Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

9/5/2019
04:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

New Technique Makes Passwords 14M Percent Harder to Crack, Nonprofit Claims

Tide's method for protecting passwords splinters them up into tiny pieces and stores them on distributed nodes.

One method that cryptographers often use to protect a secret is to split it up into multiple smaller pieces and allocate the individual portions for safekeeping to various different parties. It's only when a certain minimum number of those parties bring their portions together that the secret can be reconstructed in its entirety.

Now researchers at Tide — a nonprofit based in Sydney, Australia — have developed a similar approach to protecting usernames and passwords that they claim is some 14 million percent more difficult to hack than current mechanisms.

Tide's method, called "splintering," involves taking encrypted passwords within an authentication system, breaking them up into multiple tiny pieces, and storing the pieces on a decentralized distributed network from which they can be reassembled as needed.

Tide's Delegated Automated Trustee node technology makes it almost infinitely harder for attackers to reconstruct passwords using brute-force password guessing attacks, through reverse engineering and other techniques, according to the nonprofit.

In tests conducted using 60 million LinkedIn passwords that previously had been breached, Tide engineers discovered that splintering passwords reduced the odds of a dictionary attack succeeding from 100% to 0.00072%, an improvement over some 14.1 million percent, Tide claimed Thursday. The nonprofit has launched a campaign through which it is offering a reward to hackers who are able to break even a single username and password. So far, in 6.5 million attempts, not one hacker has been able to crack a single password, according to Tide.

Tide has implemented the new splintering technique in Tide Protocol, a collection of open source technologies it has developed to help organizations protect data better.

Yuval Hertzog, co-founder of Tide, says that within the Tide Protocol, encrypted passwords are splintered and stored over between 20 and 26 nodes on Tide's public blockchain. Each node — or Orchestrated Recluder of Keys, in the Tide Protocol — is tasked with processing the splinter assigned to it and to have the splinter assembled when requested. Only the node assigned to a splinter can decrypt it.

Configurable Security
Hertzog says the number of splinters that each encrypted password is broken up into is determined by the desired cryptographic strength and redundancy requirements of the organization. The minimum number is 20 nodes. "These parameters are configurable, allowing for customizable security and redundancy based on individual needs," he says.

The Tide scheme has been built in such a way that a splintered password can be fully recovered even if one or more of the nodes storing the splinters were to become unavailable for some reason. In fact, the model allows for up to 30% redundancy, meaning that a splintered password can be fully reassembled for authentication even if up to six nodes were to become unavailable, Hertzog says.

How scalable is the splintering approach when it comes to managing millions of passwords? Hertzog says the underlying architecture is based on an improved version of blockchain technology that already has been proven to support millions of users. "The specific implementation under the Tide Protocol has been load-tested to scale to several millions in a controlled environment," he says.

Tide engineers have introduced an intentional built-in 300 millisecond delay for each authentication request to mitigate brute-force and denial-of-service attacks on the network. But even with that, the latencies associated with splintering and reassembling passwords is on par with or even slightly better than existing commonly used authentication provider, Hertzog claims.

In public tests, end-to-end latency results showed the entire splinter-based authentication process to take between 1,500 milliseconds to 4,000 milliseconds with a full complement of nodes across Microsoft Azure, Google, and Amazon networks, he notes. "The splintering technology can be easily used in an almost identical manner to any of the existing OAuth2 authentication schemes and be integrated into any existing organization."

Tide's splintering approach is not available commercially yet. But organizations that want to kick the tires can find code and documentation for the technology on GitHub, where it is available under a special Tide Open Source License.

Tide describes itself as focused on protecting consumer data. Its members include cryptographers, tech entrepreneurs, economists, and media agency heads.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Meet FPGA: The Tiny, Powerful, Hackable Bit of Silicon at the Heart of IoT."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AlphegA
50%
50%
AlphegA,
User Rank: Apprentice
9/9/2019 | 8:58:38 PM
Re: Does it really help users?
This is a server side protection in an event the password database is breached.  This doesn't stop a compromised personal credentials.  Theres a few mechanism to mitigate those such as 2 factor authentication.  But that's not  going to help if your 2nd factor (email or device) is also compromised.   
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27652
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27653
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27654
PUBLISHED: 2020-10-29
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.
CVE-2020-27655
PUBLISHED: 2020-10-29
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.
CVE-2020-27656
PUBLISHED: 2020-10-29
Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.