Abstract:An adversary who has obtained the cryptographic hash of a user's password can mount an offline attack to crack the password by comparing this hash value with the cryptographic hashes of likely password guesses. This offline attacker is limited only by the resources he is willing to invest to crack the password. Key-stretching tools can help mitigate the threat of offline attacks by making each password guess more expensive for the adversary to verify. However, key-stretching increases authentication costs for a legitimate authentication server. We introduce a novel Stackelberg game model which captures the essential elements of this interaction between a defender and an offline attacker. We then introduce Cost Asymmetric Secure Hash (CASH), a randomized key-stretching mechanism that minimizes the fraction of passwords that would be cracked by a rational offline attacker without increasing amortized authentication costs for the legitimate authentication server. CASH is motivated by the observation that the legitimate authentication server will typically run the authentication procedure to verify a correct password, while an offline adversary will typically use incorrect password guesses. By using randomization we can ensure that the amortized cost of running CASH to verify a correct password guess is significantly smaller than the cost of rejecting an incorrect password. Using our Stackelberg game framework we can quantify the quality of the underlying CASH running time distribution in terms of the fraction of passwords that a rational offline adversary would crack. We provide an efficient algorithm to compute high quality CASH distributions for the defender. Finally, we analyze CASH using empirical data from two large scale password frequency datasets. Our analysis shows that CASH can significantly reduce (up to $50\%$) the fraction of password cracked by a rational offline adversary.

Client-Side Hashing for Efficient Typo-Tolerant Password Checkers

Don't Forget the Stuffing! Revisiting the Security Impact of Typo-Tolerant Password Authentication

Trenchcoat: Human-Computable Hashing Algorithms for Password Generation

Multi-Factor Credential Hashing for Asymmetric Brute-Force Attack Resistance

Client-CASH: Protecting Master Passwords against Offline Attacks

Fixing the Fixes: Assessing the Solutions of SAST Tools for Securing Password Storage

Securing Password Authentication for Web-based Applications

CASH: A Cost Asymmetric Secure Hash Algorithm for Optimal Password Protection

Amogap: Defending Against Man-In-The-Middle And Offline Guessing Attacks On Passwords

HoneyHash: Honeyword Generation Based on Transformed Hashes

Protocols for Checking Compromised Credentials

The weak password problem: chaos, criticality, and encrypted p-CAPTCHAs

Efficient Braille Transformation for Secure Password Hashing

On time-memory trade-offs for password hashing schemes

tPAKE: Typo-Tolerant Password-Authenticated Key Exchange

Why Johnny Can't Store Passwords Securely? A Usability Evaluation of Bouncycastle Password Hashing

Privacy-Preserving Password Cracking: How a Third Party Can Crack Our Password Hash Without Learning the Hash Value or the Cleartext

Advances in Password Security

A Security Analysis of Honeywords

The Effect of Domain Terms on Password Security

General Framework for Evaluating Password Complexity and Strength