Pitfalls in the automated strengthening of passwords

David Schmidt, Trent Jaeger

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Scopus citations

Abstract

Passwords are the most common form of authentication for computer systems, and with good reason: they are simple, intuitive and require no extra device for their use. Unfortunately, users often choose weak passwords that are easy to guess. Various methods of helping users select strong passwords have been deployed, often in the form of requirements for the minimum length and number of character classes to use. Alternatively, a site could modify a user's password in order to make it more secure; strengthening algorithms have been proposed that extend/modify a user-supplied password until achieving sufficient strength. Researchers have suggested that it may be possible to balance password strength with memorability by limiting automated changes to one or two characters while evaluating the generated passwords' strength against known cracking algorithms. This paper shows that passwords that were strengthened against the best known cracking algorithms are still susceptible to attack, provided the adversary knows the strengthening algorithm. We propose two attacks: (1) by strengthening the data sets with the known algorithm, which increases the percentage of recovered passwords by a factor of 2-5, and (2) by a brute-force attack on the initial passwords and space of possible changes, recovering all passwords produced when a sufficiently weak initial password was suggested. As a result, we find that the proposed strengthening algorithms do not yet satisfy Kerckhoffs's principle.

Original languageEnglish (US)
Title of host publicationProceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013
Pages129-138
Number of pages10
DOIs
StatePublished - Dec 1 2013
Event29th Annual Computer Security Applications Conference, ACSAC 2013 - New Orleans, LA, United States
Duration: Dec 9 2013Dec 13 2013

Publication series

NameACM International Conference Proceeding Series

Other

Other29th Annual Computer Security Applications Conference, ACSAC 2013
CountryUnited States
CityNew Orleans, LA
Period12/9/1312/13/13

All Science Journal Classification (ASJC) codes

  • Software
  • Human-Computer Interaction
  • Computer Vision and Pattern Recognition
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Pitfalls in the automated strengthening of passwords'. Together they form a unique fingerprint.

  • Cite this

    Schmidt, D., & Jaeger, T. (2013). Pitfalls in the automated strengthening of passwords. In Proceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013 (pp. 129-138). (ACM International Conference Proceeding Series). https://doi.org/10.1145/2523649.2523651