Verified Password Generation from Password Composition Policies

Abstract

Password managers (PMs) are important tools that enable the use of stronger passwords, freeing users from the cognitive burden of remembering them. Despite this, there are still many users who do not fully trust PMs. In this paper, we focus on a feature that most PMs offer that might impact the user's trust, which is the process of generating a random password. We present three of the most commonly used algorithms and we propose a solution for a formally verified reference implementation of a password generation algorithm. We use Easy-Crypt to specify and verify our reference implementation. In addition, we present a proof-of-concept prototype that extends Bitwarden to only generate compliant passwords, solving a frequent users' frustration with PMs. This demonstrates that our formally verified component can be integrated into an existing (and widely used) PM.

Challenges and Opportunities in Password Management: A Review of Current Solutions

“…Also, high entropy can be gained by including mnemonic aids for ALPHANUM, removing obscure words from the DICEWARE word list, and combining upper case letters and punctuations to the PRONOUNCE3 schemes (Smith, 2020). Grilo, Ferreira & Almeida (2021) studied 15 password managers to understand commonly used generation algorithms, and Google, Bitwarden, and KeePass algorithms were critically reviewed since they are open-source and widely used in the industry. They defined that generated passwords must satisfy the password composition policies including password character length and different character classes to avoid passwords being easily guessed or reused.…”

“…The main advantage of this is that users only have to remember a single password and the tool memorizes all other sensitive data for themselves (Rahalkar & Gujar, 2019). Grilo, Ferreira & Almeida (2021) stated that security experts are strongly recommending password managers for password creation and storage which also frees the users from the cognitive burden of password management. Gupta et al (2020b) Guo et al (2019) presented that password managers can mainly be divided Fernando, Dissanayake, Dushmantha, Liyanage, and Karunatilake, 2023. into two kinds.…”

“…This feature gives high availability for users to access login credentials and other sensitive data anywhere anytime platform independently (Anand, Susila & Balakrishnan, 2018;Gupta et al, 2022). Chaudhary et al (2019) and (Grilo, Ferreira & Almeida, 2021) counter-argued that online managers come with the possibility of security breaches and mistrust of the service provider since confidentiality arrangements might not be true at all times. Luevanos et al (2017) reported that two major online password managers in the market, LastPass and Roboform have been identified for storing credentials and sensitive data in plain text on the cloud servers and offering suggestions for the other third-party vendors on product and data security.…”

Reviewing the Usability of Web Authentication Procedures: Comparing the Current Procedures of 20 Websites

“…Some studies have focused on one security procedure, such as resetting passwords [9][10][11]. Other studies have focused on only one part of a security procedure, such as password policies [12][13][14][15][16][17] or password meters [18][19][20][21][22]. Some research has focused on specific authentication methods, such as passwords [23][24][25], biometrics [26][27][28][29], or two-factor authentication [30][31][32][33][34][35].…”