text: CSC-STD-002-85 DEPARTMENT OF DEFENSE PASSWORD MANAGEMENT GUIDELINE Approved for public release; distribution unlimited. 12 April 1985 DEPARTMENT OF DEFENSE COMPUTER SECURITY CENTER Fort George G. Meade, Maryland 20755 CSC-STD-002-85 Library No. S-226,994 FOREWORD This publication, "Department of Defense Password management Guideline," is being issued by the DoD Computer Security Center (DoDCSC) under the authority of and in accordance with DoD Directive 5215.1, "Computer Security Evaluation Center." The guidelines described in this document provide a set of good practices elated to the use of password-based user authentication mechanisms in automatic data processing systems employed for processing classified and other sensitive information. Point of contact concerning this publication is the Office of Standards and Products, Attention: Chief, Computer Security Standards. Robert L. Brotman 12 April 1985 Director DoD Computer Security Center ACKNOWLEDGMENTS Special recognition is extended to Sheila L. Brand, DoD Computer Security Center (DoDCSC), and Jeffrey D. Makey, formerly DoDCSC, as principal authors of this publication. Acknowledgment is also given for the contributions of: Daniel J. Edwards, Mary E. Flaherty, Steven J. Padilla, DoDCSC, John J. Stasak III, Gregory L. Wessel and Bernard Peters, Department of Defense, Col. Roger R. Schell, formerly DoDCSC, and James P. Anderson, James P. Anderson & Co, who gave generously of their time and expertise in the formulation and review of this document. ii CONTENTS FOREWORD..................................................... i ACKNOWLEDGMENTS.............................................. ii CONTENTS......................................................iii INTRODUCTION................................................. 1 1.0 SCOPE...........................................................1 2.0 CONTROL OBJECTIVES..................................... ....2 3.0 DEFINTIONS............................................... 3 4.0 GUIDELINES.............................................. 4 4.1 SSO Responsibilities.................................. 4 4.1.1 Initial System Passwords............... 4 4.1.2 Initial Password Assignment............... 4 4.1.3 Password Change Authorization............. 6 4.1.4 Group IDs................................ 6 4.1.5 User ID Revalidation....................... 6 4.2 User Responsibilities.............................. 6 4.2.1 Security Awareness........................ 6 4.2.2 Changing Passwords........................ 6 4.2.3 Log into a Connected System.................. 8 4.2.4 Remembering Passwords.................... 8 4.3 Authentication Mechanism Functionality............ 9 4.3.1 Internal Storage of Passwords ............. 9 4.3.2 Entry...................................... 9 4.3.3 Transmission............................... 10 4.3.4 Login Attempt Rate......................... 10 4.3.5 Auditing.................................... 10 4.4 Password Protection.............................. 11 4.4.1 Single Guess Probability.................. 11 4.4.2 Password Distribution ...................... 11 APPENDIX A: Password Generation Algorithm................... 13 APPENDIX B: Password Encryption Algorithm................... 13 APPENDIX C: Determining Password Length..................... 17 iii APPENDIX D: Protection Basis for Passwords.............. 23 APPENDIX E: Features for Use in Very Sensitive Applications 25 APPENDIX F: On the Probability of Guessing a Password..... 27 REFERENCES.................................................. 31 iv INTRODUCTION In August 1983, the DoD Computer Security Center published CSC-STD-001-83, Department of Defense Trusted Computer System Evaluation Criteria. That publication defines and describes feature and assurance requirements for six hierarchical classes of enhanced security protection for computer systems that are to be used for processing classified or other sensitive information. A major requirement common to all six classes is accountability: "Individual accountability is the key to securing and controlling any system that processes information on behalf of individuals or groups of individuals. A number of requirements must be met in order to satisfy this objective. "The first requirement is for individual user identification. Second, there is a need for authentication. Without authentication, user identification has no credibility. Without a credible identity (no) security policies can be properly invoked because there is no assurance that proper authorizations can be made." (2) This guideline has been developed `to assist in providing that much needed credibility of user identity by presenting a set of good practices related to the design, implementation and use of password-based user authentication mechanisms. It is intended that features and practices described in this guideline be incorporated into DoD automatic data processing (ADP) systems used for processing classified or other sensitive information. 1.0 SCOPE The security provided by a password system depends on the passwords being kept secret at all times. Thus, a password is vulnerable to compromise whenever it is used, stored, or even known. In a password-based authentication mechanism implemented on an ADP system, passwords are vulnerable to compromise due to five essential aspects of the password system: 1) a password must be initially assigned to a user when enrolled on the ADP system; 2) a user's password must be changed periodically; 3) the ADP system must maintain a "password database"; 4) users must remember their passwords; and 5) users must enter their passwords into the ADP system' at authentication time. This guideline prescribes steps to be taken to minimize the vulnerability of passwords in each of these circumstances. Specific areas addressed in this guideline include the responsibilities of the system security officer and of users, the functionality of the authentication mechanism, and password generation. The major features advocated in this guideline are: * Users should be able to change their own passwords. * Passwords should be machine-generated rather than user-created. * Certain audit reports (e.g., date and time of last login) should be provided by the system directly to the user. For certain sensitive applications such as Command and Control Systems, pertinent DoD directives should be referenced in order to assess the need for additional identification and authentication features. 2.0 CONTROL OBJECTIVES The CSC-STD-001-83 gives the following as the Accountability Control Objective: "Systems that are used to process or handle classified or other sensitive information must assure individual accountability whenever either a mandatory or discretionary security policy is invoked. Furthermore, to assure accountability, the capability must exist for an authorized and competent agent to access and evaluate accountability information by a secure means, within a reasonable amount of time, and without undue difficulty."(2) In order to attain the individual accountability required, it is necessary for the ADP system to be able to uniquely identify each person who uses it. In many cases, a password scheme will be used to achieve this. The Accountability Control Objective, applied to password systems, leads to the following control objectives for password systems. * Personal Identification Password systems used to control access to ADP systems that process or handle classified or other sensitive information must assure the capability to uniquely identify each individual user of the system. * Authentication Password systems used to control access to ADP systems that process or handle classified or other sensitive information must assure unequivocal authentication of the user's claimed identity. * Password Privacy Password systems must assure, to the extent possible, protection of the password database consistent with protection afforded the classified or other sensitive information processed or handled by the ADP system in which the password systems operate. * Auditing Password systems used to control access to ADP systems that process or handle classified or other sensitive information must be able to assist in the detection of password compromise. 3.0 DEFINITIONS * Access Port A logical or physical identifier that a computer uses to distinguish different terminal input/output data streams. * Expired Password - A password that must be changed by the user before login may be completed. * Password - A character string used to authenticate an identity. Knowledge of the password that is associated with a user ID is considered proof of authorization to use the capabilities associated with that user ID. * Password System - A part of an ADP system that is used to authenticate a user's identity. Assurance of unequivocal identification is based on the user's ability to enter a private password that no one else should know. * System Security Officer (SSO) - The person responsible for the security of an ADP system. The SSO is authorized to act in the "security administrator" role defined in CSC-STD-001-83. Functions that the SSO is expected to perform include: auditing and changing security characteristics of a user. * Trusted Identification Forwarding - An identification method used in networks where the sending host can verify that an authorized user on its system is attempting a connection to another host. The sending host transmits the required user authentication information to the receiving host. The receiving host can then verify that the user is validated for access to its system. This operation may be transparent to the user. * User ID - A unique symbol or character string that is used by an ADP system to uniquely identify a user. The security provided by a password system should not rely on secrecy of the user's ID. 4 4.0 GUIDELINES In the remainder of this document, guidelines for good practice are presented in bold print, while amplifications, examples, and rationale are presented in normal print. The guidelines are given with two degrees of emphasis. Those that are most important to the security of a password system are presented with such wording as "The SSO should ..." (the word "should" is the key), while less critical functions are presented with such wording as "It is recommended that." ("recommended" is the key). Because it is anticipated that diverse user communities will adopt this guideline, all recommendations are presented in general rather than specific terminology, divorced from vendor-specific hardware or system software. Where features require the setting of a specific value (e.g., password maximum lifetime), it is suggested that these be designed as parametric settings leaving the determination of exact values to local security management who understand the particular security requirements of their user environment. It is recommended that, whenever possible, the mechanisms discussed in this guide be automated. Automation will result in a minimal burden on the system administration and on the users, and thus in greater effectiveness of the mechanisms by eliminating situations where passwords might be exposed to people. 4.1 550 Responsibilities 4.1.1 Initial System Passwords Many ADP systems come from the vendor with a few standard user IDs (e.g., SYSTEM, TEST, MASTER, etc.) already enrolled in the system. The System Security Officer (SSO) should change the passwords for all standard user IDs before allowing the general user population to access the system. This can be easily assured if the standard user IDs are initially identified by the system as having "expired" passwords. (See section 18.104.22.168 for discussion of expired passwords.) 4.1.2 Initial Password Assignment The SSO is responsible for generating and assigning the initial password for each user ID. The user must then be informed of this password. In some areas, it may be necessary to prevent exposure of the password to the SSO. In other cases, the user can easily nullify this exposure. 220.127.116.11 Preventing Exposure There are methods that can be implemented to prevent exposure of a password to the SSO after it has been generated. One technique is to print the user's password on a sealed multipart form in such a way that it is not visible on the top page of the form. The SSO would then protect the sealed password appropriately until it could be delivered to the user. In this case, the password is generated randomly by the ADP system and is not known by the SSO. 5 The password should be seated so it is not visible and cannot be made visible without breaking the seal. Delivery of the password in this manner could require several days. Another method of preventing exposure is to have the user present at password generation. The SSO must initiate the procedure and the user must shield the generated password and then remove or erase it from the display. This method cannot be used when user terminals are at remote locations. It is recommended that a technique comparable to one of the above be used to prevent exposing a user's initial password to the SSO. Whatever method is used to distribute passwords, the SSO must receive an acknowledgment of receipt of the password within a specified time period. 188.8.131.52 Nullifying Exposure When a user's initial password must be exposed to the SSO, this exposure may be nullified by having the user immediately change the password by the normal procedure. (Presumably, this change procedure does not expose the new password to the SSO.) When a user's initial password is not protected from exposure to the SSO, the user ID should be identified by the system as having an "expired password" which will require the user to change the password by the usual procedure (see section 184.108.40.206) before receiving authorization to access the system. 188.8.131.52 Classification Assignment Where the password must be classified, the initial classification assignment should be entered by the SSO to designate the highest security level that may be associated with each user's initial password and its successors. 4. 13 Password Change Authorization Occasionally, a user will forget the password or the SSO may determine that a user s password may have been compromised. To be able to correct these problems, it is recommended that the SSO be permitted to change the password of any user by generating a new one. The SSO should not have to know the user's password in order to do this, but should follow the same rules for distributing the new password that apply to initial password assignment (see section 4.1.2). Positive identification of the user by the SSO is required when a forgotten password must be replaced. 6 4. 1.4 Group IDs Throughout the lifetime of an ADP system, each user ID should be assigned to only one person. In other words, no two people may ever have the same user ID at the same time, or even at different times. It should be considered a security violation when two or more people know the password for a user ID (except in the case when the SSO is the other person and the user ID is identified by the system as having an "expired password">. Note that there is no intention of prohibiting alternate forms of user identification (e.g., group IDs,functional titles) for non-authentication purposes (e.g., data access control, mail). If alternate IDs are used, they must be based on user IDs. 4.1.5 User ID Revalidation The SSO should be responsible for the development of a procedure whereby prompt notification is given to the SSO when a user ID and password must be removed from the ADP system (e.g., when an employee leaves the sponsoring organization>. In addition, all user IDs should be revalidated periodically, and information such as sponsor and means of off-line contact (e.g., phone number,mailing address) updated as necessary. It is recommended that this revalidation be done at least once per year. 4.2 User Responsibilities 4.2.1 Security Awareness Users should understand their responsibility to keep passwords private and to report changes in their user status, suspected security violations, etc. To assure security awareness among the user population, it is recommended that each user be required to sign a statement to acknowledge understanding these responsibilities. 4.2.2 Changing Passwords The simplest way to recover from the compromise of a password is to change it. Therefore, passwords should be changed on a periodic basis to counter the possibility of undetected password compromise. They should be changed often enough so that there is an acceptably low probability of compromise during a password's lifetime. To avoid needless exposure of users' passwords to the SSO, users should be able to change their passwords without intervention by the SSO. 126.96.36.199 Password Lifetime The most obvious threat to the security provided by a password system is from the compromise of passwords. The greater the length of time during which a password is used for authentication purposes,the more opportunities there are for exposing it. In a useful password system, the probability of compromise of a password increases during its lifetime. For a period of time, this probability could be considered 7 acceptably low while after a longer period of time, it would be considered unacceptably high. At this latter point, use of the password should be considered suspect rather than a reliable proof of identity. By appropriately limiting the length of time (called the password lifetime) during which a password can be used,the vulnerability of the password can remain acceptable. There should be a maximum lifetime for all passwords. To protect against unknown threats, it is recommended that the maximum lifetime of a password be no greater than 1 year. The presence of known threats may indicate a need for a shorter maximum lifetime. Also, depending on the size of the password space and on how fast a penetrator can execute a login attempt, it may be necessary to change passwords even more frequently. See Appendix C for a discussion of the relationship between password lifetime, password space and the guess rate. A password should be invalidated at the end of its maximum lifetime. It is recommended that, at a predetermined period of time prior to the expiration of a password's lifetime, the user ID it is associated with be notified by the system as having an "expired" password. A user who logs in with an ID having an expired password should be required to change the password for that user ID before further access to the system is permitted. If a password is not changed before the end of its maximum lifetime, it is recommended that the user ID it is associated with be identified by the system as "locked." No login should be permitted to a locked user ID, but the SSO should be able to unlock the user ID by changing the password for that user ID, following the same rules that apply to initial password entry (see section 4.1.2). After a password has been changed, the lifetime period for the password should be reset to the maximum value established by the system. 184.108.40.206 Change Authorization To be consistent with the Password Privacy control objective, users (other than the SSO) should be permitted to change only their own passwords. To ensure this, it is recommended that the user enter the old password and the user ID/password combination be validated as part of the password changing procedure. 18.104.22.168 Change Procedure Changing a password in a secure manner involves several steps. The following procedure is recommended: The procedure should be invoked at the user's request or when a user logs in with an expired password. If the change is necessary due to an expired password, the user should be so informed. The user should be presented with a brief summary of the major steps in changing a password, including a caution that the user should ensure that no one else is watching what the user is doing. Except 8 when the change procedure is part of the login procedure (e.g., logging in with an expired password>, the user's current password should be entered to re-authenticate identity. The change procedure should display a new password for the user. The new password should be different from the old one and should be generated by angenerated by any algorithm that satisfies the specifications in Appendix A. The user should then enter the new password twice so the procedure can verify that the user can consistently enter the password correctly. The new password should be obliterated by techniques such as overprinting or terminal screen erasing. If the two entered passwords are identical to the generated password, the password data base should be updated (i.e., the old password deleted or invalidated andthe new password associated with the user ID) and a message to this effect should be displayed. Failure by the user to correctly enter the current password or the generated password should result in a useful error message to the user and in the change procedure being aborted without changing the password. When the attempt to change an expired password is not successful, the password should be retained as expired and the user given the option to again change the password or logout. An audit record should be generated that indicates whether or not the change was successful. 4.2.3 Login to a Connected System Users should be required to authenticate their identities at "login" time by supplying their password along with their user ID. It is recommended that some form of trusted identification forwarding be used between hosts when users connect to other ADP systems through a network. When trusted identification forwarding is not used, a remote host should require the user's ID and password when logging in through a network connection. Note that user IDs on different hosts for the same user may be different, and that corresponding machine-generated passwords almost certainly will be different. Note also that a password required by a remote host is vulnerable to compromise by the local host or intermediate hosts. 4.2.4 Remembering Passwords Since users must supply their passwords to the ADP system at authentication time, it follows that they must know what their passwords are. It is recommended that users memorize their passwords and not write them on any medium. If passwords must be written,they should be protected in a manner that is consistent with the damage that could be caused by their compromise. See Appendix D for guidance on the protection of passwords. 9 4.3 Authentication Mechanism Functionality 4.3.1 Internal Storage of Passwords It is normally necessary for the ADP system to store internally the user ID for each authorized system user as well as some representation of the password and, when required, the clearance and authorizations that are associated with each user ID. Without some form of access control over this information, it will be possible for unauthorized users to read an-or modify the password database. Unauthorized reading and writing of the password database are a concern. Reading it could result in disclosure of passwords to unauthorized users. Being able to write it could result, for example, in user A changing user B's password so user A could log in under user B's identity. Note that it is necessary for the login process to be able to read the password database and the password changing process to be able to read and write the password database. Stored passwords should be protected by access controls provided by the ADP system, by password encryption, or by both. 18.104.22.168 Use of Access Control Mechanisms Access control mechanisms (e.g., mandatory or discretionary controls as discussed in CSC-STD-001-83) should be used to protect the password data base from unauthorized modification and disclosure. 126.96.36.199 Use of Encryption Encryption of stored passwords should be used whenever the access control mechanisms provided by the ADP system are not adequate to prevent exposure of the stored passwords. It is recommended that password encryption be used even when other access controls are considered adequate, as this helps protect against possible exposure when access controls are bypassed (e.g., system dumps). When encryption is used to protect stored passwords, it is recommended that the algorithm meet the specifications in Appendix B. It is recommended that encryption be done immediately after entry, that the memory containing the plaintext password be erased immediately after encryption, and that only the encrypted password be used in comparisons. There is no need to be able to decrypt passwords. Comparisons can be made by encrypting the password entered at login and comparing the encrypted form with the encrypted password stored in the password database. 4.3.2 Entry Encryption of stored passwords should be used whenever the access control mechanisms provided by the ADP system are not adequate to prevent exposure of the stored passwords. It is recommended that password encryption be used even when other access controls are considered adequate, as this helps protect against possible exposure when access controls are bypassed (e.g., system dumps). When encryption is used to protect stored passwords, it is recommended that the algorithm meet the specifications in Appendix B. It is recommended that encryption be done immediately after entry, that the memory containing the plaintext password be erased immediately after encryption, and that only the encrypted password be used in comparisons. There is no need to be able to decrypt passwords. Comparisons can be made by encrypting the password entered at login and comparing the encrypted form with the encrypted password stored in the password database. Passwords should be entered after providing a user ID to the system. If the entry is correct, the system should then display the date and time of the user's last login. It is recommended that the system not echo passwords that users type in. When the system cannot prevent a password from being 10 echoed (e.g., in a half-duplex connection), it is recommended that a random overprint mask be printed before or after the password is entered, as appropriate, to conceal the typed password. The complete password as entered by the user should be an exact match, character for character, with the user's current password. 4.3.3 Transmission During transmission of a password from a user's terminal to the computer in which the authentication is done, passwords should be protected in a manner that is consistent with the damage that could be caused by their compromise. Since passwords are no more sensitive than the data they provide access to, there is generally no reasonto protect them, during transmission, to any greater degree (e.g.,encryption) than regular data is protected. See Appendix D for guidanceon the protection of passwords. 4.3.4 Login Attempt Rate By controlling the rate at which login attempts can be made (where each attempt constitutes a guess of a password), the number of guesses a penetrator can make during a password's lifetime is limited to a known upper bound. To control attacks where a penetrator attempts many logins through a single access port, the password guess rate should be controlled on a per-access port basis. That is, each access port should be individually controlled to limit the rate at which login attempts can be made at each port. When a penetrator can easily switch among multiple access ports, it is recommended that the password guess rate also be controlled on a per-user ID basis. It is recommended that maximum login attempt rates fall within the range of one per second to one per minute. This range provides reasonable user-friendliness without permitting so many login attempts that an extremely large password space or an extremely short password lifetime is necessary. See Appendix C for a discussion of the relationship between the guess rate, password lifetime, and password space. Note that it is not intended that login be an inherently slow procedure, for there is no reason to delay a successful login. However, in the event of an unsuccessful login attempt, it is quite reasonable to use an internal timer to enforce the desired delay before permitting the next login attempt. The user should not be able to bypass this procedure. 4.3.5 Auditing 220.127.116.11 Audit Trails The system should be able to create an audit trail of password usage and changes. Such an audit trail should not contain actual passwords or character strings that were incorrectly given as passwords, since this could expose the password of a legitimate user who mistyped his user ID or password. Auditableevents should include: successful login, unsuccessful login 11 attempts, use of the password changing procedure, and the locking of a user ID due to its password reaching the end of its lifetime. For each recorded event, the audit record should include: date and time of the event, type of event, offered user ID for unsuccessful logins or actual user ID for other events, and origin of the event (e.g., terminal or access port 11'). Audit records of password changes should also indicate whether or not the change was successful. 184.108.40.206 Real-time Notification to System Personnel It is recommended that each accumulation of 5 consecutiveunsuccessful login attempts from a single access port or against a single user ID results in immediate notification of the event to the ADP system operator or the SSO. While there is no requirement for the SSO or operator to take any action upon receiving the notification, frequent notifications may indicate that a penetration attempt is in progress and may warrant investigation and possible corrective action. 18.104.22.168 Notification to the User Upon successful login, the user should be notified of: * The date and time of user's last login; * The location of the user (as can best be determined) at last login; and * Each unsuccessful login attempt to this user ID since the last successful login. This provides a means for the user to determine if someone else is using or attempting to guess this user ID and password. 4.4 Password Protection 4.4.1 Single Guess Probability The probability that any single attempt at guessing a password will be successful is one of the most critical factors in a password system. This probability depends on the size of the password space and the statistical distribution within that space of passwords that are actually used. Since many user-created passwords are particularly easy to guess all passwords should be machine generated using an algorithm that meets the specifications in Appendix A. 4.4.2 Password Distribution During distribution to the user. passwords should be protected to the same degree as the information to which they provide access.machine-generated passwords should be displayed on the user's terminal at time of change, along with appropriate cautions to the 12 user to protect the password. At the completion of the change procedure, it is recommended that displayed passwords be erased or overstruck, as appropriate for the terminal type. Passwords changed by the 550 should be distributed in a manner that is consistent with the damage that could be caused by their compromise. See Appendix D for guidance on the protection of passwords. 13 APPENDIX A Password Generation Algorithm This appendix describes the requirements to be met by an acceptable password generation algorithm. The issues involved relate to the specifications for password space, random seed generation, pseudo-random number generation and "user- friendly" passwords. A.1 Password Space The size of the password space is a function of the size of the alphabet and the number of characters from that alphabet that are used to create passwords. (The maximum size of the password space can be expressed as 5 A where 5 is the maximum password space, A is the alphabet size and M is the password length.) To determine the minimum size of the password space needed to satisfy the security requirements for an operational environment, equation [3] in Appendix C can be used. The password generation algorithm selected should be able to generate at least that number of passwords. In addition, the generated passwords should be, at a minimum, 6 characters in length. A.2 Random Seeds When a pseudo-random number generator is used in a password generation algorithm, it should accept as input random data that would provide output which has a high degree of unpredictability. This random data (seed) can be derived from a number of available parameters such as a system clock, system registers, date, time, etc. The parameters should be selected to ensure that the number of unique seeds that can be generated from these inputs should be at least equal to the minimum number of passwords that must be generated. When passwords are used to protect classified information, the seed generator should be approved by the DoD Computer Security Center. A.3 Pseudo-Random Number Generator Using a random seed as input, the pseudo-random number generator that drives a password generation algorithm should have the property that each bit in the pseudo-random number that it generates is a complex function of all the bits in the seed. The Federal Data Encryption Standard (DES), as specified in FIPS 46, (9) is an example of a pseudo-random number generator with this property. If DES is used, it is suggested that the 64-bit Output Feedback (OFB) mode be used as specified in FIPS 81 (10). In this case, the seed used as input could consist of: * An initialization vector * A cryptographic key * Plaintext 14 Factors that can be used as input to these parameters are: For the initialization vector: * System clock * System ID * User ID -Date and time For the cryptographic key: * System interrupt registers * System status registers * System counters The plain text can be an external randomly generated 64-bit value (8 characters input by the 550). The resulting pseudo-random number that is output will be the 64 bits of cipher text generated in the 64-bit OFB mode. The password generation algorithm can either format this pseudo-random number into a password or use it as an index (or indices) into a table and use the contents from this table to form a password or a passphrase. A.4 "User-Friendly" Passwords To assist users in remembering their passwords, the password generation algorithm should generate passwords or passphrases that are "easy" to remember. Passwords formed by randomly choosing characters are generally difficult to remember. Passwords that are pronounceable are often easy to remember, as are passphrases that are formed by concatenating real words into a phrase or sentence. 15 APPENDIX B Password Encryption Algorithm Password encryption is advocated as a password protection measure. The algorithm selected for this would be determined by the system environment. Some environments may require that a classified encryption algorithm be used, while for other environments an unclassified algorithm would be required. B.1 Encryption Algorithm A conventional or public key cryptographic algorithm which is configured as a "one-way" encryption algorithm may be used for password encryption, but whatever algorithm is used, the protection the encryption algorithm provides should rely on its complexity. If there is a key that can be used with the algorithm to decrypt passwords, that key should not be stored in the ADP system. B.2 Assurance for Unique Encrypted Passwords If a password encryption system depends only on the password and other fixed information, there is a possibility that two different users will have identical encrypted passwords. A user who discovers another user with an identical encrypted password will then know that the same password will work for both user IDs even if they don't have identical plaintext passwords. To minimize this possibility, it is recommended that the encryption algorithm use the ADP system name (in network environments) and the user's ID as factors in the encryption. (This can be easily accomplished by concatenating the system ID, user ID and password, and then applying the encryption algorithm to the resulting string.) 16 APPENDIX C Determining Password Length The security afforded by passwords is determined by the probability that a password can be guessed during its lifetime. The smaller that probability, the greater the security provided by the password. All else being equal, the longer the password, the greater the security it provides. This appendix reviews the mathematics involved in establishing how long a password should be. The basic parameters that affect the length of the password needed to provide a given degree of security are: L = maximum lifetime that a password can be used to log into the system. P = probability that a password can be guessed within its lifetime, assuming continuous guesses for this period. R = number of guesses per unit of time that it is possible to make. S = password space, i.e., the total number of unique passwords that the password generation algorithm can generate. C.1 Relationship Considering only the cases where S is greater than L x R and therefore P is less than 1, the relationship between these parameters is expressed by the equation: P = L x R [I] A detailed explanation of the derivation of this basic equation is given in Appendix F. C.2 Guess Rate Several factors contribute to the rate at which attempts can be made to gain access to the data on a system when a valid password is not known. First and foremost is the protection given to the password data base itself. If the password data base is unprotected (i.e., can be read by anyone as ordinary data), then "guessing" may not be required. If the password data base can be read. but the passwords are encrypted (see Appendix B), a very high guess rate may be possible by using a computer to try a dictionary of possible passwords to see if ciphertext can be generated that is the same as one in the password data base. A similar situation frequently occurs where only passwords are used to protect files. 16 Finally, if the password data base has effective access controls and the login procedure cannot be bypassed, the guess rate can be controlled by setting limits on the number of login or other attempts that can be made before terminating the connection or process. C.3 Password Lifetime All other things being equal, the shorter the lifetime of a password, the fewer the number of guesses that can be made and thus the greater the degree of password security. As stated in 126.96.36.199, the maximum password lifetime should not exceed one year. C.4 Password Space Password length and alphabet size are factors in computing the maximum password space requirements. Equation [2] expresses the relationship between S, A, and M where: S = password space A = number of alphabet symbols M = password length S = AM [2] To illustrate: If passwords consisting of 4 digits using an alphabet of 10 digits (e.g., 0-9) are to be generated: S = 104 That is, 10,000 unique 4-digit passwords could be generated. Likewise, to generate random 6-character passwords from an alphabet of 26 characters (e.g., AZ): S = 266 That is 3.089 * 108 unique 6-character passwords could be generated. "User-friendly" passwords (sometimes referred to as passphrases) could be generated by using, for example, 3 symbols from an alphabet (dictionary) of 2000 symbols, where each symbol was a pronounceable word of 4, 5, or 6 characters. Using equation [2] and setting: A = 2000 symbols (words) M = 3 Then S = 20003 That is, 8 * 109 unique passwords could be generated where each password was made up of 3 words taken from a dictionary of 2000 words. 19 C.5 A Procedure for Determining Password Length What is important in using passwords is how long to make the password to resist exhaustive penetration attacks. We can do this by using the following procedure: a. Establish an acceptable probability, P, that a password will be guessed during its lifetime. For example, when used as a login authenticator, the probability may be no more than 1 in 1,000,000. In another case, where very sensitive data is involved, the value for P may be set at 10-20. b. Solve for the size of the password space, 5, with the equation derived from equation [1] S = G [3] P where G L x R c. Determine the length of the password, M, from the equation M = log S [4] log (number of symbols in the "alphabet") M will generally be a real number that must be rounded up or down to the nearest whole number. Examples of calculating many of the values described above are given below. C.6 Worked Examples An example shown here is drawn from a real network case. The problem is to determine the needed password length to reduce to an acceptable level the probability that a password will be guessed during its lifetime. The network to which this is applied supports both a 300-baud and a 1200-baud service. Experiments on the network have determined that it is possible to make about 8.5 guesses per minute on the 300-baud service and 14, guesses per minute on the 1200-baud service. (The reason that the "guess rate' for the 1200-baud service is not 4 times that of the 300-baud service is that the system response time, which is not affected by the improved transmission speed, becomes the limiting factor in how many guesses can be accomplished in a given amount of time.) In this example, the arbitrary value of 10-6 is used for the probability (P) of guessing the password in its lifetime. As we will see below, the password lifetime is not the critical factor here as long as the password is changed at least once per year. The statement of the problem is to find a password length that will resist being guessed with a probability of 1 in 106 in 1 year of continuous guesses. When three parameters in equation [1] are known, the fourth value can be found. To find the password space required by our examples, the following parameters are given: 20 L is set for 6 months and 12 months. P is set for 1 in 1,000,000 (acceptable probability of guessing the password). R is set at 8.5 guesses per minute (guess rate possible with 300-baud service). At 8.5 guesses per minute, the number of guesses per day would be 12,240. Substituting 183 days for 6 months then using equation [3], S = G 183x12240 - 2.23992x1012 passwords P -000001 The 12-month value is twice that of the 6-month case. With this data, and using equation [4], we can determine the length of the passwords as a function of the size of the alphabet from which they are drawn. We will assume two alphabet sizes: a 26-letter alphabet and a 36-letter-and-number alphabet. M = log (2.23992 x 1012) 8.72 (for 6-month lifetime) log 26 M = log (4.4676x1012) 8.94 (for 12-month lifetime) log 26 M = log (2.23992x1012) 7.93 (for 6-month lifetime) log 36 M = log (4.4676 x 1012) 8.13 (for 12-month lifetime) log 36 Table 1 presents the results. TABLE 1 MAXIMUM Length of Password LIFETIME (months) 26-Character alphabet 36-Character alphabet 6 9 8 (rounded up from 8-72) (rounded up from 7.93) 12 9 8 (rounded up from 8.94) (rounded down from 8.13) 21 C.7 Passphrases A "passphrase" is a concatenation of words drawn from a dictionary. The dictionary is merely the collection of symbols making up the "alphabet" from which the password is generated. As an example, suppose the passphrase is made up of words drawn from a dictionary of 4, 5 and 6 letter words. There are approximately 3,780 4-letter words, 7,500 5-letter words and 12,000 6-letter words in English. The "alphabet size" for generating passphrases is approximately 23,300. We can compute how many words, drawn at random from the dictionary of 23,300 words, are needed to produce a passphrase that will be resistant to exhaustive attack with the probability of 1 x 10-6. We have to solve for 5 as before, and from that, solve for M, the length of the password (i.e., number of alphabet symbols or words). For L = 12 months, 5=4.4676*1012, log S = 12.6500 For L = 6 months, 5=2.2399*1012, log S = 12.3502 Log 23300 4.3669 Using equation (4) we obtain: For L = 12 months M 12.6500 3 (rounded from 2.89) 4.3669 For L = 6 months M 12.3502 3 (rounded from 2.82) 4.3669 Thus, for the passphrase algorithm described, namely selection at random from a dictionary of 23,300 words, only 3 words are needed in a passphrase to obtain the desired resistance to exhaustive enumeration. In using the algorithm, each word of the phrase is drawn independently from the dictionary. This may result in a word appearing more than once in the passphrase. 23 APPENDIX D Protection Basis for Passwords Passwords are used to prevent people who have physical access to an ADP system from gaining access to data belonging to another user. Thus, a password should be protected in a manner that is consistent with the damage that might be caused by its exposure to someone who has the opportunity to use it (i.e., has physical access to the ADP system terminals). Exposure of a password to someone who is physically prevented from attempting to use it is not a threat. D.1 Systems Containing Only Unclassified Information Although an ADP system may process only unclassified information, it still may require that the data be protected from unauthorized use. Although the password is unclassified, the obligation remains that the user protect this password so that only those with a need-to-know can access the data. D.2 Systems Containing Classified Information Passwords that are used in AD P systems that operate in the dedicated or system high security modes (3) should not be classified, but should be protected to the same degree as For Official Use Only information. In this case, there is no need to classify passwords since access to the area in which the system resides is restricted to those with a clearance as high as the highest classification level of the information processed. A person who obtained a password for a system running in dedicated or system high security mode but who did not possess the proper security clearance would be unable to gain physical access to the system and use the password. For systems operating in the multilevel security mode (3), passwords may or may not have to be classified. When the ability to access classified information is based on the physical protection of the terminal rather than on the identity of the user (i.e., when all terminals are single-level devices), passwords should not be classified, but should be protected to the same degree as For Official Use Only information. There is no need to classify passwords that can only be used on single-level terminals, since physical access to single-level terminals is controlled to the level associated with the terminal. When the ability to access classified information is based on the user's identity and is not restricted by the level of the terminal (i.e., multilevel terminals), each password must be classified to the highest level of the information to which it provides access. When multilevel terminals are used, the system determines the user's access authorizations to classified material based on his identity, and authenticates the identity by requiring a password. Thus. the ADP system can protect the information it processes only to the extent that passwords are protected. For example, a user with a Secret clearance can access Secret information. 24 Compromise of that user's password could result in the compromise of Secret information; therefore, the password would be classified Secret. In the case of a system with multilevel terminals, disclosure of a Top Secret user's password to a Secret user would allow the Secret user to login as the Top Secret user and thus gain access to Top Secret information. Disclosure of Top Secret information to someone with only a Secret clearance can cause exceptionally grave damage to the national security. Since disclosure of the Top Secret user's password could lead to this, the password must be classified Top Secret (5). Note that classified passwords must not be used on terminals that are not authorized for data at the level of the password (e.g., a Top Secret password must not be used on a Secret terminal). The presence of both single-level and multilevel terminals on a system may indicate the need for passwords at each security level. At a minimum, an unclassified password should be available for use on terminals that are only authorized for unclassified data. 25 APPENDIX E Features for Use in Very Sensitive Applications The following features can be used to enhance the security provided by a password system. Because they are somewhat "user-unfriendly," they are recommended for environments only when there is a high threat of password compromise. E.1 One-Time Passwords One-time passwords (i.e., those that are changed after each use) are useful when the password is not adequately protected from compromise during login (e.g., the communication line is suspected of being tapped). The difficult part of using one-time passwords is in the distribution of the new passwords. If a one-time password is changed often because of frequent use, the distribution of new one-time passwords becomes a significant point of vulnerability. There are products on the market that generate such passwords through a cryptographic protocol between the destination host and a hand-held device the user can carry. E.2 Failed Login Attempt Limits In some instances, it may be desirable to count the number of unsuccessful login attempts for each user ID and to base password expiration and user ID locking on the actual number of failed attempts. (Changing a password would reset the count for that user ID to zero.) For example, the password could be identified as expired after 100 failed login attempts, and the user ID locked after 500. 27 APPENDIX F On the Probability of Guessing a Password Appendix C discusses the techniques for finding a password length that will resist exhaustive enumeration over the lifetime of the password with a given probability. This appendix derives the probability of guessing a password during its lifetime. As in Appendix C, we use the parameters: L = password lifetime R = guess rate S = size of the password space P = probability of guessing a password during its lifetime The total number of guesses, (G), that can be made during a password's lifetime is: G = R x L [1] At this point, we need to consider the relation of the size of the password space, 5, to G. Clearly, if 5 is so small that one could try all possible passwords before the lifetime of the password expires, the probability of guessing the password is l. As a result, we consider only cases where 5 is greater than G. The probability question then is, "For the case where 5 is greater than G, what is the probability that in G guesses the password will be guessed?" This is the same as asking the question, "What is the probability that in the lifetime of the password, it will be guessed?" The probability sought is: How many ways one can make G guesses (of S objects) P = that include the password How many different ways one can make G guesses of S objects Note that the probability that is appealed to is of the simplest form. It is derived from the definition of probability that the probability of an event is given by the number of ways the event can happen divided by the number of ways an event can happen or fail. We first observe that the total number of ways one can make G guesses of 5 things is given by sCg (the combinatorial notation that means the number of combinations of "s" things taken "g" at a time). (Lower case letters are used with the combinatorial notation in order to make the expressions more readable.) This is determined by: s! g!(s-g)! Thus, if 5 - A B C,D,E, one could make 3 guesses in 5C3 different ways, 5*4*3*2*1/3*2*1*2*1 10. 28 (Enumerating, they are ABC~ABD,ABE,ACD,ACE,ADE,BCD,BCE,BDE~C~~.) The problem of finding the number of guesses of this total that include a specific password, e.g., an "A", is addressed by considering a reduced set without the specific password and asking how many ways one can make G guesses with the reduced set. Then, the total number of ways to make G guesses that include the specified password is the difference between the two values. This is given by: sCg-(s-1)Cg [2] That is, remove the designated password from the set 5, compute the number of ways of making G guesses without the password, then consider the difference between the two values. If we ask in our example how many ways to make 3 guesses that do NOT include a particular password from the set of 5 (say an "A"), this is given by: 4C3 4*3*2*1/3*2*1*1 = 4 Enumerating for the specific case of an "A", they are BCD,BCE,BDE,CDE. The number of ways to make 3 guesses that include the designated element is 10-4 6. Thus, the probability of guessing a designated password in 3 guesses is 6/10 or 6. Simplification: It is indeed fortuitous that there is a theorem in any number of books on Probability Theory that states: nCr (n-1)C(r-1) + (n-1)Cr [3] This may also be expressed as: nCr- (n-1)Cr (n-1)C(r-1) [4] Substituting s for n and g for r we obtain the expression: (s-1)C(g-1) [5] for the number of ways of making G guesses that include a specific password. Then, the probability that a given password will be guessed during the lifetime of that password is given by: P (s-1)C(g-1) [6] sCg 29 Evaluating this expression gives: (s-1)! (s-1)! P = (g-1)!((s-1)-(g1))! = (g-1)1(s-g)! = g!(s-1)! = g s! s! (g-1)!s! s g!(s-g)! g!(s-g)! This derivation of the probability of guessing a password during its lifetime, i.e., P = G [8] is important in that it allows us to derive the size of the password space S = G [9] P given an acceptable probability of not guessing the password during its lifetime. 30 REFERENCES 1. Brown, R. L. Computer System Access Control Using Passwords, 1985 , Aerospace Corporation, 16 January 1984. 2. DoD Computer Security Center. Department of Defense Trusted Computer System Evaluation Criteria, CSC-STD-00183, 15 August 1983. 3. DoD Directive 5200.28, Security Requirements for Automatic Data Processing (ADP) Systems, revised April 1978. 4. Downey, P. J. Multics Security Evaluation: Password and File Encryption Techniques, ESD-TR-74-193, Vol. III, AD-A045279, AFSC Electronic Systems Division, Hanscom AFB, Mass., June 1977. 5. Executive Order 12356, National Security Information, 6 April 1982. 6. Gasser, M. A Random Word Generator for Pronounceable Passwords, MTR-3006, ESD-TR-75-97, AD-A017676, MITRE Corp., Bedford, Mass.,November 1975. 7. Wood, H.M. The Use of Passwords for Controlled Access to Computer Resources, NBS Special Publication 500-9, U.S. Department of Commerce, National Bureau of Standards, May 1977. 8. National Bureau of Standards. Federal Information Processing Standards Publication 112, Password Usage Standard, 30 May 1985. 9. National Bureau of Standards. Federal Information Processing Standards Publication 46, Data Encryption Standards, 15 January 1977. 10. National Bureau of Standards. Federal Information Processing Standards Publication 81, DES Modes of Operation, 2 December 1980.


text:
The Galleries
- Robert E. Petersen Collection
- Ancient Firearms - 1350 to 1700
- Road to American Liberty - 1700 to 1780
- A Prospering New Republic - 1780 to 1860
- A Nation Asunder - 1861 to 1865
- The American West - 1850 to 1900
- Innovation, Oddities and Competition
- Theodore Roosevelt and Elegant Arms - 1880s to 1920s
- World War I and Firearms Innovation
- WWII, Korea, Vietnam and Beyond - 1940 to Present
- For the Fun of It
- Modern Firearms - 1950 to Present
- Hollywood Guns
U.S. Springfield M1 Garand Semi Automatic Rifle
During WW II, Springfield Armory was joined by Winchester in the production of the semi-automatic M1 battle rifle. Winchester ceased production at the end of that war, but Harrington & Richardson and International Harvester made M1's during the Korean War while Springfield concentrated on rebuilding existing rifles. All production of the M1 ended in 1957. This example was made in 1941. SN 422349
John Cantius Garand was born on New Year's Day, 1888 in St. Remi, Quebec, Canada. After spending his early years in Canada, he moved with his family to Connecticut. Showing great mechanical aptitude from an early age, he designed and patented a screw jack at the age of 14; by his nineteenth birthday, Garand was working as a machinist. As his career progressed, he gained experience in tool and gauge making and design. Garand was also an accomplished marksman. On one occasion, it is said that he spent over $100 in a single day at the shooting galleries of Coney Island.
During the First World War, Garand took a job in a micrometer factory in New York City. While employed there, he came up with a design for a machine gun and submitted it to the U.S. government. As a result, he was hired as a designer by the Bureau of Standards, where his work with machine guns continued. Garand's design employed a mechanism in which the primer moved slightly rearward on firing with enough force to unlock the bolt. Army Ordnance officials were sufficiently impressed with the young man's work that in 1919, he was transferred to Springfield Armory at an annual salary of $3,500. With the success of John Browning-designed machine guns, the Army saw no need for a similar arm. Instead, Garand was tasked with developing a semi-automatic rifle based on his machine gun design.
By 1925, Garand had worked out many of the problems facing this new rifle, but a change in the design of the Army's .30-06 cartridge made Garand's primer-activated system unworkable. Undaunted, he re-designed his rifle to be gas-operated. Additional challenges were posed when the Army abandoned the .30-06 in favor of the .276 cartridge; Garand adapted his design to work with the new round, and in 1929, this design was the winner in Army acceptance trials. Instead of entering production, Garand's rifle faced yet another obstacle, as Army Chief of Staff Douglas MacArthur insisted that the .30-06 be retained. Once again, Garand returned to his workshop and changed the design for use with the heavier cartridge. On January 9, 1936, the "U.S. Rifle, Caliber .30 M1" was adopted by the Army as its new battle rifle.
The Marine Corps followed suit in November, 1941, based at least in part on the rifle's favorable performance on Guadalcanal. Garand's original design was not without its share of problems. Most notable among these was a load failure with the seventh cartridge contained in the 8-round en bloc clip, a tendency to eject the clip with one round remaining, and an operating rod malfunction caused by prolonged exposure to rain. All of these were solved through minor improvements prior to the outbreak of the Second World War. Original production M1s utilized a gas-trap actuator. This was changed to a gas-port system in 1940. Eventually, these early production rifles were converted to the new system during normal ordnance maintenance and rebuild cycles, but some did see service in the Philippines during the early days of the war.
Other changes included the use of a compartment in the buttstock for storage of cleaning supplies, and improved sights. M1 variants include the M1C and M1D sniper rifles. Initial production was limited to Springfield Armory, and by the end of the war, nearly three and one-half million M1s had been produced in its shops. By mid-1943, Springfield's output topped 4,000 rifles each day. Winchester Repeating Arms accounted for over 500,000 more. With the conclusion of hostilities, Winchester's M1 production lines were shut down, and Springfield concentrated on rebuilding surviving service rifles.
Production resumed during the Korean War, when nearly one million M1s were manufactured by Springfield Armory, Harrington & Richardson, and International Harvester. Production of the M1 ended in 1957. The United States was the only nation to issue a semi-automatic rifle as a standard infantry arm during the Second World War, and the Garand's firepower proved to be a decisive factor in combat. The M1 proved to be rugged, dependable, and accurate, and it was also easy to strip and maintain in the field. M1s saw service in all theaters of the war and in extreme climates from the deserts of North Africa and the jungles of the Pacific to the frozen forests of Belgium and Germany.
Although initially viewed with suspicion by the soldiers to whom it was issued, the rifle proved itself time and again to be superior to any other infantry long arm up to that time. In fact, General George S. Patton called the M1 ". . . the greatest battle implement ever devised." General Douglas MacArthur added, "The Garand rifle . . . is one of the greatest contributions to our armed forces." Garand received many awards for his rifle, the highest of which came in March, 1944, when he was presented with the Civilian Medal of Honor for "exceptionally meritorious service to his country." He continued his work at Springfield Armory until his retirement in 1953, after 34 years of service.
The M1's successor, the selectable-fire M14, was based on his earlier design. All told, he held fifty-four firearms-related patents, all of which were signed over to the government, with no additional compensation paid to Garand other than his salary. John Garand died in Springfield, Massachusetts in 1974 at the age of 86. - The town of Springfield, Massachusetts, located on the banks of the Connecticut River, was settled in 1636 by emigrants from Roxbury. The town was nearly destroyed during King Philip's War in 1675, but it was quickly rebuilt.
As early as 1776, Continental Army colonel and future Secretary of War Henry Knox recommended the establishment of public laboratories, magazines, arsenals and foundries in secure locations for the production and repair of arms, ammunition, and other ordnance stores. Both George Washington and the Continental Congress concurred with this recommendation, under which an ordnance depot was established at Springfield in 1777. The town's access to raw materials, sources of water power, and transportation, as well as its inland location which provided security against seaborne attack, made Springfield an ideal location.
Over the following year, buildings were rented or erected for use as barracks and storehouses. In addition to ordnance stores, the depot at Springfield also handled other aspects of army supply, including equipment, uniforms, tents, food, and fuel. The end of the War for Independence also brought a decline in military activities at Springfield. In 1794, an Act of Congress directed that national armories be established for the fabrication of small arms. President Washington selected Springfield and Harpers Ferry, which was then located in Virginia, as the sites for these facilities.
In addition to the advantages that contributed to the presence of a Revolutionary War depot in the town, many skilled armory workers were still living nearby. The government acquired nearly 300 acres and constructed a dam to furnish power to the armory complex, as well as shops, offices, and storehouses. The first permanent structure to be constructed on the site was a brick powder magazine, which was torn down in 1842. Additional buildings have been constructed as necessary over the years since. Production of arms at Springfield began in 1795, with 245 muskets manufactured during that year, and approximately 80,000 were turned out before production was discontinued in 1814.
The Model 1795 muskets were the first standardized U.S. martial arms to be produced and were patterned after the French Model 1763 Charleville musket. Harpers Ferry Armory also produced a Model 1795 musket, but these were distinctly different from those manufactured at Springfield. The first known Springfield Armory-marked specimens were manufactured in 1799, and feature dated lockplates which bear an eagle stamp and the word "Springfield." The Model 1816 was first standardized U.S. martial arm to be manufactured at both Springfield and Harpers Ferry. These arms enjoyed the longest production run in U.S. history, lasting until 1844, with nearly 700,000 muskets turned out during this period. Both armories also produced the Model 1842 percussion musket and Model 1855 percussion rifle-musket.
These arms are significant in that the Model 1842 was the last U.S. regulation .69 caliber smoothbore, as well as the first to be made at both armories with completely interchangeable parts, while the Model 1855 rifle-musket was the first rifle-musket to be produced by the United States, the first to be produced in the new regulation .58 caliber, and the last arm to be produced at both government armories. In addition to commonly produced arms, each armory was the sole producer of certain other designs, such as the Model 1855 percussion pistol-carbine and various musketoons and cadet muskets that were produced solely at Springfield, or the Model 1803 flintlock rifle, and the Model 1841 percussion, or "Mississippi" rifles, both of which were produced only at Harpers Ferry.
Model 1861 and 1863 rifle-muskets, which were based on a modification of the earlier Model 1855, were produced in great quantities throughout the Civil War. These were the last muzzle loading, paper cartridge percussion arms to be produced by the U.S. Erskine S. Allin, Springfield's Master Armorer, designed a method for converting many of these into metallic cartridge breech loaders. This conversion consisted of a modification to the breech to permit the installation of a "trap door" breechblock with a self-contained firing pin.
The famous .45-70 government caliber "trap door" Springfield rifles and carbines of the Plains Indian Wars were based on Allin's work, and these accounted for much of the Armory's production during the 1870s and 1880s. Springfield Armory was also involved in improving the state of the art in military rifle design, and toward this end, limited-production long arms including the Ward-Burton, Lee Vertical Action, Hotchkiss, and Chaffee-Reese rifles were manufactured there. These efforts culminated in the 1890s with the Army's adoption of the smokeless powder Krag-Jorgensen bolt-action repeating rifle as its standard longarm. These rifles, as well as carbine versions, were manufactured at the Armory through the turn of the century.
The Spanish-American War proved the superiority of the German-designed Mauser, and the .30-'06 caliber U.S. Model 1903 bolt-action rifle, which was built at Springfield Armory and Rock Island Arsenal under a license from Mauser, replaced the Krag-Jorgensen as the Army's new standard rifle. Over one million were manufactured before production was discontinued in 1941, and many of these, as well as rebuilt or contract model Ô03s, saw action in both World Wars. Prior to the First World War, Springfield also manufactured the M1911 .45 caliber semi-automatic pistol under license from Colt, and throughout this period, Armory workers continued to experiment with, produce, test, and maintain various other ordnance materiel including rifles, pistols, machine guns, and related equipment. During the interwar years, John Garand, a Canadian-born design engineer and Springfield Armory employee, worked on a design for a new gas-operated semi-automatic rifle. After overcoming several problems, both with his designs and with Army brass, the U.S. Rifle .30 caliber M1 was adopted by the Army in 1936.
The Marine Corps followed suit, and during the Second World War, over three and one-half million M1s were produced at Springfield. An additional 500,000 were manufactured by Winchester Repeating Arms Co. This rifle, which General George S. Patton called, "the greatest battle implement ever devised," gave American troops a significant edge over their German and Japanese enemies, most of whom were still equipped with bolt-action arms. After the war, Springfield ceased manufacture of the M1 and turned its efforts to the overhaul and long-term storage of these rifles. The outbreak of war in Korea in 1950 caused a resumption in production at the Armory, as well as by International Harvester and Harrington & Richardson.
The return of peace brought a second and final discontinuation of M1 production. Springfield Armory's continuing efforts at advancing military rifle designs yielded a series of improvements to the M1, culminating in production of the 7.62mm NATO caliber selective-fire M14 rifle, which replaced the Garand in the Army's inventory. In 1968, the Ordnance Department ceased operations at Springfield Armory. The Armory grounds, buildings, and museum, with its extensive arms and accouterments collection, have become Springfield Armory National Historic Site and are now maintained by the National Park Service.

subset: commoncrawl


text:
Steve Scalici is a Certified Financial PlannerTM and Vice President of Treasure Coast Financial. He is co-host of a daily radio show called "God's Money" which can be heard at www.oneplace.com. You can contact Steve at firstname.lastname@example.com or via telephone at 1-800-728-6342. His website is www.tcfin.com
More articles by Steve Scalici
Personal Finance
CBNMoney.com During this time of year, it's very easy for our bodies to overheat. Our bodies produce a tremendous amount of internal heat and we normally cool ourselves by sweating and radiating heat through the skin. However, in certain circumstances, such as extreme heat, high humidity or vigorous activity in the hot sun, this cooling system may begin to fail, allowing heat to build up to dangerous levels. If a person becomes dehydrated and can not sweat enough to cool their body, their internal temperature may rise to dangerously high levels, causing heat stroke.
Many of us have experienced a similar phenomenon in our finances. All we have to do is overspend, make a few bad investment decisions, etc. and our finances become dehydrated. It's always easier (and frankly more fun) to get into financial trouble than it is to get out of financial trouble. Unlike the clock that we can easily manipulate, our finances take more time. The old adage is true: Anything worth having requires time and effort.
We are enamored with stories of people who make it big overnight. But, those stories are few and far between. True success comes through hard work and determination. People often call me or e-mail me with a difficult financial circumstance that they want to take care of. That's good. The problem is they want it to happen overnight. They want a pill that will fix their problem immediately. And why wouldn't they? We have pills that help us solve all sorts of problems today. We can access instant remedies for cholesterol, weight, blood pressure, headaches and back pain. The list goes on and on.
The only problem with these pills is that they often have side effects. Have you ever noticed the disclaimers that are given after a commercial for medicine finishes? A soothing voice comes over the air and says something like, "This product may cause diarrhea, nausea, bloody nose, whooping cough, hearing impairment and/or swallowing of the tongue." I think you get the picture. Even if we had a pill for our finances, the side effects would probably outweigh the benefits.
Here are some keys to re-hydrate your finances.
Think long term So often we are looking for a quick fix. Countless people call or visit my office looking for an easy solution. And why wouldn't they? Everything else in life is marketed to us as a quick-fix: Abs of steel in 6 minutes per day, 10 minute oil changes and one-hour photo shops. Even the problems of all our favorite sitcom characters are resolved in one hour or less! We need to remember that anything worth having takes time and effort. It's never easy. We must keep a long term perspective.
Set goals "But don't begin until you count the cost. For who would begin construction of a building without first getting estimates and then checking to see if there is enough money to pay the bills?" Luke 14:28. It's been said before that if you don't know where you're going, any road will take you there. As a guy, I struggle with asking for directions. Therefore I love maps and Global Positioning Systems (GPS). They allow me to find where I'm going without the embarrassment of asking for directions. The word "maps" is a word that we can use as an acrostic to help us set goals.
M – Measurable. Your goals have to be measurable. Blaine Harris, in his book "The Four Laws of Debt Free Prosperity" writes that "only that which can be measured can be managed." We're in the thick of the NBA playoffs, and we watch for one reason: to see who wins. It wouldn't be much fun if they just ran up and down the court without keeping score.
A – Achievable. Your goals have to be achievable. Your goals should stretch you, but they need to be realistic. For example, setting a goal to play in the NBA would not be an achievable goal for me. I'm 5'10"; I have a bum knee; I'm not very fast; I don't jump very well; and frankly I'm just not that good. However, I could set a goal to play in the over-30 men's league. That would be realistic. The perfect goal should be easy enough that it's attainable but hard enough that you have to rely on God to accomplish it
P – Personal. Your goals should be personal. Your goals must be your own. You can't live someone else's dream, and they can't live yours. You also shouldn't project your goals and desires onto somebody else.
S – Specific. Your goals must be specific. In order for your goals to be specific, they must have an estimated completion date, and they must be written in the affirmative. For example, let's say your goal is to get on a budget. You would write, "I will set up a budget by June 1, 2005." Unwritten goals are just wishes, and goals without a deadline are merely a philosophical statement. How many times have you heard yourself say, "One of these days, I'm going to …." We do it all the time.
Give generously Nothing frees us like giving. Solomon wrote, "One man gives freely yet gains even more; another withholds unduly but comes to poverty" (Proverbs 11:24 NIV). This is counterintuitive to what the world says, but since when were the things of this world right? This is not our home. You can't take it with you, but you can send it on ahead. Jesus said it best: "Don't store up treasures here on earth, where they can be eaten by moths and get rusty, and where thieves break in and steal. Store your treasures in heaven, where they will never become moth-eaten or rusty and where they will be safe from thieves" (Matthew 6:19).
Make a commitment today to implement these three principles before the dog days of summer are over.
Steve Scalici is a Certified Financial PlannerTM and Vice President of Treasure Coast Financial. He is co-host of a daily radio show called "God's Money" which can be heard at www.oneplace.com. You can contact Steve at email@example.com or via telephone at 1-800-728-6342. His website is www.tcfin.com.
A caring friend will be there to pray with you in your time of need.


text:
Digital X-Rays
Dental radiographs (x-rays) are essential, preventative, diagnostic tools that provide valuable information not visible during a regular dental exam. Dentists and dental hygienists use this information to safely and accurately detect hidden dental abnormalities and complete an accurate treatment plan. Without x-rays, problem areas may go undetected.Dental x-rays may reveal:
- Abscesses or cysts
- Bone loss
- Cancerous and noncancerous tumors
- Decay between the teeth
- Developmental abnormalities
- Poor tooth and root positions
- Problems inside a tooth or below the gum line
Finding and treating dental problems at an early stage can save you time, money, unnecessary discomfort, and your teeth!


text:
Recent Posts
- MYSTERY AMERICA: Border Patrol
- The DMV
- Annoyatarians: A Real Conversation with a Real Meathead
- Going to the Gym
- Shoot Me
- Weddings Are Fun!
- Cheap Ass Motherfuckers
- X's and Ohs…
- inDirecTV
- Actors: The Most Important People on the Planet
- Mind Over Manners — Part Too
- Mind Over Manners
- There's the Rub (and Tug)
- Wet Hot American Shower (Sex)
- It's Just Lunch
- I Don't Care Anymore
- I hate cats (not the musical)
- Random Things about Steve Schneider
- Dictures
- Birthdays
- Awkward Moments in Time
- 10 things i hate (not including you)
- me vs. you
- kiddie porn
- Dating
- Names
- Couch Time
- I Heart Airplanes
- Ikea
- Shit Story
Watch Schneider's Videos
Tag Archives: disney
I'm really good at finding what's wrong with people and telling them about it. It's not that I'm good at telling them, I'm just really good ABOUT telling them. I try to do what normal people do and ignore other people's flaws [because I have plenty of my own (this being one of them)] but eventually it ends up eating away at my patience — making me angrier and angrier – I start looking for it, anticipating it — actually wanting them to do it — the thing I hate — just so I can be right and hate them more. Until I can't take it anymore and I explode. Continue reading


text:
Our name "iWadi" derives from Yoruba language and means "a study". Yoruba is a language spoken primarily in Africa, but also in the US and the UK. All in all, it is used by approx. 20 million people in the world.
iWadi is a part of Cint AB Group, one of the largest and the fastest growing research companies with headquarters in Stockholm, Sweden.
iWadi is an online research panel
In brief: iWadi is an online research panel where your opinion transforms into money. Wondering how? It's very easy: sign up, provide your e-mail address and receive from us invites to online paid surveys (you can complete only those paid surveys that you want), accumulate points and in the end, we will pay you your remuneration. Completion of the paid survey takes only few minutes and for your convenience you can answer questions on any device with the Internet access.
iwadi works with the leading brands
We work with the leading brands in the field of market research and marketing. We usually ask about social and consumer issues. By participating in iWadi paid surveys you can share your opinion on all matters relating to everyday life and change the world for the better.
iwadi protects your data
Any information provided by you is confidential which means that the answers provided in the paid surveys are analyzed with complete anonymity. The results of our surveys are presented only in the form of statistical summaries, as average or percentage response for a particular group of people, e. g. 30% of men aged 25-30 years like sports.
Your data is safe because it is processed in accordance with the Code of Ethics of ESOMAR (European Society for Opinion and Market Research). Our connections are encrypted with SSL / HTTPS certificate.
Detailed rules of iWadi's operation are described in the Terms of Use.
If you still have questions, you are welcome to e-mail them to us to the address: [email protected]. We will be happy to answer them.


text:
Magic Sam Biography
Magic Sam (Samuel Maghett) was one of the most dynamic and gifted blues musicians during his short lifetime (1937-1969). Born a few miles northeast of this site, Maghett began his performing career in Grenada and lived in this house until he moved to Chicago in the early 1950s. The youthful energy and spirit of Magic Sam, Buddy Guy, Otis Rush, and Freddie King modernized Chicago blues into an explosive, electrifying new style in the late 1950s and early '60s.
Magic Sam, unlike most of his blues contemporaries, was born and raised in a community where fiddle music, hoedowns and square dances held sway over the blues among the African American population. Roy Moses, a renowned black fiddler in Grenada County, was not only the leading caller of steps at such dances, but also a mentor and inspiration to younger local musicians. Samuel Maghett carried these musical influences with him to Chicago in 1950. Blues guitarist Syl Johnson, who later became a nationally known soul singer, recalled that Sam was playing "a hillbilly style" at the time, and Johnson began teaching him blues and boogies. Sam developed a house-rocking blues style unparalleled in its rhythmic drive; it may well have had roots in the dance tempos of the reels and breakdowns he learned in Grenada.
Magic Sam was better known, however, for the heartfelt vocals and stinging guitar work of his 1957-58 blues recordings produced by Willie Dixon for the Cobra label in Chicago such as "All Your Love" and "Easy Baby," some of which featured another Grenada native, Billy Stepney, on drums. Sam's singing reflected another early influence, that of the church. During the '50s he often returned to visit and perform in Grenada, where he was credited with helping to popularize the blues. Sam and his combo won a local talent contest at the Union Theater which enabled them to compete on a show in Memphis promoted by WDIA radio. After performing under several stage names, he settled on "Magic" Sam–to rhyme with his surname.
In Chicago, Sam was at the vanguard of a new West Side blues movement. He remained a popular nightclub act during the 1960s and was poised to take his career to a new level, after recording two acclaimed albums for Delmark Records and turning in legendary festival performances in Ann Arbor, Michigan, and in Europe, but he died of a heart attack on December 1, 1969. His music has continued to influence generations of blues, R&B, and rock musicians.
Magic Sam's birthplace now lies submerged beneath Grenada Lake. The Redgrass and Hendersonville communities where he spent his earliest years, along with the former town of Graysport, were flooded in the late 1940s to create the lake as a flood control reservoir. The Maghett family relocated here to the Knoxville community, where Sam resided until he was thirteen. Maggitt Street, just south of this site, represents one of many local variations of the family surname.
Magic Sam photo gallery


text:
UKVMUG: The unofficial lowdown on everything announced at VMworld
I have had the pleasure today of presenting at the 4th annual UK VMware User Group conference at the National Motorcycle Museum in Solihull near Birmingham.
I did a whirlwind tour of everything that was announced at VMworld and believe me, there was a huge amount. OK, so no major release which is the norm (but plenty of teasers) but enough other things going on in the VMware space to fill more than a UKVMUG! I know, I've done the research! Even though I was at VMworld US, so much was going on that I didn't appreciate all the new shiny things being announced and once you start getting down to the nitty gritty of everything, you will be amazed at how much is going on.
I really didn't have time to go through everything in detail so the presentation acts as an independently curated jumping off point for you to find out more information about the announcements that matter to you. You may not care particularly about hyper-converged or OpenStack so you can flick through the slides and then head off to continue your explorations.
Thanks for having me UKVMUG!
Here's the presentation:


text:
- Consulting services
Document Management and Control System: 5-Wk Implementation
Document Control System and Regulatory compliance solution with reporting and workflow for business processes.
We help you implement your initial document control solution "Bitscape Vault" including required workflow and regulatory reporting. The implementation is over Azure utilizing best of Microsoft SharePoint powered on Azure and all required security and reporting leveraging Azure as a platform. The controls for the SOC 1, SOC 2, SOC 3 - US FDA CFR 21 Part 11, HIPPA archival, GDPR for professional services and data residency is addressed using Microsoft azure as platform and our implementation services of our IP based solution framework in this service offer. We will configure solution for you to use as per your requirements. the engagement is 5 weeks estimated and it is fixed cost. Price does not include any onsite travel expenses if required.
Following are features we will be able to implement for your requirements.
Compliance Features
Do get us in touch with us today to utilize this offer.
Optimize Operation -Process & Review
Publish & Search
We have specific solution implementation offer for


text:
So, you just got a camera. And the folks in the store are anxious to sell you an "accessory kit". They're anxious to do this because it's a high-profit item -- put a bunch of low-quality items together, give it a name, perhaps a name for a specific camera model, and sell it for a premium.
Ignore the accessory kits and instead think about what you need. Here are my suggestions:
- A memory card. Probably the one that came with the camera is too small. You need a minimum of one decent-sized card and a maximum of two. The price per GB is constant up to 16GB, so forget the idea of getting more smaller ones. The only advantage of two is the ability to transfer pictures from one card while you're using the other one. Always transfer the images to your computer and delete them off the card. Calculate how much space you need by estimating how many pictures you'll take between opportunities to transfer to your computer and then multiply by the space needed for the size you'll be shooting at.
- Speed does matter. With most cameras, faster cards let you take pictures faster. The cheapest cards off-brand cards seem to be the slowest.
- If your camera uses Compact Flash (CF), consider a UDMA card and a UDMA reader (see below).
- A UV filter, if you have an SLR. The real purpose is to protect your lens if it gets knocked. You don't need to pay absolute top dollar, but the cheapest ones may introduce distortion.
- A bag (not a case). You want a bag to stow the camera in when you're actually using it and possibly when you're using it not at home. I have a small Velocity 7 for active work. You don't want any case that is supposed to be used *while* you're actually taking pictures. They get in the way.
- If you have an SLR with multiple lenses, consider a backpack. I have an excellent one from Kata.
- Stability aka a tripod. You probably want some combination of the the following.
- A tripod. The best recommendations I know of are by Thom Hogan of bythom.com (he also writes great books). Most people can get by with less, maybe even just putting the camera on the edge of a table and using the self timer.
- A small tripod. Gorilla pods aren't bad (get the larger one, not the small one, it also comes in green). Or, maybe a Green Pod.
- A monopod. They're lightweight and good for added stability. Even a really cheap one can make a big difference. I've heard good things about the SteadePod.
- If you don't have one, you need a card reader for your computer. I have a Lexar dual-slot reader that supports UDMA. It does not have an attached USB cord (more convenient for packing) and closes to keep dust out.
- Consider a cheat sheet from Bert's Cheat Sheets. Small and handy. I also got one for my external flash.
- A memory card that's bigger than you actually need. Bigger is not always better: with some cameras, particularly point-and-shoots, larger cards mean the camera takes longer to turn on.
- Additional batteries or an external battery charger. You can always buy them later.
- An external flash, unless you know what you're doing (in which case, you probably don't need my advice anyway).
- Any lens adapter that goes on the outside of your lens.
- Remote control, unless you know you'll use it.
- Anything labeled an accessory kit.