DAHash: Distribution Aware Tuning of Password Hashing Costs

01/25/2021
by   Wenjie Bai, et al.
0

An attacker who breaks into an authentication server and steals all of the cryptographic password hashes is able to mount an offline-brute force attack against each user's password. Offline brute-force attacks against passwords are increasingly commonplace and the danger is amplified by the well documented human tendency to select low-entropy password and/or reuse these passwords across multiple accounts. Moderately hard password hashing functions are often deployed to help protect passwords against offline attacks by increasing the attacker's guessing cost. However, there is a limit to how "hard" one can make the password hash function as authentication servers are resource constrained and must avoid introducing substantial authentication delay. Observing that there is a wide gap in the strength of passwords selected by different users we introduce DAHash (Distribution Aware Password Hashing) a novel mechanism which reduces the number of passwords that an attacker will crack. Our key insight ishat a resource-constrained authentication server can dynamically tune the hardness parameters of a password hash function based on the (estimated) strength of the user's password. We introduce a Stackelberg game to model the interaction between a defender (authentication server) and an offline attacker. Our model allows the defender to optimize the parameters of DAHash e.g., specify how much effort is spent to hash weak/moderate/high strength passwords. We use several large scale password frequency datasets to empirically evaluate the effectiveness of our differentiated cost password hashing mechanism. We find that the defender who uses our mechanism can reduce the fraction of passwords that would be cracked by a rational offline attacker by around 15

READ FULL TEXT

page 1

page 2

page 3

page 4

09/21/2020

Information Signaling: A Counter-Intuitive Defense Against Password Cracking

We introduce password strength information signaling as a novel, yet cou...
06/09/2020

On the Economics of Offline Password Cracking

We develop an economic model of an offline password cracker which allows...
05/18/2020

DALock: Distribution Aware Password Throttling

Large-scale online password guessing attacks are wide-spread and continu...
06/26/2022

Cost-Asymmetric Memory Hard Password Hashing

In the past decade, billions of user passwords have been exposed to the ...
11/30/2017

Efficacy of Object-Based Passwords for User Authentication

Traditional text-based password schemes are inherently weak. Users tend ...
04/17/2019

Authenticated Preambles for Denial of Service Mitigation in LPWANs

In this article we introduce authentication preambles as a mechanism to ...