Forgive me, I am no code breaker.  But it struck me some time ago that we do passwords the wrong way.

We’ve witnessed the steady uptick in password requirements online since we got online big-time in the 90s, and it seems the upticking might morph into ways of “doing security” that are potentially much more intrusive, and much more sinister than “security theater”.  Witness this week’s NPR story (All Tech Considered, 25 July) about privacy and account hacking that pointed to what I see as only less-than-excellent choices — “stronger” passwords, objects (arphids?), or biometrics.

Stronger passwords means longer passwords, and/or passwords with increasingly novel characters.  Will debit card readers eventually require 9 character PINs with at least one in Cyrillic?  I reckon, post-singularity, we’ll have to use infinitely long passwords.  Objects keys are interesting, as is RFID.  But since being burned by thumbdrives earlier in the Century (and 5” floppies, diskettes, CDRs during the last) the notion of trusting a thing I tote to bear data I need seems not so robust.  And biometrics is where I don’t want to go — but, no doubt, it is where we will go. Retina, gait patterns, voice timbre, and even good old fingerprint recognition are abundant these days, and all are trending up.

Now it occurs to me that before we get too far ahead of ourselves, we should re-imagine ways to improve the simplest option.  Passwords aren’t weak, they’re just
dumb.  I propose smart passwords that we’ll here call “phasekeys”.

A phasekey isn’t a string of characters.  Phasekeys are formulae.

When you create a new account, you set a username, and you might still give the system personally identifying information (anything from a birthday, a maiden name, a fingerprint scan, whatever).  But the password section asks for an initial PIN or character string of some kind plus a mathematical operation.

You put in a password of “2000yippie” and select an operation like “multiply by x” to get a phasekey of 2080*x (2000259161695 is 2000 and the numerical correspondances of each letter in yippie: 25,9,16,16,9,5; the string of numbers is added to get 2080), where “x” is determined at each new login.  Upon each login, a user would determine the value of x.  The phasekey has 3 blank forms, where the login has just one.

Login:        podunk.cypherdellic
Phasekey:
Password:    2000yippie
x equals:    4

Phasekey:    8320

This is a simple illustration of the idea, but you can imagine much more baroque operations.  Longer passwords with “special characters” acting as actual operators (“bbq^2” comes out to be 441) and more sophisticated choices in the “x equals” field (9x-[the cube of the second character]) would make breaking into an account really hard.  Phasekeys are also simpler, in that you can start with an intuitive password with real words and numbers.  You don’t even have to use special characters.  You could use “password” and still be safe.

Phasekeys are different from passwords because they describe movements and operations rather than static strings of characters.  They make “passwords” into a whole other category of thing by giving them some set (if changing and changeable) treatment.

Now it may be the case that all phones will shortly come with built-in biometric locks.  When you wink at it, it wakes up and sighs… when somebody else winks at it, it barks “Back off, Smurfette” in its best Warren Ellis.  The pros and cons of ubiquitous biometrics can be debated.  The uses and abuses will be myriad, funky, and surely sometimes fun.  But before we slip too far down that slope, let’s try a bit of phase-space tantra on a good old standard tool.  Let’s meta the password.

Attn cypherpunks: is any of this remotely realistic?