Re: Password / access rights check

From: Ben Mord (benmord_at_earthlink.net)
Date: 09/09/03 

Date: Mon, 8 Sep 2003 20:04:36 -0400

"Simon Johnson" <Ckwop@hotmail.com> wrote in message
news:f5668ae7.0309080757.476687d4@posting.google.com...
> alex221@pisem.net (Alex Prokhorov) wrote in message
news:<a502d884.0309072223.6839d811@posting.google.com>...
> > Hello.
> > I need to add security to my project and haven't done this before.
> > What I have to do is to grant different users different levels of
> > access to the features of the program. It is clear for me how to do it
> > in case of simple allowed/denied access to the program. I just create
> > text file with usernames and md5 hash of their passwords. But how and
> > where to store access options? I suppose, that access options must be
> > encrypted too (or maybe i'm not right?). Additionally i need an option
> > for the admin to arbitrarily change access options for users without
> > knowing their passwords. Anyone could please direct me. Thanks.
> > Alex221
>
>
> Use public key cryptography. Sign the permissions with the
> administrators private key. You can write the program to check the
> correct public key is installed by checking the permissions signatures
> verify properly.
>
> Simon.

Simon - It doesn't make sense to sign the permissions unless you also sign
the password hashes (or use a keyed hash). Otherwise, someone who is able to
modify this file would simply change the password on an account with the
desired access level. If you did sign both, you would need to sign them
together to prevent someone from swapping a privledged account's access
level with their's. But even in this situation, it is practically impossible
to defend against an attacker who has unrestrained access to the same
system's hard drive that also hosts the program itself - they could just
modify the access logic itself. In light of these considerations, it
probably makes more sense to rely on non-cryptographic measures to protect
the integrity of this data, in most situations. (There might be an
exceptional situation, e.g. under some threat models if the file were
remotely stored on another file server for some reason, or perhaps mounted
RW while the software is on a partition mounted read-only...)

Alex - hashing passwords prevents someone with unauthorized knowledge of
your file's contents from gaining unauthorized access. Depending on your
specific requirements, you might not care that much if this same person has
knowledge of a user's access level. One reason why you might care is that it
allows the attacker to focus their attacks only on those accounts with the
desired access, and it might also tell them which user they should beat up
or bribe to gain the desired access. But depending on your context, you
might or might not care much about these issues.

Ben

Relevant Pages

  • Re: a way psuedo random numbers can be used in cryptography
    ... multiplies it together. ... Well, the first problem is multiple passwords all create the same seed, ... The attacker knows this is a letter going to Alice. ...
    (sci.crypt)
  • US-CERT security awareness tips
    ... the US-CERT recently started offering security ... Choosing and Protecting Passwords ... what attacker cares about your ... One of the best ways to protect information or physical property is to ...
    (Security-Basics)
  • Re: [Full-disclosure] Google Talk cleartext credentials in processmemory
    ... operating system already presents a means to protect against one process snooping on the other, as has already been pointed out elsewhere in this thread. ... Since application developers are lazy they're going to expose those passwords to every tom, dick and harry who gains access. ... The longer an attacker has to wait for something the greater the ...
    (Full-Disclosure)
  • Re: MD5 and SHA-0 collisions
    ... >>authenticating that you have the secret key. ... hashes of passwords to avoid storing passwords in the clear. ... An attacker wanting to run a dictionary search would have to get ...
    (sci.crypt)
  • Re: File encryption software?
    ... passwords in certain files (passwords in the file are encrypted or ... Password Safe suggestion took care of my web passwords. ... I've tried putting Agent in my user profile directory as ... I understand Vista Ultimate lets you encrypt almost everything, ...
    (rec.outdoors.rv-travel)