Abstract:An attacker who breaks into an authentication server and steals all of the cryptographic password hashes is able to mount an offline-brute force attack against each user's password. Offline brute-force attacks against passwords are increasingly commonplace and the danger is amplified by the well documented human tendency to select low-entropy password and/or reuse these passwords across multiple accounts. Moderately hard password hashing functions are often deployed to help protect passwords against offline attacks by increasing the attacker's guessing cost. However, there is a limit to how "hard" one can make the password hash function as authentication servers are resource constrained and must avoid introducing substantial authentication delay. Observing that there is a wide gap in the strength of passwords selected by different users we introduce DAHash (Distribution Aware Password Hashing) a novel mechanism which reduces the number of passwords that an attacker will crack. Our key insight ishat a resource-constrained authentication server can dynamically tune the hardness parameters of a password hash function based on the (estimated) strength of the user's password. We introduce a Stackelberg game to model the interaction between a defender (authentication server) and an offline attacker. Our model allows the defender to optimize the parameters of DAHash e.g., specify how much effort is spent to hash weak/moderate/high strength passwords. We use several large scale password frequency datasets to empirically evaluate the effectiveness of our differentiated cost password hashing mechanism. We find that the defender who uses our mechanism can reduce the fraction of passwords that would be cracked by a rational offline attacker by around 15%.

PASSWORD CRACKING BASED ON RAINBOW TABLE IN DISTRIBUTED COMPUTING ENVIRONMENT

Study on Hash Function Cracking Based on Rainbow Table

Password Cracking Based on Rainbow Tables with A Dynamically Coarse Grain Reconfigurable Architecture.

Rainbow Table Based on Generator-A New Way of Rainbow Table Generation

A Universal Distributed Model for Password Cracking.

Zero-Sum Password Cracking Game: A Large-Scale Empirical Study on the Crackability, Correlation, and Security of Passwords

Research of Distributed Database's Safety in Password

Making A Higher Hit Ratio Cryptanalytic Time-Memory Trade-Off Attack on Passwords

Advances in Password Security

Exploring the Network of Real-World Passwords: Visualization and Estimation.

Decryption of Encrypted Key Password by Cloud Computing

DAHash: Distribution Aware Tuning of Password Hashing Costs

Novel password authentication protocol based on RTT

Password Cracking and Countermeasures in Computer Security: A Survey

Security Analysis of MD5 Algorithm in Password Storage

Understanding Offline Password-Cracking Methods: A Large-Scale Empirical Study

The Scale-free Network of Passwords : Visualization and Estimation of Empirical Passwords

Password Guessing Time Based on Guessing Entropy and Long-Tailed Password Distribution in the Large-Scale Password Dataset

Privacy-Preserving Password Cracking: How a Third Party Can Crack Our Password Hash Without Learning the Hash Value or the Cleartext

Password Authentication Scheme for Mobile Computing Environment

Analysis of partial key recovery attack on multivariate cryptographic transformations using rank systems