CompTIA Security_ Deluxe Study Guide_ SY0-201 - Emmett Dulaney [171]
Passwords should be as long and as complicated as possible. Most security experts believe a password of 10 characters is the minimum that should be used if security is a real concern. If you use only the lowercase letters of the alphabet, you have 26 characters with which to work. If you add the numeric values 0 through 9, you’ll get another 10 characters. If you go one step further and add the uppercase letters, you’ll then have an additional 26 characters, giving you a total of 62 characters with which to construct a password.
Most vendors recommend that you use nonalphabetic characters such as #, $, and % in your password, and some go so far as to require it.
If you used a 4-character password, this would be 62 × 62 × 62 × 62, or approximately 14 million password possibilities. If you used 5 characters in your password, this would give you 62 to the fifth power, or approximately 920 million password possibilities. If you used a 10-character password, this would give you 62 to the tenth power, or 8.4 × 1017 (a very big number) possibilities. As you can see, these numbers increase exponentially with each position added to the password. The 4-digit password could probably be broken in a fraction of a day, while the 10-digit password would take considerably longer and much more processing power.
If your password used only the 26 lowercase letters from the alphabet, the 4-digit password would have 26 to the fourth power, or 456,000 password combinations. A 5-character password would have 26 to the fifth power, or over 11 million, and a 10-character password would have 26 to the tenth power, or 1.4 × 1014. This is still a big number, but it would take considerably less time to break it.
To see tables on how quickly passwords can be surmised, visit http://www.lockdown.co.uk/?pg=combi&s=articles.
Mathematical methods of encryption are primarily used in conjunction with other encryption methods as part of authenticity verification. The message and the hashed value of the message can be encrypted using other processes. In this way, you know that the message is secure and hasn’t been altered.
As a security administrator, you should know how to work with hashing within your operating system.
Understanding Quantum Cryptography
Quantum cryptography is a relatively new method of encryption. Prior to 2002, its application was limited to laboratory work and possibly to secret governmental applications.
This method is based on the characteristics of the smallest particles known. It may now be possible to create unbreakable ciphers using quantum methods.
You won’t be tested on quantum cryptography on the Security+ exam. It’s included here for real-world knowledge.
The process depends on a scientific model called the Heisenberg Uncertainty Principle for security. Part of the Heisenberg Uncertainty Principle basically states that in the process of measuring the results, the results are changed. Werner Heisenberg’s early works were published in 1926, and they have been greatly debated by physicists ever since.
Imagine you have a bowl of water and you want to measure the temperature of the water. When you put a thermometer into the water, you change the temperature of the water: The presence of the thermometer makes the temperature of the water rise or drop slightly. In short, the act of measuring the water temperature changes the water temperature, making it impossible to know the true temperature of the water before you measured it.
In quantum cryptography, a message is sent using a series of photons. If the receiver knows the sequence and polarity of the photons, they can decode the message. Otherwise, the photons look like random noise. If someone intercepts the photons, some of the photon positions will change polarity and the message will be altered. This will inform the receiver that someone is listening in on the message. The sender, when informed, can change the pattern and resend the message