Full Text:   <2837>

CLC number: TN918; TP309

On-line Access: 

Received: 2007-03-11

Revision Accepted: 2007-05-09

Crosschecked: 0000-00-00

Cited: 2

Clicked: 4867

Citations:  Bibtex RefMan EndNote GB/T7714

-   Go to

Article info.
1. Reference List
Open peer comments

Journal of Zhejiang University SCIENCE A 2007 Vol.8 No.8 P.1183-1190


Multiple hashes of single key with passcode for multiple accounts

Author(s):  LEE Kok-wah, EWE Hong-tat

Affiliation(s):  Faculty of Engineering & Technology, Multimedia University, Jalan Ayer Keroh Lama, 75450 Bukit Beruang, Melaka, Malaysia; more

Corresponding email(s):   kwlee@mmu.edu.my, htewe@mmu.edu.my

Key Words:  Key management, Memorability, Key hashing, Key strengthening, Multiple accounts, Information security

LEE Kok-wah, EWE Hong-tat. Multiple hashes of single key with passcode for multiple accounts[J]. Journal of Zhejiang University Science A, 2007, 8(8): 1183-1190.

@article{title="Multiple hashes of single key with passcode for multiple accounts",
author="LEE Kok-wah, EWE Hong-tat",
journal="Journal of Zhejiang University Science A",
publisher="Zhejiang University Press & Springer",

%0 Journal Article
%T Multiple hashes of single key with passcode for multiple accounts
%A LEE Kok-wah
%A EWE Hong-tat
%J Journal of Zhejiang University SCIENCE A
%V 8
%N 8
%P 1183-1190
%@ 1673-565X
%D 2007
%I Zhejiang University Press & Springer
%DOI 10.1631/jzus.2007.A1183

T1 - Multiple hashes of single key with passcode for multiple accounts
A1 - LEE Kok-wah
A1 - EWE Hong-tat
J0 - Journal of Zhejiang University Science A
VL - 8
IS - 8
SP - 1183
EP - 1190
%@ 1673-565X
Y1 - 2007
PB - Zhejiang University Press & Springer
ER -
DOI - 10.1631/jzus.2007.A1183

A human’s e-life needs multiple offline and online accounts. It is a balance between usability and security to set keys or passwords for these multiple accounts. Password reuse has to be avoided due to the domino effect of malicious administrators and crackers. However, human memorability constrains the number of keys. Single sign-on server, key hashing, key strengthening and petname system are used in the prior arts to use only one key for multiple online accounts. The unique site keys are derived from the common master secret and specific domain name. These methods cannot be applied to offline accounts such as file encryption. We invent a new method and system applicable to offline and online accounts. It does not depend on HTTP server and domain name, but numeric 4-digit passcode, key hashing, key strengthening and hash truncation. Domain name is only needed to resist spoofing and phishing attacks of online accounts.

Darkslateblue:Affiliate; Royal Blue:Author; Turquoise:Article


[1] Abadi, M., Lomas, T.M.A., Needham, R., 1997. Strengthening Passwords. Technical Reports of SRC (Systems Research Center) SRC-1997-033. Palo Alto, CA, USA, p.1-11.

[2] Adams, A., Sasse, M.A., 1999. Users are not the enemy. Commun. ACM, 42(12):40-46.

[3] Borenstein, N., Freed, N., 1992. Base64 Content-Transfer-Encoding. MIME (Multipurpose Internet Mail Extensions): Mechanisms for Specifying and Describing the Format of Internet Message Bodies. RFC 1341. IETF, Sterling, Virginia, USA, p.17-19.

[4] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., Stewart, L., 1999. HTTP Authentication: Basic and Digest Access Authentication. RFC 2617. IETF, Sterling, Virginia, USA, p.1-34.

[5] Gabber, E., Gibbons, P., Matias, Y., Mayer, A., 1997. How to make personalized web browsing simple, secure, and anonymous. LNCS, 1318:17-31.

[6] Gouda, M.G., Liu, A.X., Leung, L.M., Alam, M.A., 2005. Single Password, Multiple Accounts. Proc. 3rd Int. Conf. on Applied Cryptography and Network Security. New York City, NY, USA, p.1-12.

[7] Halderman, J.A., Waters, B., Felten, E.W., 2005. A Convenient Method for Securely Managing Passwords. Proc. 14th Int. Conf. on World Wide Web 2005. Chiba, Japan, p.471-479.

[8] Ives, B., Walsh, K.R., Schneider, H., 2004. The domino effect of password reuse. Commun. ACM, 47(4):75-78.

[9] Kanaley, R., 2001. Login Error Trouble Keeping Track of All Your Sign-ons? Here’s a Place to Keep Your Electronic Keys, but You’d Better Remember the Password. San Jose Mercury News, Feb. 4, 2001.

[10] Karp, A.H., 2003. Site-Specific Passwords. Technical Report of HP Laboratories Palo Alto HPL-2002-39 (R.1). Palo Alto, CA, USA, p.1-9.

[11] Karp, A.H., Poe, D.T., 2004. System-Specific Passwords. USPTO Published Application for Patent US2004/ 0025026. Alexandria, VA, USA, p.1-6.

[12] Kelsey, J., Schneier, B., Hall, C., Wagner, D., 1997. Secure applications of low-entropy keys. LNCS, 1396:121-134.

[13] Kormann, D.P., Rubin, A.D., 2000. Risks of the passport single signon protocol. Computer Networks, 33:51-58.

[14] Lilly, G.M., 2004. Device for and Method of One-Way Cryptographic Hashing. USPTO Patent US6829355. Alexandria, VA, USA, p.1-8.

[15] Luo, H., Henry, P., 2003. A Common Password Method for Protection of Multiple Accounts. Proc. 14th IEEE 2003 Int. Symp. on Personal, Indoor and Mobile Radio Communication (PIMRC 2003). Beijing, China, 3:2749-2754.

[16] Manber, U., 1996. A simple scheme to make passwords based on one-way functions much harder to crack. Computers and Security, 15(2):171-176.

[17] Matias, Y., Mayer, A., Silberschatz, A., 1997. Lightweight Security Primitives for E-commerce. Proc. USENIX Symposium on Internet Technologies and Systems. Monterey, California, USA, p.95-102.

[18] NIST, 2002. FIPS PUB 180-2: Secure Hash Standard. CSRC, NIST. Gaithersburg, MD, USA, p.1-79.

[19] Rivest, R., 1992. The MD5 Message-Digest Algorithm. RFC 1321. IETF, Sterling, Virginia, USA, p.1-21.

[20] Ross, B., Jackson, C., Miyake, N., Boneh, D., Mitchell, J.C., 2005. Stronger Password Authentication Using Browser Extensions. Proc. 14th USENIX Security Symposium (SEC’05). Baltimore, MD, USA, p.17-32.

[21] Wikipedia, 2007a. MD5. Wikipedia the Free Encyclopedia. Accessed on Feb. 1, 2007, <http://en.wikipedia.org/w/index.php?title=MD5&oldid=142373953>

[22] Wikipedia, 2007b. SHA Hash Functions. Wikipedia the Free Encyclopedia. Accessed on Feb. 1, 2007, <http://en.wikipedia.org/w/index.php?title=SHA_hash_functions&oldid=141311777>

[23] Wikipedia, 2007c. Petname. Wikipedia the Free Encyclopedia. Accessed on Feb. 1, 2007, <http://en.wikipedia.org/w/index.php?title=Petname&oldid=93050718>

[24] Wikipedia, 2007d. Moore’s Law. Wikipedia the Free Encyclo-pedia. Accessed on Feb. 1, 2007, <http://en.wikipedia.org/w/index.php?title=Moore%27s_Law&oldid=142016849>

[25] Yee, K.P., Sitaker, K., 2006. Passpet: Convenient Password Management and Phishing Protection. Proc. Symposium on Usable, Privacy and Security. Pittsburgh, PA, USA, p.32-43.

Open peer comments: Debate/Discuss/Question/Opinion


invest@No address<hotmann@mail.com>

2014-03-12 15:05:37

A series of true different colours is programmed in the display and the transmission quick through spots

kartosin@No address<roag94@mail.com>

2014-03-10 12:30:19

However caution is ideal necessary when choosing true model great flexibility

mypiko@No address<coconof@mail.com>

2014-01-30 02:06:32

The physician studies the pattern on the paper to see if the heart rhythm is normal

ourgreen@No address<rostont@mail.com>

2014-01-26 01:29:48

The oranges inside recalled absolutely a landscape

Please provide your name, email address and a comment

Journal of Zhejiang University-SCIENCE, 38 Zheda Road, Hangzhou 310027, China
Tel: +86-571-87952783; E-mail: cjzhang@zju.edu.cn
Copyright © 2000 - 2022 Journal of Zhejiang University-SCIENCE