http://sntbul.bmstu.ru/issue/541655.html УДК 621.382 Метрики

!"#$%&'()*&
+,-./0/$1-23021-/$45.267823$95:/-;
+5.02<$=(>(
!"#$%&", '()%$*(+,-&).*/(01.&&(2+3%4.5(6&.6"7» 89:;+1/<+=<><+?(#/(&(@+
A<+8.6'B(@+C.6612
=(#D&EF+*#'.B.$1"%G7H+I1*G.B+J<K<,
'(&$1$(" "%L&1D%6'1L+&(#'@+$.0%&" '()%$*E+,-&).*/(01.&&(2+3%4.5(6&.6"7»
89:;+1/<+=<><+?(#/(&(@+A<+8.6'B(@+C.6612
!"#$%&'(%)(*(%+,-',.,
gm@cnpo.ru
/012&234',% ,-34.3&5&6,7&&% 89:84328% ;4<9='% <->4?0'% 9% 2&234'4 @,A&3=% &.50<',7&&%
60';BC34<.0D% 2&234'=(%#<,1&7&0..='&%2&234','& ,-34.3&5&6,7&&% 89:8C328% 02.09,..=4% .,%
246<43.=E% &14.3&5&6,30<,E% - ;,<0:8E(% F% 20?,:4.&CG% ;,<0:B.=4% 2&234'=% -8@9&'=% ;0%
0>H463&9.='% &% 2->H463&9.='% ;<&I&.,'G% .,;<&'4<G% ;0% ;<&I&.4% 9=>0<,% .4230D60J0% ;,<0:8G%
.,:&I&8% -8@9&'0234D% 9% 2&234',E% &% ;<03060:,E% ,-34.3&5&6,7&&G% <,2;<023<,.4..023&% 2&234'%
;01>0<,% ;,<0:4D% &% 2&234'% ;4<4E9,3, &% 1<( ),;<&'4<G% 20J:,2.0% 23,3&23&64G% KLM% &.7&14.309% 9%
0>:,23&% &.50<',7&0..0D% >4@0;,2.023&% 298@,.=% 2% 60';<0'43,7&4D% ;,<0:B.0D% @,A&3= [1,7].
N@94234.% <81% '4<0;<&83&DG% .,;<,9:4..=D% .,% ;09=O4.&4% >4@0;,2.023& ;,<0:B.0D% @,A&3=G%
.,;<&'4<G% J4.4<,7&8% 230D6&E% ;,<0:4D% &% 9.41<4.&4% 2003943239-CA4D% ;,<0:B.0D% ;0:&3&6&%
>4@0;,2.023&(%F%.41023,36,'%;02:41.4J0%;01E01,%'0?.0%03.423&%30G%I30%3<4>09,.&8%6%;,<0:8'G
6,6% ;<,9&:0G% 0;<414:8C328% 94<>,:B.0G% .,;<&'4<G% 50<'-:&<-4328% 3<4>09,.&4G% 20J:,2.0%
6030<0'-% 1:&.,% ;,<0:8% 10:?.,% >=3B% >0:BO4% O423& &:&% 902B'& 2&'90:09(% P% <,>034%
<,22'03<4.=% '43<&6&% Q;06,@,34:&% 230D6023&% ;,<0:4DRG% ;0@90:8CA&4% 250<'-:&<09,3B%
50<',:B.=4% 3<4>09,.&8% 6% 230D6023&% ;,<0:4D, &2E018% &@% 90@'0?.023&% &E% 60';<0'43,7&&G% ,%
3,6?4%;<09414.0%&22:4109,.&4%;,<0:B.0D%@,A&3=%.,%;<&'4<4%207&,:B.=E%2434D(
?.,@2<58/A$0$45.2678;B$1/1-,B5B
P%0>A4'%;:,.4%;,<0:B%;<4123,9:843%20>0D%;02:4109,34:B.023B%2&'90:09G%;0@90:8CA&E%
;0:B@09,34:C%;0:-I,3B%1023-;%6%<42-<2,'%&%;<07422,'%60';BC34<.0D%2&234'=( N@9423.0G%I30%
94<083.023B%;01>0<,%;,<0:4D%<,22I&3=9,4328%;0%2:41-CA4D%50<'-:4S
"#$
! = |%|& ,
http://sntbul.bmstu.ru/issue/541655.html
J14S%' – 260<023B% ;01>0<,% ;,<0:8% @:0-'=O:4..&60'G%( - 2<06% 14D239&8% ;,<0:8G%) - ,:5,9&3%
;,<0:4DG%|)|* - '0A.023B%;<023<,.239,%;,<0:4DG%n - 1:&.,%;,<0:8(
P% .,2308A44% 9<4'8% 9% <022&D26&E% 23,.1,<3,E% &'4C328% 3<4>09,.&8% 6% ;09=O4.&C%
230D6023&% ;,<0:B.0D% @,A&3=G% 6,2,CA&428G% J:,9.='% 0><,@0'G% '&.&',:B.0D% 1:&.=% ;,<0:8(%
),;<&'4<G% 9% <-609018A&E% 106-'4.3,E% "0234E60'&22&& W022&&% 0;<414:4.0G% I30% «9%
,930',3&@&<09,..0D% 2&234'4% 10:?.=% 9=;0:.83B28% &14.3&5&6,7&8% &% ;<094<6,% ;01:&..023&%
2->H46309%1023-;,%;<&%9E014%9%.44%;0%;,<0:C%-2:09.0-;02308..0J0%14D239&8G%1:&.0D%.4%'4.44%
O423&%>-694..0-7&5<09=E%2&'90:09» [6].
/010>.=4%3<4>09,.&8%'0?.0%923<43&3B%9%@,<->4?.=E%23,.1,<3,E%X11, 12].
Y<&4.3&<-82B
.,%
-6,@,..=4% 23,.1,<3=% &% 0>A4;<&.83-C% ;<,63&6-% '0?.0%
250<'-:&<09,3B% 0;<414:4.&4% 2:,>0J0% QZ.4.,14?.0J0[R% ;,<0:8G% 6030<=D% '0?43% >=3B%
03.02&34:B.0%:4J60%;010><,.(%/-23B%2:,>=D%;,<0:B%- \30%;,<0:BG%6030<=DS%60<036&D%Q'4.BO4%K%
2&'90:09RG% .,><,.% 9% 01.0'% <4J&23<4G% .,><,.% 9% ;<0230'% ,:5,9&34% Q30:B60% 2&'90:=% &:&% 30:B60%
7&5<=RG% .,D14328% 9% 0>A41023-;.=E% 2:09,<8EG% 6,6-:&>0% 298@,.% 2% 9:,14:B74'G% 3,6% I30% '0?43%
>=3B%03J,1,.(%U%30I6&%@<4.&8%,930',3&@,7&&%074.6&%230D6023&%;,<0:B.0D%@,A&3=%;<4123,9:843%
&.34<42 ;0:-I&3B%50<',:B.=4%;06,@,34:& 230D6023&%;,<0:4D(
+,-./0/$1-23021-/$45.26,3
U-A4239-C3% <,@:&I.=4% ;06,@,34:&% 230D6023&% ;,<0:B.0D% @,A&3=G% .,@=9,4'=4%
;,<0:B.='&%'43<&6,'&G%,%&'4..0S
- I&2:4..=4%'43<&6&;
- 94<083.023.=4%'43<&6&]
- &.50<',7&0..,8%\.3<0;&8%;0%^4..0.-;
- \9<&23&I426&4%'01&5&6,7&&%\.3<0;&&;
- 94<083.023.=4%'01&5&6,7&&%\.3<0;&&(
_&2:4..=4% '43<&6&G% 6,6% ;<,9&:0G% ;<4123,9:8C3% .0<'&<09,..=4% @.,I4.&8% 9<4'4.&%
;0:-I4.&8% ;,<0:8% '43010'% ;<8'0J0% ;4<4>0<,% [3]. #,60D% ;01E01G% 6% 20?,:4.&CG% .4% -I&3=9,43%
209<4'4..=4% '4301=% 74:4.,;<,9:4..0J0% ;4<4>0<,% &% -J,1=9,.&8G% ,% 3,6?4% 10:?4.% -I&3=9,3B%
020>4..023&%&.34<54D2,%&%&'4CA&428%9=I&2:&34:B.=4%'0A.023&(
P4<083.023.=4% '43<&6&% &% 94<083.023.=4% '01&5&6,7&&% ;0:-I,C3G% &2E018% &@% ,.,:&@,%
&'4CA4D28% 23,3&23&6&% ;,<0:B.=E% >,@% 1:8 60.6<43.=E 2&234' [2, 8]. F% .41023,36,'% '43<&6
03.0283% .40>E01&'023B% .,:&I&8% >,@=% ;,<0:4D% ;0% 2&234'4% &:&% 9=;0:.4.&4% ,;;<062&',7&&
&'4CA4D28% 23,3&23&6&% 6% <4,:B.0D% 2&234'4. U% 30I6&% @<4.&8% <4@-:B3,3&9.023& ,3,6&% .,%
;,<0:B.-C% 2&234'-G% &2;0:B@09,.&4% 94<083.0234D% '0?43% >=3B% .4% 924J1,% 0;<,91,.0G% 3(6(% 5,63%
2,'0J0% .,E0?14.&8% ;,<0:8% 9% 2:09,<4% Q9% -2:09&8E% 209<4'4..0D% 9=I&2:&34:B.0D% >,@=R% 2901&3
4J0%\.3<0;&C%6 .-:C.
!0:014?.=D%.,-I.0-34E.&I426&D%9423.&6%TUVV-51038
/0% -6,@,..='% ;<&I&.,'% 9% <,>034% <,22'03<4.= &.50<',7&0..,8% \.3<0;&8% ;0% F:01-%
^4..0.-% [6] &% «\9<&23&I426,8» \.3<0;&8G% <460'4.109,..,8% 23,.1,<30'% NIST [10]. Y3:&I&4%
&140:0J&D% '43<&6% 20230&3% 9% ;<41;0:0?4.&8EG% &2;0:B@-4'=E% ;<&% &E% 0>02.09,.&&: ^4..0.%
;<41;0:0?&:G% I30% ;,<0:&% J4.4<&<-C328 2:-I,D.='% 1,3I&60', 9% 106-'4.34 NIST ;0:,J,4328G%
I30 ;,<0:B%9=>&<,4328 I4:09460'(
N3,6G% 9% 6,I42394% 02.09.0D%'43<&6&% '=% &2;0:B@-4'% ;0.83&4% &.50<',7&0..0D% \.3<0;&&%
;0%^4..0.-S
+(), ) = -./0 |), | = -./0 |)|* = 1 # -./0 |)| = 1
2*|%|
2*0
,
J14S%|)| - '0A.023B%,:5,9&3,, n - 1:&.,%;,<0:8.
!43<&6,%;06,@=9,43G%I4'%2:-I,D.44 .,>0<%2&'90:09G%34'%.,14?.44%;,<0:B%&%34'%2:0?.44%
4J0% @,;0'.&3B(% `C>=4% ;0;=36&% 214:,3B% ;,<0:B% @,;0'&.,CA&'28% ;<&901&3% 6% 2.&?4.&C%
\.3<0;&&%&%;<4126,@-4'023&%;,<0:8(
U0J:,2.0% '43<&64% '0?.0% ;06,@,3BG% I30 ;,<0:BG% .,;<&'4<, 202308A&D% &@% V% 7&5<G%
;<,63&I426& \69&9,:4.34.% ;,<0:CG% 202308A4'-% &@% 5 :,3&.26&E% 2&'90:09 01.0J0% <4J&23<,%
Q2'(3,>:(aR.
:(3G10(+M
/<&'4<=%\.3<0;&D%;,<0:4DG%>&3
b:5,9&3\c:&.,
ab..z
1234567890
ab..zAB..Z123467890
ab..zAB..Z1,>((8b+((da23467890
5
23.5
16.6
29.7
35
W460'4.1,7&8' NIST '0?.0% 20;023,9&3B
6
28.2
19.9
35.7
41.9
2:41-CA-C
7
32.9
23.2
41.6
48.9
8
37.6
26.5
47.6
55.9
50<'-:-% \.3<0;&&% ;,<0:8G%
20@1,..0J0%I4:09460'%Q,%.4%J4.4<,30<0'%;,<0:4DR:
*
3(), 1) = 4 + 4:570 25 + 406
578 1.5 + 4570; 1 + 6<% ,
59*
59*
59*
J14S%n - 1:&.,% ;,<0:8G%n>1; <% – E,<,634<&23&I426,8% 5-.67&8% .,:&I&8% 9% ;,<0:4% .4,:5,9&3.=E%
2&'90:09%&:&%2&'90:09%9%94<E.4'%<4J&23<4(
$6,@,..,8%50<'-:,G%;<0A4%J090<8G%0@.,I,43G%I30%\.3<0;&8%;4<90J0%2&'90:,%<,9.,%e%>&3,',
\.3<0;&8%2:41-CA&E%24'&%2&'90:09%- ;0%f%>&3,%.,%6,?1=DG%03%g-J0%10%fL-=D 2&'90:%;0%a(h%>&3,%
\.3<0;&&% .,% 2&'90:G% 21-=D% 2&'90: &% 1,:BO4% .4243% 9% 24>4% a% >&3% \.3<0;&&(% Y1.,60G% 42:&%
&2;0:B@-4328% 3,6?4% 94<E.&D% <4J&23<% >-69% &:& .4,:5,9&3.=4% 2&'90:=G% 30% 10>,9:84328% 4Ai% j%
>&309( F%;<&'4<-G 2:0?.=D%;,<0:B%&@%K%2&'90:09%>-143%&'43B%\.3<0;&C%fe%>&3(
#,6&'% 0><,@0'G 2:,>=D% ;,<0:B% 50<',:B.0% '0?43% >=3B 0;<414:i.% 19-'8% '43<&6,'&S
\.3<0;&4D%9 hj%>&3%;0%^4..0.-%&%\.3<0;&4D%9%fe%>&3%20J:,2.0%23,.1,<3-%NIST.
http://sntbul.bmstu.ru/issue/541655.html
C116,D2<58/,$1-23021-/$45.267823$95:/-;$<$12E/5678;F$1,-AF
k,% ;02:41.&4% J01=% 9% <4@-:B3,34% E,64<26&E% ,3,6% >=:&% .401.06<,3.0 260';<0'43&<09,.=
>,@=%;,<0:4D 207&,:B.=E 2434D [8](%),;<&'4<, 9%N.34<.43 9%30%&:&%&.04%9<4'8%>=:&%1023-;.=%
>,@=: black list twitter-2010, twitter-2011, vk-fLLg%&%1<( #,6?4%&@9423.=%>,@=%;,<0:4D%9&<-2.=E%
;<0J<,''% Q.,;<&'4<S% conficker,
morris-worm
&% 1<(RG% 342309,8
>,@,%
rockyou,
>,@,
260';<0'43&<09,..=E%;,<0:4D%hotmail &%1<(
c:8%&22:4109,.&8%>=:,%;<4123,9:4.,%260';<0'43&<09,..,8%>,@,%;,<0:B.0D%@,A&3=%01.0D%
034I42394..0D%207&,:B.0D%243&G%2014<?,A,8%&'8%;0I3=%&%;,<0:B(%P%<4@-:B3,34%0><,>036&%>,@=%
2% ;0'0ABC% &22:4109,34:B260D% ;<0J<,''=% [5] >=:,% ;0:-I4.,% 23,3&23&6,G% ;<4123,9:4..,8% 9%
3,>:(f-4.
:(3G10(+N
W4@-:B3,3=%&22:4109,.&8 ;,<0:B.0D%>,@=
P24J0%&22:41-4'=E%;,<0:4D
_&2:0%;,<0:4D%202308A&E%30:B60%&@%7&5<
_&2:0%;,<0:4D%202308A&E%30:B60%&@%>-69
_&2:0%;,<0:4D%202308A&E%30:B60%&@%>-69%&%7&5<
_&2:0%;,<0:4D%202308A&E%30:B60%&@%<-226&E%>-69
_&2:0%;,<0:4D%202308A&E%&@%,.J:&D26&E%>-69
_&2:0%;,<0:4D%202308A&E%&@%<-226&E%&%,.J:&D26&E%>-69
83524
17382
38684
27458
15562
17632
05490
(20.8%)
(46.3%)
(32.9%)
(18.6%)
(21.1%)
(6.6%)
:(3G10(+O
/<094<6,%.,:&I&8%2:,>0J0%;,<0:8
!4.BO4%K%2&'90:09
U&'90:=%01.0J0%<4J&23<,
U09;,1,43%2%&'4.4'%;0I3=
U09;,1,43%20%2:09,<4'
U014<?&3%34:450.
U:,>=4%;,<0:&%Q\.3<0;&8%'4.BO4%h6 >&3R
30798
58514
00776
03675
07700
67451
(37%)
(70%)
(1%)
(4.4%)
(9.2%)
(80.7%)
:(3G10(+P
#0;-h%<,2;<023<,.i..=E%;,<0:4D 9%W022&&
/,<0:&
123456
123456789
qwerty
111111
1234567890
*.3<0;&8%;0%
^4..0.-%
20
30
28
20
33
*.3<0;&8%;0%
NIST
20
26
14
20
27
!0:014?.=D%.,-I.0-34E.&I426&D%9423.&6%TUVV-51038
*.3<0;&8%2%
-I430'%2:09,<4D
0
0
0
0
0
G;<2D;
a(% N22:4109,.&4% ;06,@,:0G% I30% ;<&% 0;<414:4.&&% 3<4>09,.&D% 6% 230D6023&% ;,<0:B.0D%
@,A&3=% 74:4200><,@.0% &2;0:B@09,3B% .4% 94<>,:B.=4% 0;&2,.&8G% ,% \.3<0;&D.=4% '43<&6&(% #,6&4%
;,<0:B.=4% '43<&6&% >0:BO4% -I&3=9,C3% 230D6023B% 2&234'% ,-34.3&5&6,7&&% 6 ,3,6,'% .,% ;01>0<%
;,<0:4D &%&E%-10>.44%&2;0:B@09,3B%;<&%94<&5&6,7&&%>4@0;,2.023&%2&234'(
2. l2:&% 2<,9.&3B% <4@-:B3,3=% &22:4109,.&8% 2% 0>A41023-;.0D% <43<02;463&9.0D%
23,3&23&60D [4, 9]G%30%'0?.0%214:,3B%9=901=G%I30%;<023=4%;,<0:&%;<,63&I426&%.4%&@'4.&:&2BG%
'01.='&% ;,<0:8'&% 24DI,2% 89:8C328% 20309=4% 34:450.=G% .,>:C1,4328% % .4@.,I&34:B.,8%
34.14.7&8%6%-2&:4.&C%;,<0:B.0D%@,A&3= >:,J01,<8%.09=' ;,<0:B.=' ;0:&3&6,' &.34<54D209
207&,:B.=E%2434D.
H4/120$6/-,.5-I.;
1. +4:4.60% b(% /,<0:&S% 230D6023BG% ;0:&3&6,% .,@.,I4.&8% &% ,-1&3 mm% k,A&3,% &.50<',7&&(%
N.2,D1(%fLLg(%n%a(%U( 61-64.
2. "-5,.% F(o(G% )090281:=D% P(b(G% *14:B% c(b(% Y74.6,% 230D6023&% ;,<0:B.=E% 5<,@ 6%
'4301,'%;01>0<,%mm%Y36<=304%0><,@09,.&4(%fLaa(%nf(%afV-apL%2(
3. k,<6-'09,% W()(% N22:4109,.&4% 60:&I42394..=E% E,<,634<&23&6% 2&234'=% ;,<0:B.0D%
@,A&3=%&.50<',7&&%mm%U>0<.&6%.,-I.=E%3<-109%)"#$(%fLaL(%n%fQjLR(%C.83-88.
4. l93449%c(%b.,:&@%;<0>:4'%;,<0:B.0D%@,A&3=%9%<022&D26&E%60';,.&8E // kbY%Z/0@&3&9%
#46.0:01?&@». 2009. pp%2(
5. !,<609%"(b(%F%90;<02-%0>%0;<414:4.&&%230D6023&%;,<0:B.=E%2&234' mm%U>0<.&6%3<-109%
#<43B4D% 924<022&D260D% )#F% Z+4@0;,2.=4% &.50<',7&0..=4% 34E.0:0J&&[% m% ;01(% W41(%
P(b(!,39449,(%!S%)NN%W`%!"#$%&'()(*(+,-',.,(%fLaf(%U(21-23.
6. !4301=% 074.6&% .42003943239&8% 2<41239% @,A&3=% &.50<',7&&% m% b(U( !,<609G%
P(`(q&<:09G%b(P(+,<,>,.09(%!(S%W,1&0%&%298@BG%fLaf(%agf%2(
7. Y2.09=% &.50<',7&0..0D% >4@0;,2.023&S% $I4>.04% ;020>&4% m% Y(b(b6-:09G% c()(+,1,.&.G%
l(N(r-6G%)(P(!4194149G%/(!(F9,209G%N(N(#<0&76&D(%!(S%N@1-90%!"#$%&'(%).*. +,-',.,, 2008.
161 2.
8. Bonneau J. Guessing human-chosen secrets // Technical Report UCAM-CL-TR-819. 2012.
161 p.
9. Burnett M. Perfect Password: Selection, Protection, Authentication. Syngress Publishing,
2006.194 p.
10. Burr W.E. and etc. Electronic Authentication Guideline // NIST Special Publication 800-631. 2011. 110 p.
http://sntbul.bmstu.ru/issue/541655.html
11. Information Assurance Implementation // Department of Defense Instruction 8500.2. 2003.
102 p.
12. PCI DSS Requirements and Security Assessment Procedures. Version 2.0. PCI Security
Standards Council LLC. 2010. 75 p.
!0:014?.=D%.,-I.0-34E.&I426&D%9423.&6%TUVV-51038