A shift cipher shifts every letter of a word by \"n\" amount and creates new wor

Question

A shift cipher shifts every letter of a word by "n" amount and creates new word. The number of possible keys in the shift cipher is equal the size of the alphabet set from which the word is derived. For example if the words are derived from the lowercase letters there are 26 different keys.

The word "withcurious" with the shift-amount or key "1" gets transformed to "xjuidvsjpvt". Can such schemes be used by user to set passwords. One might argue that, in the case of shift cipher the number of keys are less. Therefore if the attacker learns this trick, he has to build only 26 dictionaries one with every shift amount. 0...25

But if one uses monoalphabetic or polyalphabetic substitution ciphers, in which every alphabet in a word is basically shifted by different amount, can it be used to create secure passwords, considering that a random key is assigned to every user. With the alphabet set of size 94 that include lowercase, uppercase, digit and symbols there are 94! different keys in case of monoalphabetic substitution ciphers and power(94;94) in case of polyalphabetic substitution ciphers. User can store the key (alphabetic mapping) securely, and may be use the name of the site and encrypt it with his secret key. The resulting ciphertext appears random and is set as password.

Can the passwords constructed under such scheme be considered as secure if it satisfies the minimum length requirement( > 12)? Is it feasible to implement such scheme?

Explanation / Answer

Essentially what you are proposing is an algorithm with a seed value. This seed value is the users plaintext password. This is essentially no different from using a good KDF (like PBKDF2) on a master password to then create derived passwords.

That said, the common and most sensible advice is don't roll your own. If it's a KDF you are after, then use a known good algorithm. If it's simply secure passwords that you are after, a much simpler (and more secure) alternative is to use a password manager like Keepass.

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.