PHAL-256 (Parameterized HashALgorithm) is a proposal of a new dedicated hash algorithm designed as an answer to weaknesses of MD/SHA family. Recently proposed attacks on well-known and widely used hash functions motivate a design of new hash functions. In this paper new approach is presented, where a few elements of hash function are parameterized. This approach makes the hash algorithm more secure and more flexible. PHAL-256 consists of two mechanisms: new iteration schema and dedicated compression function.

It is very common for users to create weak passwords. Currently, the majority of websites deploy password strength meters to provide timely feedback. These meters are in wide use and their effects on the security of passwords have been relatively well studied. In this paper another type of feedback is studied: a gamified approach supported by fear appeal. In this approach, users are encouraged to make passwords stronger through the use of visual and textual stories. This approach is supported by data-driven suggestions about how to improve password security as well as by fear appeal. To prove the effectiveness of this gamified password creation process, an experiment was performed in which users changed their passwords in two ways: without any feed-back, and with gamified feedback with fear appeal. To support the initial findings a questionnaire was completed by participants at the end of research.

No abstract

The aim of the article is to systematise the methods of securing static passwords stored in IT systems. Pros and cons of those methods are presented and conclusions as a recommendation for IT system designers are proposed. At the beginning, the concept of cryptographic hash function is presented, following discussion of methods of storing passwords showing their evolution and susceptibility to modern attacks. Results of research on masked passwords of Polish banks IT systems are presented, as well as the most interesting examples of adaptive password functions are given. Then, the systematisation of password protection methods was carried out. Finally, the directions for further research are indicated. Keywords: computer security, password, authentication, hash function

No abstract