Chapter 2 · 1970s

The file

If you must keep a file of secrets, make the file worthless to steal. Unix's answer — hash it, salt it — still guards your accounts tonight.

Scherr’s punched card posed a question that took a decade to answer well: how do you check a password without keeping a file of passwords? The answer came out of Bell Labs, from the Unix room — the same cast this project’s computing site follows — and it was published in 1979 in a paper so durable that your accounts are still guarded by its ideas tonight.

Robert Morris and Ken Thompson’s “Password Security: A Case History” reads like a confession as much as a design. Unix had started exactly where CTSS did — a readable password file — and the paper walks through the embarrassments that followed. The best one: an administrator merged the password file with the message-of-the-day file, and every password on the system greeted every user at login. The file, again. Always the file.

Their fix has two moving parts, and both matter. First: never store the password. Store a one-way hash of it — a scramble that’s easy to compute in one direction and practically impossible to reverse. At login, hash whatever the user types and compare scrambles. The system can check your password without knowing it. Steal the file now and you hold a list of locks, not keys.

Attackers adapt, and the paper saw the adaptation coming: fine, you can’t reverse the hash — but you can guess. Hash “password”, hash “123456”, hash every word in the dictionary, and compare against the stolen file. Worse, you can do that work once, in advance, and check the precomputed table against every system on earth — since everyone choosing “sunshine” produces the same hash everywhere.

That’s what the second part kills. Salt: mix a random value into each password before hashing, store the salt beside the hash. Now two users with the same password have different hashes, and the attacker’s precomputed table is worthless — every guess must be recomputed per account. Salting doesn’t make one password harder to crack. It makes economies of scale in cracking collapse. Slide the numbers below and feel the arithmetic: it’s the difference between attacking everyone at once and attacking one account at a time.

Notice what kind of move this was, because it’s the site’s thesis making its first appearance in engineering form. Nothing about the password itself changed — users still typed the same weak secrets. What changed was the management of the secret: how it was stored, what a thief could do with the stolen store. The control migrated from the string to the wrapping. It would keep migrating for sixty years.

The paper is also honest about the part no algorithm fixes, and its numbers are famous: the authors collected thousands of real passwords and cracked an outright majority with short searches — dictionary words, names, short strings. Hashing protects the file. Nothing in the file protects against the human choosing “ken” as a password. Hold that thread; it becomes the cracking wars of chapter 3 and the rules disaster of chapter 4.

One more thing about who wrote this. Robert Morris left Bell Labs for the NSA. Nine years after the paper, his son released the worm that knocked out a tenth of the internet — partly by guessing weak passwords, exactly as the paper had warned. The father wrote the defense; the son delivered the demonstration. Chapter 3 is the demonstration era.