I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law or anything similar, I'm at a bit of a loss as to where I should start my research on this area. Google searches have so far proven in vain... Where would it be best to start reading about the subject?

Regards, Ian

  • 1
    Do you mean trial and error checking? Cryptanalysis is very different from the usual method of hashed password cracking. – Jeff Ferland Feb 22 '13 at 21:31
  • I'm referring to cryptanalytic attacks on a pre-computed hash through the use of brute force attacks, dictionary attacks and so on - John the Ripper, Rainbow Tables - that sort of thing... – Ian Muscat Feb 22 '13 at 22:00

"Legality" is about laws which change quite a lot depending on the country. Start your search by this site which is a survey on laws about cryptography in various countries. Though the survey is about laws which restrict (or not) the usage for cryptographic tools, it may contain pointers to laws about password cracking tools.

In countries which use Common Law or a variant thereof (e.g. the USA), the authoritative source for legality of password cracking will include cases which have been brought to a judge. This Web page quotes a case of prosecution of someone in 1995 for having run a password cracking tool. Since the perpetrator (technically an invalid qualification, since the records were expunged) was a high profile figure in Internet-related circles, there will probably be extensive documentation on the case (e.g. this page) that will yield a lot of material for your dissertation.

As for ethics, I would say that passwords are private data, which the users feel as such. Knowing a password not only gives you access to the system which is protected by that password, but also gives you some insight into the private parts of the life and brain of the password owner. As a simple example, many people will use as password the name of their current or potential future girlfriend/boyfriend (a terrible way of choosing password, but users do that).

I would say that running password cracking tools is ethically valid as long as:

  • users have duly been made aware, when they chose their password, that such tools may be run;
  • passwords which are thus found are not disclosed to third parties, except under anonymization (no way to link the password back to the user).

There are several moral systems out there; although I believe mine is better than all others (I am not a moral relativist), I acknowledge the fact that some people will not agree with me on this subject.

  • Thanks! I think this should get me started - I particularly like the view you took on the 'ethical' side of things. – Ian Muscat Feb 22 '13 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.