Abstract:An attacker who breaks into an authentication server and steals all of the cryptographic password hashes is able to mount an offline-brute force attack against each user's password. Offline brute-force attacks against passwords are increasingly commonplace and the danger is amplified by the well documented human tendency to select low-entropy password and/or reuse these passwords across multiple accounts. Moderately hard password hashing functions are often deployed to help protect passwords against offline attacks by increasing the attacker's guessing cost. However, there is a limit to how "hard" one can make the password hash function as authentication servers are resource constrained and must avoid introducing substantial authentication delay. Observing that there is a wide gap in the strength of passwords selected by different users we introduce DAHash (Distribution Aware Password Hashing) a novel mechanism which reduces the number of passwords that an attacker will crack. Our key insight ishat a resource-constrained authentication server can dynamically tune the hardness parameters of a password hash function based on the (estimated) strength of the user's password. We introduce a Stackelberg game to model the interaction between a defender (authentication server) and an offline attacker. Our model allows the defender to optimize the parameters of DAHash e.g., specify how much effort is spent to hash weak/moderate/high strength passwords. We use several large scale password frequency datasets to empirically evaluate the effectiveness of our differentiated cost password hashing mechanism. We find that the defender who uses our mechanism can reduce the fraction of passwords that would be cracked by a rational offline attacker by around 15%.

Hash & Adjust: Competitive Demand-Aware Consistent Hashing

Revisiting Consistent Hashing with Bounded Loads

Distributed Discrete Hashing by Equivalent Continuous Formulation.

Distributed Collaborative Hashing and Its Applications in Ant Financial

DHash: Enabling Dynamic and Efficient Hash Tables

Hyperdimensional Hashing: A Robust and Efficient Dynamic Hash Table

DHash: Dynamic Hash Tables With Non-Blocking Regular Operations

A Consistent Hashing Load Balancing Strategy Based on Fragmentation and Its Application

Fast Consistent Hashing in Constant Time

A Reliable Power Management Scheme for Consistent Hashing Based Distributed Key Value Storage Systems

Adaptive Hashing with Sparse Modification.

Adaptive Hashing With Sparse Modification For Scalable Image Retrieval

MementoHash: A Stateful, Minimal Memory, Best Performing Consistent Hash Algorithm

Smart Hashing Update for Fast Response.

Optimizing Hash-based Distributed Storage Using Client Choices

Parallel Optimization Of A Type Of Dynamic Hashing

DAHash: Distribution Aware Tuning of Password Hashing Costs

CHDAER:Consistent Hashing-based Data Allocation for Efficient Recommendation in Edge Environment

A Write-efficient and Consistent Hashing Scheme for Non-Volatile Memory

Iceberg Hashing: Optimizing Many Hash-Table Criteria at Once

Accelerated Large Scale Optimization by Concomitant Hashing