Room: BBL 065
Speaker: Gerrit Wiltink
Title: Wissel je Wachtwoord Wisselaar: Would YOU trust your government to generate your passwords?
In October 2010, the Dutch government launched a password generation tool,
the Wachtwoord Wisselaar. After answering five personal questions, users are
provided with a password that is claimed to be both easy to remember and of
sufficient complexity. In this project we successfully challenge the latter.
Among other methods, we adapted a precomputation attack and a brute force
attack to specifically target the Wachtwoord Wisselaar. We tested our methods with a
set of cryptographically hashed passwords, that were created by Computing
Science students using the Wachtwoord Wisselaar. Using only a few
computers with widely available hardware we managed to crack more than 75% of these
passwords in a relatively short period. As a more powerful adversary may have access to
state-of-the-art machinery, the Wachtwoord Wisselaar should now be considered