrases. The naïve approach would be to tell users "Just get better at remembering passwords", but experience has shown that such advice is counter-productive with some users.

Their memory seems to be hard-wired to only recall simple words, which probably have something to do with their work. So somebody working in a car factory may remember a word such as Engine.

Engine, of course, is a terrible password - both in length and entropy. So the "Kryptonizer" or similarly named cards try to add both of those.

Length is added by the prefix, 4uR=? in this case. It immediately increases the password length by 5 characters, bumping a 6 character password up to an 11 character password. Not perfect, but an improvement.

Entropy is added by substituting each character with a randomly chosen character. Not exactly a 1:1 substitution, but close enough. Since each card is unique, one can't build a pre-made rule on how to mangle each dictionary phrase.

In this example, Engine would turn into 4uR=?1YFFY1. Is this a good password? Probably not great, but certainly a lot better than Engine.

Problems with this scheme

Of course, it's not a perfect system. A good passphrase can't be replaced by a little paper card. Since three input characters map to one output character, the resulting password loses entropy instead of gaining it. The net entropy gain is that attackers can't use dictionary attacks as easily anymore. In order to do that, they would need to gain access to the mapping or perform an exhaustive search. If an attacker knows that such a card was used, they can use this to their advantage to speed up an exhaustive search.

Furthermore, users are expected to keep their card around, and many will probably leave it on their desk, under their keyboard or in similar bad locations. If they lose their card, they will probably lose their password too. They will need a new card, and change their password as well, which is not that good for usability.

Summary

So, is this a good system? Ultimately, I would say you have to judge it in the context of what it is designed to do. It's an aid for a specific group of users, who would otherwise use ungodly terrible passwords. And helping users choose marginally better passwords for a negligible cost is a good thing, in my opinion. Of course, it is not a silver bullet that magically solves the problem of credential storage and generation.

If possible, always use a password manager, let it generate long, high-entropy passwords and store them for you in a safe manner.

If this is not possible (e.g. for OS logins), I recommend either using Diceware or creating a long, nonsensical sentence, such as TheGreenLightFromOurEyesShinesThroughTheMirrorOfTime.. Just ensure that such a sentence isn't taken from a book or movie.

Answer 2

It always depends on what you compare it with! What is the realistic alternative, that users would actually use, to using this card?

Clearly, 4uR=?F133Y9Yi31 is a much better password than HELLOWORLD. If you are giving this card to a non-techie whos not going to pick good passwords or use a password manager anyway, then it's an improvement.

On the other hand, using this system is much worse than just picking a random 16 letter password that you'll never remember and storing it in your password manager. An attacker who knows what letters there are on the card (e.g. by looking at leaked passwords from the same user) could easily crack it - suddenly it is no better than HELLOWORLD!

So is this a good idea for people who might use a password manager? No, absolutely not. For your grandpa? Maybe! Don't let perfect be the enemy of the good.

Answer 3

Not 100% clear from your exposition, but I understand the second row is generated independently at random for each card. I'll work from that assumption. I'll further assume that:

• The attacker is trying to guess your password.
• The attacker knows you've generated your password using such a card.
• The attacker doesn't know the random content unique to your card.
• The attacker has the means to efficiently test their guesses, e.g., because they stole a password database entry with a hash of your password.

How hard is it for the attacker to succeed?

First, they have to guess the 5 random start symbols. If they're picked from a set of 66 characters as you say, each have about log₂(66) ≈ 6 bits of entropy, for a total of 6 × 5 = 30 bits collectively—about the same strength already as the (in)famous Tr0ub4dor&3.

Second: As part of the process for using the card, you choose a human password. But the card divides the alphabet into eight groups such that letters in each group are treated as equivalent choices with one another. This means that after grouping, each letter in the human password cannot contribute any more than log₂(8) = 3 bits of entropy, but in practice it will be less:

• Some groups' letters are more frequent than others';
• Some words are more frequent than others;
• Some human passwords (e.g., PASSWORD) are distressingly more frequent than others.

Third: Each of these groups is assigned a randomly chosen character out of a set of 66. Each of those choices is about 6 bits of entropy, and that times eight groups sounds like 48 bits... but it's unlikely the attacker will have to crack the whole table in your card, because more likely than not, the human password will only "trigger" a subset of the eight groups, and they won't have to guess the symbols assigned to the "dormant" groups. If you pick 8 items randomly with replacement out of a set of 8, you expect to draw about 5 distinct items (source), which means the amount of the table's entropy that an eight-character human password is most likely to trigger is 30 bits. But some human passwords would trigger fewer groups, and some would trigger more.

Analyzing the interaction between statistical patterns of English text and the groupings in the cards is left as a tedious exercise for the reader. I think we can conclude tentatively that this card method isn't obviously broken—it will produce passwords with a guarantee of least 36 bits of entropy (30 for the start characters, 6 for triggering just one group), and you're realistically likely to see 54 bits (30 bits for start characters, 24 for triggering four groups) even without counting any entropy from the human passwords.

I don't think we should be surprised if this method doesn't suck. After all, my explanation above demonstrates that each card contains 78 bits of entropy: 30 from the initial five, 48 from the random assignment of characters to groups. 78 bits is about the entropy of 12-character random printable ASCII string (12 × log₂(95)). Packing this much entropy into a small card is a neat idea; the weakness with the scheme is that it doesn't reliably exploit all of it (the "dormant" groups issue).

---

Another scenario we could consider is this. Suppose the attacker manages to steal your generated password (e.g., from a website that stores it as plaintext). Can they work backwards from that to guess your human password or the random values in your card? Well, in that case the initial five random characters are just hopelessly compromised, and breaking the human password looks roughly similar to breaking a monoalphabetic substitution cipher, so it's not looking too good. But I'll note this:

They also recommend to use this card for only one password and change it, if you lose the card.

...and if you follow their recommendation, the compromise of one card's content can only compromise the one human password that was supplied as input to that card. We should probably add that you shouldn't reuse the same human password with multiple cards.

Answer 4

Looks very impractical to me. Disadvantages (cumbersome calculations, you need not to lose your card, you need to remember your password) outweigh the advantages (strong password).

I fail to find a use case for this scheme:

• For unsavvy users (your grandpa), it is much more practical to write down the password in a notebook kept in a locked drawer.

• For savvy users (readers of this blog), better use a password manager app encrypted with a master password.

Answer 5

 you have a reduced entropy [...], but as long as your card stays unknown, the attacker can't exploit this fact

If the card stays unknown, the attacker can't exploit it even if you write your complete password on it. This is, however, a very bad assumption to make, exactly for the same reason why writing passwords down is bad.

Installing a password manager on a cellphone and using your phone as a password cheatsheet makes much more sense.

Answer 6

My novice guess is, that you have a reduced entropy because of only 8 different characters (+ 1 start sequence)

Not necessarily.

Let's compare a password that uses characters from the English alphabet (upper-) and lowercase. A password of length n has (2 * 26)**n possible values (and realistically much less than that since the target audience probably isn't going to have mixed case in the middle of the password).

Meanwhile, the generated password has around (8**n) * (66**5) possible values:

• Each character in the original password maps to one of 8 values, n times.
• You've stated that there are 66 characters to choose from, repeated 5 times.

I don't have intuitive sense for how 52**n compares to (8**n) * (94**5), so let's try some values. For an 8 character password (n=8) we get:

• 53,459,728,531,456 (original)
• 21,010,654,131,388,416 ("Kryptonized")

The "Kryptonized" version has orders of magnitude more possibilities.

For an 11 character password:

• 7,516,865,509,350,965,248 (original)
• 10,757,454,915,270,868,992 ("Kryptonized")

For a 12 character password:

• 390,877,006,486,250,192,896 (original)
• 86,059,639,322,166,951,936 ("Kryptonized")

So for passwords 11 characters or shorter, the "Kryptonized" version wins in terms of possible values. (If we assume that the original password uses only a single case, then the "Kryptonized" version wins for passwords 17 characters or shorter.)

Note that I'm not taking into account that that the 8 possible characters mapped to are presumably random, but I don't think it really matters. A thing to learn from this is that increasing password length is much better than increasing the size of the character set.

Answer 7

A good password scheme is not just about entropy. All the entropy in the world will not protect you if you reuse passwords. All it takes is one site storing your password in the clear.

A good scheme also has to discourage password reuse. In this case it depends on how the card is used.

If a user thinks "I have a super secure password now" and reuses that one password they're vulnerable. Reusing a moderately good password is better than reusing a weak password, but not a whole lot. I see this as the most likely way it will be used.

I can see a clever user creating unique passwords by using it to hash something about the account, perhaps the domain name. Their password for google.com would be 4uR=?FYY31xYY. Security experts would decry this scheme for numerous reasons, and they'd be right, but it will produce a larger diversity of stronger passwords than otherwise. However, I don't see this being a common way the card is used.

Because users of the card will likely reuse a handful of passwords, I rate this scheme weak but better than nothing.

---

An improved scheme (I Am Not A Security Expert) may be to print a list of strong passwords with blank space next to each. When a user needs a new account they use the next free password and write down the domain name and username, if it's not their email address. This guarantees strong passwords without reuse, as long as they don't have too many accounts.

This is, of course, vulnerable to physical attack; stealing, copying, or photographing the card. If the person is already writing their passwords down, or worse have it in a file, this scheme is a vast improvement. I can think of a number of people who would benefit.

It's a trade off. I rate the risk of physical and targeted attacks much lower than reuse and weak passwords. You're much more likely to have a weak, reused password hoovered up in a random site break-in than a physical attack.

And, of course, this is all much weaker than using a good password manager.