Problem - Kevin Tafuro

8.8 Throttling Failed Authentication Attempts
Problem
You want to prevent an attacker from making too many attempts at guessing a password
through normal interactive means.
Solution
It’s best to use a protocol where such attacks don’t leak any information about a
password, such as a public key–based mechanism.
Delay program execution after a failed authentication attempt. For each additional
failure, increase the delay before allowing the user to make another attempt to
authenticate.
Discussion
Throttling failed authentication attempts is a balance between allowing legitimate
users who simply mistype a password or passphrase to have a quick retry and delaying
attackers who are trying to brute-force passwords or passphrases.
Our recommended strategy has three variables that control how it delays repeated
authentication attempts:
Maximum number of attempts
If this limit is reached, the authentication should be considered a complete failure,
resulting in a disconnection of the network connection or shutting down of
the program that requires authentication. A reasonable limit on the maximum
number of allowed authentication attempts is three, or perhaps five at most.
Maximum number of failed attempts allowed before enabling throttling
In general, it is reasonable to allow one or two failed attempts before instituting
delays, depending on the maximum number of allowed authentication failures.
Number of seconds to delay between successive authentication attempts
For each successive failure, the delay increases exponentially. For example, if the
base number of seconds to delay is set to two, the first delay will be two seconds,
the second delay will be four seconds, the third delay will be eight seconds,
and so on. A reasonable starting delay is generally one or two seconds, but
depending on the settings you choose for the first two variables, you may want
to increase the starting delay. In particular, if you allow a large number of
attempts, it is probably a good idea to increase the delay.
The best way to institute a delay depends entirely upon the architecture of your program.
If authentication is being performed over a network in a single-threaded server
that is multiplexing connections with select( ) or poll( ), the best option may be to
398 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.