Cryptanalytic time–memory trade-off for password hashing schemes

Chang, Donghoon; Jati, Arpan; Mishra, Sweta; Sanadhya, Somitra Kumar

doi:10.1007/s10207-018-0405-5

Cited by 7 publications

(4 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…They highlight the shortcomings of Argon2i in achieving its stated memory hardness goals. The research provides valuable perspectives on the resilience and efficiency of password hashing schemes considering different time and memory resource allocation scenarios (Chang et al, 2019).…”

Section: Analysis Of Rainbow Tables E Cacy In Password Hashing Schemesmentioning

confidence: 99%

On time-memory trade-offs for password hashing schemes

Saran

2024

Front. Comput. Sci.

View full text Add to dashboard Cite

A password hashing algorithm is a cryptographic method that transforms passwords into a secure and irreversible format. It is used not only for authentication purposes but also for key derivation mechanisms. The primary purpose of password hashing is to enhance the security of user credentials by preventing the exposure of plaintext passwords in the event of a data breach. As a key derivation function, password hashing aims to derive secret keys from a master key, password, or passphrase using a pseudorandom function. This review focuses on the design and analysis of time-memory trade-off (TMTO) attacks on recent password hashing algorithms. This review presents a comprehensive survey of TMTO attacks and recent studies on password hashing for authentication by examining the literature. The study provides valuable insights and strategies for safely navigating transitions, emphasizing the importance of a systematic approach and thorough testing to mitigate risk. The purpose of this paper is to provide guidance to developers and administrators on how to update cryptographic practices in response to evolving security standards and threats.

show abstract

Section: Analysis Of Rainbow Tables E Cacy In Password Hashing Schemesmentioning

confidence: 99%

On time-memory trade-offs for password hashing schemes

Saran

2024

Front. Comput. Sci.

View full text Add to dashboard Cite

show abstract

“…Password-based user authentication methods are a powerful means of protecting the private information of users in the field of information security [1,2]. When choosing a password, security and convenience conflict [3,4]. For example, although complex passwords that combine numbers and special symbols like "toeq39bf@la" are inconvenient to use because they are difficult to remember, they are safe because they are not easily inferred by others.…”

Section: Introductionmentioning

confidence: 99%

Enhanced Evaluation Model of Security Strength for Passwords Using Integrated Korean and English Password Dictionaries

Hong

Kang

Lee

2021

Security and Communication Networks

View full text Add to dashboard Cite

In the field of information security, passwords are a means of authenticating users. Passwords with weak security cannot perform the role of user authentication and personal information protection because confidentiality is easily violated. To ensure confidentiality, it is important to evaluate the strength of the password and choose a very secure password. Due to this fact, security evaluation models for various passwords have been presented. However, existing evaluation models evaluate security based on the English alphabet. Passwords depend on the memory of the user and are closely related to the language or environment used by the user. In this regard, there are limitations in applying the existing security evaluation models to passwords chosen by non-English speakers. We compose a non-English, Korean language-based password dictionary and propose a password security evaluation model based on this for Korean users. In addition, to verify the effectiveness of the proposed model, we conducted experiments to evaluate the security of Korean language-based passwords using a database of passwords that have been actually leaked. As a result, the proposed model showed 99.38% accuracy for Korean language-based leaked passwords. This is superior to the 80.06% accuracy shown by the existing model. In conclusion, the use of the Korean language-based password security evaluation model proposed in this paper will contribute to choosing more secure passwords for Korean language-based sites or users.

show abstract

“…Деякі фреймворки можуть використовувати базові схеми хешування, такі як SHA256 або SHA512, що покращує безпеку в порівнянні з MD5 і SHA1, проте вони все ще можуть бути вразливі до атак з використанням спеціалізованих апаратних засобів або паралельних обчислень [6].…”

unclassified

Підвищення Стійкості Паролів У Веб-Системах За Допомогою Вдосконалених Схем Хешування

БАГРІЙ,

БАРМАК,

МАНЗЮК

2024

Вісник Хмельницького національного університету. Серія: Технічн

View full text Add to dashboard Cite

Researching the security of web systems is a relevant and integral component in the process of developing and operating Internet projects. Ensuring the security of user passwords is a key aspect in this context, as compromised passwords can lead to undesirable consequences, including loss of sensitive information, unauthorized access and website compromise. One approach to making passwords more resistant to cracking is the use of hashing techniques. When a user account is created, the password is hashed using the selected hash function. The development of parallel computing allows for many attacks when cracking password hashes. To counter such attacks, it is necessary to constantly develop new password hashing schemes that will be effective and provide a higher level of password security in web systems. The results of the study confirm that most of the popular frameworks used for the development of web systems do not provide a sufficiently high level of password protection. Many of them simply hash user data using fast and less stable algorithms such as SHA2 or MD5. This makes passwords vulnerable to hash table and dictionary attacks. According to OWASP guidelines and accepted security practices, highly robust salted hashing algorithms are one of the most effective methods for keeping passwords secure. Such algorithms provide much greater resistance to various attacks, including attacks using specialized hardware and parallel computing. Argon2id is one of the most robust password hashing algorithms that has won a password hashing contest and is considered one of the most reliable options for password security. Using Argon2id allows you to configure configuration parameters such as the minimum memory size, the number of iterations and the degree of parallelism, which allows you to achieve an optimal balance between security and performance.

show abstract

Cryptanalytic time–memory trade-off for password hashing schemes

Cited by 7 publications

References 9 publications

On time-memory trade-offs for password hashing schemes

On time-memory trade-offs for password hashing schemes

Enhanced Evaluation Model of Security Strength for Passwords Using Integrated Korean and English Password Dictionaries

Підвищення Стійкості Паролів У Веб-Системах За Допомогою Вдосконалених Схем Хешування

Contact Info

Product

Resources

About