What is a dictionary attack?
In order to not to transfer passwords over the network as clear text a challenge/response protocol is often used. With this protocol the authentication server sends a challenge to the client. Based on the challenge and the password entered by the user the client calculates a response and sends this back to the authentication server. The authentication server performs the same operation as the client and compares the two responses. If the responses match the user is authenticated. The algorithm used to calculate the response is a one-way-hash function, such as MD5 or SHA1. A property of a one-way-hash function is that it is not possibly to reverse the operation and calculate the password even if the challenge and response is known. The challenge/response method is, however, vulnerable to dictionary attacks. Assume that the user has chosen a weak password such as “alice”.
