Fast password recovery attack: application to APOP

Abstract

Abstract. In this paper, we propose a fast password recovery attack to APOP application in local which can recover a password with 11 characters in less than one minute, recover a password with 31 characters extremely fast, about 4 minutes, and for 43 characters in practical time. These attacks truly simulate the practical password recovery attacks launched by malware in real life, and further confirm that the security of APOP is totally broken. To achieve these dramatical improvements, we propose a group satisfaction scheme, apply the divide-and-conquer strategy and a new suitable MD5 collision attack to greatly reduce the computational complexity in collision searching with high number of chosen bits. The average time of generating an "IV Bridge" is optimized to 0.17 second on ordinary PC, the average time of generating collision pairs for recovering passwords up to 11 characters is about 0.08 second, for 31 characters is about 0.15 second, for 39 characters is about 4.13 seconds, for 43 characters is about 20 seconds, and collisions for recovering passwords as long as 67 characters can be theoretically generated. These techniques can be further applied to reduce the complexity of producing a 1-bit-free collisions for recovering the first 11 characters, whose main target is that to reduce the number of challenges generated in APOP attack, to about 2 36 MD5 compressions.

On the security of PPPoE network

“…Second, with the efficient password cracking using probabilistic context‐free grammars, we further improve it to quickly crack the known‐length password. We confirm that it is unsuitable to further deploy PPPoE in commercial using until all of the proven weak authentication protocols are abolished and replaced with more secure Extensible Authentication Protocols (EAPs), and the security of MD5‐based network applications should be re‐evaluated .…”

On the cryptographic security of the “BotikKey” authentication protocol against attacks on MD5 hash function

“…В настоящее время протокол APOP считается скомпрометирован-ным, так как его применение позволит злоумышленнику (который выдает себя за почтовый сервер) за разумное время восстановить до 43 символов (байт) пароля [7]. Опишем стратегию, применяемую для выполнения атаки на протокол APOP.…”

How to Break EAP-MD5

“…MD5 [11,17,7,8] is a typical Merkle-Damgård structure hash function, which takes a variable-length message M as input and outputs a 128-bit hash value. M is first padded to be multiples of 512 bits, a '1' added at the tail of M , followed by '0's until the bit length becomes 448 on modulo 512, finally, the length of the unpadded message M is inserted to the last 64 bits.…”