On the Implications of Zipf’s Law in Passwords

Wang, Ding; Wang, Ping

doi:10.1007/978-3-319-45744-4_6

Cited by 47 publications

(53 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…is the running time for exclusive-or operation. |D pw | denotes the number of passwords in D pw , and |D pw | is very limited in practice [49,50]; usually |D pw | ≤ 10 6 ; so the above attack is quite efficient.…”

Section: Offline Dictionary Attack Via Verification Value Inmentioning

confidence: 41%

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

Wang¹,

Xu²

2017

Security and Communication Networks

View full text Add to dashboard Cite

Remote user authentication is the first step to guarantee the security of online services. Online services grow rapidly and numerous remote user authentication schemes were proposed with high capability and efficiency. Recently, there are three new improved remote user authentication schemes which claim to be resistant to various attacks. Unfortunately, according to our analysis, these schemes all fail to achieve some critical security goals. This paper demonstrates that they all suffer from offline dictionary attack or fail to achieve forward secrecy and user anonymity. It is worth mentioning that we divide offline dictionary attacks into two categories: (1) the ones using the verification from smart cards and (2) the ones using the verification from the open channel. The second is more complicated and intractable than the first type. Such distinction benefits the exploration of better design principles. We also discuss some practical solutions to the two kinds of attacks, respectively. Furthermore, we proposed a reference model to deal with the first kind of attack and proved its effectiveness by taking one of our cryptanalysis schemes as an example.

show abstract

Section: Offline Dictionary Attack Via Verification Value Inmentioning

confidence: 41%

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

Wang¹,

Xu²

2017

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Password frequencies have been shown to follow closely variants of the Zipf's law distribution. In particular, the so-called CDF-Zipf's law model introduced in [25,26] is a modification of the Zipf's law which captures the frequencies of passwords, both for very frequent passwords, and the tails, as exhibited by the close empirical fit to multiple password datasets (see [26,25,27]). Note that an adversary can benefit greatly from the the non-uniformity of these distributions to design more powerful brute-force attacks.…”

Section: Figmentioning

confidence: 99%

Why Botnets Work: Distributed Brute-Force Attacks Need No Synchronization

Salamatian¹,

Huleihel

Beirami

et al. 2019

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

In September 2017, McAffee Labs quarterly report [2] estimated that brute force attacks represent 20% of total network attacks, making them the most prevalent type of attack ex-aequo with browser based vulnerabilities. These attacks have sometimes catastrophic consequences, and understanding their fundamental limits may play an important role in the risk assessment of password-secured systems, and in the design of better security protocols. While some solutions exist to prevent online brute-force attacks that arise from one single IP address, attacks performed by botnets are more challenging. In this paper, we analyze these distributed attacks by using a simplified model. Our aim is to understand the impact of distribution and asynchronization on the overall computational effort necessary to breach a system. Our result is based on Guesswork, a measure of the number of queries (guesses) required of an adversary before a correct sequence, such as a password, is found in an optimal attack. Guesswork is a direct surrogate for time and computational effort of guessing a sequence from a set of sequences with associated likelihoods. We model the lack of synchronization by a worst-case optimization in which the queries made by multiple adversarial agents are received in the worst possible order for the adversary, resulting in a min-max formulation. We show that, even without synchronization, and for sequences of growing length, the asymptotic optimal performance is achievable by using randomized guesses drawn from an appropriate distribution. Therefore, randomization is key for distributed asynchronous attacks. In other words, asynchronous guessers can asymptotically perform brute-force attacks as efficiently as synchronized guessers. I. INTRODUCTIONFrom online banking [3] and bitcoin wallets [4], to secure shell (SSH), file transfer protocol (ftp), and telnet servers [5], and passing by governmental institutions [6], brute-force attacks have shown to be one of the major threats to network security. Despite the computational burden on the attacker, brute-force attacks are prevalent. This can be explained through multiple points of view. First, passwords are often weaker than what they ought to be, meaning that attackers can hope to find the correct password well before they query a significant portion of the possible password strings. Next, attacks through huge networks of compromised computers (botnets) are now more common, giving access to significant computational resources for the attacker. More critically, these botnets help to disguise the attack by distributing it. Indeed, a main solution to the threat of online brute-force attacks is to setup a system that detects and prevents too many queries from any one user, as determined by IP addresses. As such, an attacker which uses only a single IP address would be limited to a fixed number of guesses. In recent years, however, this defense was circumvented by using massive botnets, each bot querying potential passwords. In this situation, it is hard to detect legitimat...

show abstract

“…The time complexity of the above attack is

scriptO false(false| D_{I d} false| * false| D_{P w} false| * 2 T_{h} false)

, where T h is the running time for hash computation,

false| D_{I d} false|

and

false| D_{P w} false|

denote the number of identities in

D_{I d}

and the number of passwords in

D_{P w}

, respectively. And usually

false| D_{I d} false| \leq false| D_{P w} false| \leq 1 0^{6}

, so the above attack is quite efficient. Accordingly, the scheme of Kumari et al is unable to resist off‐line password guessing attack.…”

Section: Cryptanalysis Of the Scheme Of Kumari Et Almentioning

confidence: 99%

Cryptanalysis and improvement of 2 mutual authentication schemes for Session Initiation Protocol

Qiu

Guo

et al. 2018

Int J Communication

View full text Add to dashboard Cite

Summary Recently, Chaudhry et al and Kumari et al proposed an advanced mutual authentication protocol for Session Initiation Protocol on the basis of the protocol of Lu et al. The authors claimed that their schemes can be resistant to various attacks. Unfortunately, we observe some important flaws in their respective schemes. We point out that their schemes are prone to off‐line password guessing and privileged insider attacks. To remedy their protocols's drawbacks, in this paper, we present a new improved authentication scheme keeping apart the threats encountered in the design of the schemes of Chaudhry et al and Kumari et al. Furthermore, the security analysis illustrates that our proposed scheme not only removes these drawbacks in their schemes but also can resist all known attacks and provide session key security. We give a heuristic security analysis and also provide the security analysis of the proposed scheme with the help of widespread Burrows‐Abadi‐Needham Logic. Finally, our scheme is compared with the previously proposed schemes on security and performance.

show abstract

On the Implications of Zipf’s Law in Passwords

Cited by 47 publications

References 31 publications

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

Cryptanalysis of Three Password-Based Remote User Authentication Schemes with Non-Tamper-Resistant Smart Card

Why Botnets Work: Distributed Brute-Force Attacks Need No Synchronization

Cryptanalysis and improvement of 2 mutual authentication schemes for Session Initiation Protocol

Contact Info

Product

Resources

About