Privacy-Preserving Password Strength Meters with FHE

Abstract

AbstractPassword strength meter service enables users to assess strength of the passwords and assist users in setting stronger passwords for their accounts. However, passwords are private to the users and may contain sensitive information about them. Hence, it is important to query password strength meter service in a privacy preserving manner. To address this, we propose fully homomorphic encryption (FHE) based privacy preserving password strength meters constructed using widely studied Markov model and Probabilistic Context Free Grammar (PCFG) model. These privacy preserving strength meters allow clients to securely evaluate strength of password by providing end-to-end query privacy to the users. The primitive operation in these constructions comprises of search operation. However, search over large datasets in FHE domain is expensive and induces worst case complexity. Therefore, our constructions focus on optimizing search space to suit FHE domain that improves the efficiency of privacy preserving password strength meter. Our construction achieves practical performance with accurate guessing probabilities.KeywordsMarkov modelPCFG modelPrivacyFully homomorphic encryptionPassword strength.