The Password Grid - A Password Strategy
First published on February 18, 2000
Please send any questions or comments to this address.
This is a strategy for protecting your encrypted data such that you will always
have the option of easily and quickly destroying the data forever, in the event
your system is compromised, stolen, or confiscated. It is assumed that the
encryption software in use is of high quality.
Sample Password Grid
- Start by creating a set of several different grids patterned after the one above,
with each square containing a randomly selected keyboard character. You can do this
by hand, with a spreadsheet program, or with other software. True randomness is
important here. Any software you develop to create grids should itself be encrypted
and password protected by the grid currently in use.
- Choose and memorize an ordered pattern of squares. The longer the pattern,
the more secure it is. Here are some examples using sixteen squares:
- Follow your chosen pattern through the grid to read out your password and
enter it into your password protected system.
For example:
- Using the first pattern, the password is "6FVJ1vZ%n^dTpCeq".
- Using the second pattern, the password is "eHYJVF6ixASvOcn%".
- Using the third pattern, the password is "s@S1DjpTdQ3gnODY".
- Carry a copy of the grid with you. A spare copy may optionally be kept in a
safe place, but in no event should a copy currently in use be stored anywhere
near your computer - not even in the same building.
- In the event you find yourself beginning to remember parts of your password,
switch to another grid and read out your new password, using the same pattern
that you memorized before. There's no need to change to a new pattern.
Change the password on your system to the new one.
- In the event that your system is compromised and you wish to destroy the data
so that nobody, not even you, can ever recover it, simply destroy all copies of the
current password grid. Keep unused copies in order to demonstrate to interested
parties that the password is truly lost forever.
- Update, added May 28, 2007: For convenience, you can
restrict the characters used in the grid to the 24 lower-case letters excluding
"l" and "o", and the digits 2-9. This leaves a set of 32 characters which can all
be typed one-handed while holding the printed copy of the password grid. It also
prevents confusion of the digit "1" (one) with the letter "l", and the letter
"o" with the number "0" (zero).
Restricting the characters to this set and using a total password length of 16
characters, with each character being randomly chosen and duplicate characters
being allowed to occur as they may, this results in a total of 2^80, or
1,208,925,819,614,629,174,706,176 possible passwords. This implies that without
possession of the password grid, password strength will remain extremely strong.
(End)