A shift cipher shifts every letter of a word by "n" amount and creates new word. The number of possible keys in the shift cipher is equal the size of the alphabet set from which the word is derived. For example if the words are derived from the lowercase letters there are 26 different keys.

The word "withcurious" with the shift-amount or key "1" gets transformed to "xjuidvsjpvt". Can such schemes be used by user to set passwords. One might argue that, in the case of shift cipher the number of keys are less. Therefore if the attacker learns this trick, he has to build only 26 dictionaries one with every shift amount. 0...25

But if one uses monoalphabetic or polyalphabetic substitution ciphers, in which every alphabet in a word is basically shifted by different amount, can it be used to create secure passwords, considering that a random key is assigned to every user. With the alphabet set of size 94 that include lowercase, uppercase, digit and symbols there are 94! different keys in case of monoalphabetic substitution ciphers and power(94;94) in case of polyalphabetic substitution ciphers. User can store the key (alphabetic mapping) securely, and may be use the name of the site and encrypt it with his secret key. The resulting ciphertext appears random and is set as password.

Can the passwords constructed under such scheme be considered as secure if it satisfies the minimum length requirement( > 12)? Is it feasible to implement such scheme?

  • 1
    Can one? probably - most passwords also require complexity, and it is unlikely that a shift cipher will generate the resulting complexity. Most users are also going to find that the resulting cipher is too complex. Also most simple ciphers (that can be done unaided by a human) are NOT resilient against cryptanalysis. Ultimately the question rests on how you measure security and what your threat profile looks like. – Mark C. Wallace Sep 16 '14 at 15:56
  • Mapping can be stored securely in the form of a table, every symbol is mapped to different symbol in case of monoalphabetic cipher. This mapping is essentially the key. The number of such mappings are enormous 94! (94 factorial). One such mapping is assigned for every user. Cryptanalysis is possible on long ciphertexts but in our case the ciphertext is password itself and is secret. – Curious Sep 16 '14 at 16:08
  • I think you're falling into the XY trap. What is the problem you need to solve? – Mark C. Wallace Sep 16 '14 at 16:10
  • Creating difficult to guess but easy to remember passwords using Classical Ciphers which has large key space. – Curious Sep 16 '14 at 16:11
  • 1
    This is doubly ridiculous. First you really make it hard for users to remember and type passwords. If you used your scheme to login to 10 systems per day, how much time would it take you compared to vanilla passwords, even with whatever aids you want? And then, why on earth does everyone want to create "memorable and secure passwords" when they can't even guarantee said graalwords won't be stolen in the first place. – Steve DL Sep 16 '14 at 21:17

Such a scheme provides no benefit over purely random passwords. They're still difficult to remember, but easier for a computer to guess than pure random strings.

Instead, you should use passphrases. Length trumps complexity when it comes to entropy, and words are easier to remember than random characters.

Obligatory XKCD: http://xkcd.com/936/

You might think taking advice from a comic isn't the best idea, but try it for yourself: https://www.grc.com/haystack.htm

You can plainly see here that a passphrase comprised of several common words is stronger than 8-12 random characters.

Tr0ub4dor&3 - 5.75 x 10^21

correct horse battery staple - 3.90 x 10^49

xjuidvsjpvt - 3.82 x 10^15

If these passwords have to be generated for the user, have your script pick four or five random dictionary words of at least 5 characters in length. No algorithms, super easy to remember.

  • xjuidvsjpvt is just one example, using large alphabet set of size 94 will give different password. Moreover the strength measured by grc site is not correct. Longer doesn't imply security. The correct to measure the strength is how randomly those words are drawn to create the passphrase. If only 1000 words are used then the strength of the passphrase consisting of 4 words will be just 40 bits which is 10^12 and not 10^49 as claimed by grc – Curious Sep 17 '14 at 3:58
  • -1 for pointing to a snake oil website with a badly broken "entropy estimator". – forest Apr 18 '18 at 4:24

Essentially what you are proposing is an algorithm with a seed value. This seed value is the users plaintext password. This is essentially no different from using a good KDF (like PBKDF2) on a master password to then create derived passwords.

That said, the common and most sensible advice is don't roll your own. If it's a KDF you are after, then use a known good algorithm. If it's simply secure passwords that you are after, a much simpler (and more secure) alternative is to use a password manager like Keepass.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.