Abstract:We develop an economic model of an offline password cracker which allows us to make quantitative predictions about the fraction of accounts that a rational password attacker would crack in the event of an authentication server breach. We apply our economic model to analyze recent massive password breaches at Yahoo!, Dropbox, LastPass and AshleyMadison. All four organizations were using key-stretching to protect user passwords. In fact, LastPass' use of PBKDF2-SHA256 with $10^5$ hash iterations exceeds 2017 NIST minimum recommendation by an order of magnitude. Nevertheless, our analysis paints a bleak picture: the adopted key-stretching levels provide insufficient protection for user passwords. In particular, we present strong evidence that most user passwords follow a Zipf's law distribution, and characterize the behavior of a rational attacker when user passwords are selected from a Zipf's law distribution. We show that there is a finite threshold which depends on the Zipf's law parameters that characterizes the behavior of a rational attacker -- if the value of a cracked password (normalized by the cost of computing the password hash function) exceeds this threshold then the adversary's optimal strategy is always to continue attacking until each user password has been cracked. In all cases (Yahoo!, Dropbox, LastPass and AshleyMadison) we find that the value of a cracked password almost certainly exceeds this threshold meaning that a rational attacker would crack all passwords that are selected from the Zipf's law distribution (i.e., most user passwords). This prediction holds even if we incorporate an aggressive model of diminishing returns for the attacker (e.g., the total value of $500$ million cracked passwords is less than $100$ times the total value of $5$ million passwords). See paper for full abstract.

Making A Higher Hit Ratio Cryptanalytic Time-Memory Trade-Off Attack on Passwords

Mangling Rules Generation with Density-Based Clustering for Password Guessing

Cost-Asymmetric Memory Hard Password Hashing

DAHash: Distribution Aware Tuning of Password Hashing Costs

Practical Password Recovery Attacks on MD4 Based Prefix and Hybrid Authentication Protocols

Zipf's Law in Passwords.

On time-memory trade-offs for password hashing schemes

1 Zipf ’ s Law in Passwords

Password Guessing Time Based on Guessing Entropy and Long-Tailed Password Distribution in the Large-Scale Password Dataset

An Algorithm to Generate Password Structure Dictionary Based on Gene Bank

Digit Semantics Based Optimization for Practical Password Cracking Tools.

A Universal Distributed Model for Password Cracking.

Applying time-memory-data trade-off to plaintext recovery attack

PASS2EDIT: A Multi-Step Generative Model for Guessing Edited Passwords

An Alternative Method for Understanding User-Chosen Passwords.

On the Economics of Offline Password Cracking

Rainbow Table Based on Generator-A New Way of Rainbow Table Generation

Memory Chunking Analysis Of Numerical Password For Chinese Websites

An In-depth Study of Digits in Passwords for Chinese Websites.

Password guessers under a microscope: an in-depth analysis to inform deployments

Amogap: Defending Against Man-In-The-Middle And Offline Guessing Attacks On Passwords