Abstract:An adversary who has obtained the cryptographic hash of a user's password can mount an offline attack to crack the password by comparing this hash value with the cryptographic hashes of likely password guesses. This offline attacker is limited only by the resources he is willing to invest to crack the password. Key-stretching tools can help mitigate the threat of offline attacks by making each password guess more expensive for the adversary to verify. However, key-stretching increases authentication costs for a legitimate authentication server. We introduce a novel Stackelberg game model which captures the essential elements of this interaction between a defender and an offline attacker. We then introduce Cost Asymmetric Secure Hash (CASH), a randomized key-stretching mechanism that minimizes the fraction of passwords that would be cracked by a rational offline attacker without increasing amortized authentication costs for the legitimate authentication server. CASH is motivated by the observation that the legitimate authentication server will typically run the authentication procedure to verify a correct password, while an offline adversary will typically use incorrect password guesses. By using randomization we can ensure that the amortized cost of running CASH to verify a correct password guess is significantly smaller than the cost of rejecting an incorrect password. Using our Stackelberg game framework we can quantify the quality of the underlying CASH running time distribution in terms of the fraction of passwords that a rational offline adversary would crack. We provide an efficient algorithm to compute high quality CASH distributions for the defender. Finally, we analyze CASH using empirical data from two large scale password frequency datasets. Our analysis shows that CASH can significantly reduce (up to $50\%$) the fraction of password cracked by a rational offline adversary.

Bit-Free Collision: Application to APOP Attack

You See What I Want You to See: Exploring Targeted Black-Box Transferability Attack for Hash-based Image Retrieval Systems

How to Break MD5 and Other Hash Functions

Multi-Collision Attack On The Compression Functions Of Md4 And 3-Pass Haval

A New Non-MDS Hash Function Resisting Birthday Attack and Meet-in-the-middle Attack

Privacy-Preserving Password Cracking: How a Third Party Can Crack Our Password Hash Without Learning the Hash Value or the Cleartext

MultiCollision Attack on the Compression Functions of MD4 and 3-Pass HAVAL.

Triangulating Rebound Attack on AES-like Hashing

Cryptanalysis of the Hash Functions MD4 and RIPEMD

Multi-Factor Credential Hashing for Asymmetric Brute-Force Attack Resistance

CASH: A Cost Asymmetric Secure Hash Algorithm for Optimal Password Protection

Amogap: Defending Against Man-In-The-Middle And Offline Guessing Attacks On Passwords

An Attack on Hash Function HAVAL-128

Time-Space Lower Bounds for Finding Collisions in Merkle–Damgård Hash Functions

Classical and Quantum Meet-in-the-Middle Nostradamus Attacks on AES-like Hashing

Client-CASH: Protecting Master Passwords against Offline Attacks

A Lightweight Detection Algorithm for Collision-Optimized Divide-and-Conquer Attacks

Improved 2-round collision attack on IoT hash standard ASCON-HASH

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

CoTree: A Side-Channel Collision Tool to Push the Limits of Conquerable Space

Automatic Search of Meet-in-the-Middle Preimage Attacks on AES-like Hashing