A probabilistic framework for improved password strength metrics

A New Multimodal Approach for Password Strength Estimation—Part I: Theory and Algorithms

“…Since the first cracking methods using probabilities appeared to reduce the size of dictionaries in dictionary-based attacks [60], many different probabilistic strength estimation algorithms have been proposed. The vast majority of these techniques take advantage of the lessons learned in the field of natural language modeling [68] and may be grouped in three main trends: 1) Approaches that model passwords as simple character sequences using some form of the popular Markov Models [15], [17], [19], [47], [62]. 2) A very successful line of research using Probabilistic Context-Free Grammars (PCFG) was initiated by Weir as a cracking tool [48] that was further refined in [63].…”

“…If the reader is not fully familiar with Markov Chains and other related concepts such as smoothing, it is highly recommended to go over some general work in the topic like [16], [49], [69] before moving to the description of the two novel methods. As an introduction to how Markov models can be applied to the representation of passwords, it is also important to get acquainted with the two simple models that were introduced in [19] and further analyzed in [62]: the discrete time Simple Markov Chain and the discrete time Layered Markov Chain. We believe that this initial introductory readings can help to better understand the more complex models developed in the work and presented in Sects.…”

“…Although this basic approach addresses many of the shortcomings of the Simple and Layered Markov Chains (see [62]), it introduces a new key issue in the representation of passwords: what would be the optimal memory size? The biggest memory possible could be a good choice, however, this would entail a huge model impossible to be properly trained with a finite (but very large) amount of data.…”

“…The previous section has shown that, although the model with adaptive memory has clear advantages with respect to previous probabilistic-based methods such as the ones proposed in [17], [19], [62], it still presents some limitations.…”

“…The probability of occurrence of higher-order structures po s p is computed according to the Layered Markov Chain described in [62], where each state is assigned one of the SS higher-order subsequences. Any transition to/from a subsequence longer than lc max , dc max or sc max , is assigned a probability equal to the same transition to/from the longest subsequence of its class divided by 10.…”