Plaintext Password Research Articles

On time-memory trade-offs for password hashing schemes

A password hashing algorithm is a cryptographic method that transforms passwords into a secure and irreversible format. It is used not only for authentication purposes but also for key derivation mechanisms. The primary purpose of password hashing is to enhance the security of user credentials by preventing the exposure of plaintext passwords in the event of a data breach. As a key derivation function, password hashing aims to derive secret keys from a master key, password, or passphrase using a pseudorandom function. This review focuses on the design and analysis of time-memory trade-off (TMTO) attacks on recent password hashing algorithms. This review presents a comprehensive survey of TMTO attacks and recent studies on password hashing for authentication by examining the literature. The study provides valuable insights and strategies for safely navigating transitions, emphasizing the importance of a systematic approach and thorough testing to mitigate risk. The purpose of this paper is to provide guidance to developers and administrators on how to update cryptographic practices in response to evolving security standards and threats.

Authentication Based on Image Password

Abstract: In the modern day, graphical password authentication that relies on memory or recognition is a different and still developing sort of authentication. The user copies the picture or is able to identify the image that was used or made during the registration process. Only authorised users are able to access resources and information thanks to passwords. The newest fashion is graphic passwords, which appear to be a highly promising authentication technique. It is available as a substitute for text passwords. The most popular method is using usernames and passwords that are alphanumeric. While this method has certain benefits over plain text passwords, it also has some drawbacks. Users strive to memorise short, strong passwords that can be broken when using alphanumeric passwords, but doing so becomes cumbersome. Users that use graphical passwords save a picture or certain areas of an image as their password. Biometrics is now the most sophisticated and secure form of authentication, yet it is too costly for widespread usage. Graphical passwords are a fantastic alternative authentication mechanism since they are less expensive, more secure, and simpler for everyone to use. [1]

Authentication Based on Image Password

Abstract: In the modern day, graphical password authentication that relies on memory or recognition is a different and still developing sort of authentication. The user copies the picture or is able to identify the image that was used or made during the registration process. Only authorised users are able to access resources and information thanks to passwords. The newest fashion is graphic passwords, which appear to be a highly promising authentication technique. It is available as a substitute for text passwords. The most popular method is using usernames and passwords that are alphanumeric. While this method has certain benefits over plain text passwords, it also has some drawbacks. Users strive to memorise short, strong passwords that can be broken when using alphanumeric passwords, but doing so becomes cumbersome. Users that use graphical passwords save a picture or certain areas of an image as their password. Biometrics is now the most sophisticated and secure form of authentication, yet it is too costly for widespread usage. Graphical passwords are a fantastic alternative authentication mechanism since they are less expensive, more secure, and simpler for everyone to use. [1]

Effective One-Class Classifier Model for Memory Dump Malware Detection

Malware complexity is rapidly increasing, causing catastrophic impacts on computer systems. Memory dump malware is gaining increased attention due to its ability to expose plaintext passwords or key encryption files. This paper presents an enhanced classification model based on One class SVM (OCSVM) classifier that can identify any deviation from the normal memory dump file patterns and detect it as malware. The proposed model integrates OCSVM and Principal Component Analysis (PCA) for increased model sensitivity and efficiency. An up-to-date dataset known as “MALMEMANALYSIS-2022” was utilized during the evaluation phase of this study. The accuracy achieved by the traditional one-class classification (TOCC) model was 55%, compared to 99.4% in the one-class classification with the PCA (OCC-PCA) model. Such results have confirmed the improved performance achieved by the proposed model.

The Secrets to MIMIKATZ - The Credential Dumper

With the emergence of many credential dumping tools, Mimikatz has become an exceedingly dramatic tool against Windows users that allows intruders to fetch plain text passwords. Moreover they also target memory to dump password hashes. Mimikatz capacity and potential will be briefly discussed throughout the paper. Several modules of Mimikatz to dump credentials will follow, and the paper will conclude with procedures and techniques that may be used as prevention against Mimikatz attacks that are performed.

Understanding digit‐only financial account passwords: ID card, structure, and security

Password-based authentication is widely used in website access. Current studies on password security have focused considerable attention on letter-only passwords or passwords that include both letters and digits. However, little research has been conducted on commercial and digit-only passwords. In this paper, we comprehensively evaluate digit-only passwords by analyzing approximately 130,000 passwords from the 12306 data set. We observe that approximately 20% of six-digit passwords belonging to Chinese users include the user's identity document (ID) card information. Most of the passwords are found to be related to the user's birth dates. Additionally, we demonstrate that male users are more likely to set passwords with digits extracted from their ID card numbers than female users. It is the first time that the relation between real-user passwords and ID card series numbers was considered. It focuses on actual attack methodologies and real-user passwords, which renders this study an explicit study on digit-only password security. We propose a password-encryption authentication model based on FF3-1 to implement secure storage of passwords. We experiment with ciphertext and plaintext passwords using three–three and four–two structures combined with probabilistic context-free grammars. The cracking success rates of ciphertext passwords are found to be 0.086% and 1.06%, and they can recover 59.83% and 33.2% of the passwords in the test set. Conversely, using plaintext passwords results in the recovery of 98% and 85% of passwords in the test set. Our results demonstrate that the use of encryption for password storage can significantly reduce the cracking success rate of attackers.

Understanding Offline Password-Cracking Methods: A Large-Scale Empirical Study

Researchers proposed several data-driven methods to efficiently guess user-chosen passwords for password strength metering or password recovery in the past decades. However, these methods are usually evaluated under ad hoc scenarios with limited data sets. Thus, this motivates us to conduct a systematic and comparative investigation with a very large-scale data corpus for such state-of-the-art cracking methods. In this paper, we present the large-scale empirical study on password-cracking methods proposed by the academic community since 2005, leveraging about 220 million plaintext passwords leaked from 12 popular websites during the past decade. Specifically, we conduct our empirical evaluation in two cracking scenarios, i.e., cracking under extensive-knowledge and limited-knowledge. The evaluation concludes that no cracking method may outperform others from all aspects in these offline scenarios. The actual cracking performance is determined by multiple factors, including the underlying model principle along with dataset attributes such as length and structure characteristics. Then, we perform further evaluation by analyzing the set of cracked passwords in each targeting dataset. We get some interesting observations that make sense of many cracking behaviors and come up with some suggestions on how to choose a more effective password-cracking method under these two offline cracking scenarios.

Utilize Machine Learning Methods to Detect Plaintext Passwords

Every company is a target today, no matter the type of business it does. Hackers and cybercriminals are after data which they can monetize in many ways. Being proactive and have a defensive and protective plan in place such as evaluating and assessing IT security is a great recipe for avoiding data breaches and consequently, business disasters. Passwords are the most popular authentication method, mainly because they are easy to implement, require no special hardware or software, and are familiar to users and developers. Unfortunately, most users store their sensitive information or credentials in plain-text that might be accessible to attackers. Since the information is not encrypted and stored or transferred in cleartext, attackers will be able to read it easily. Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource. Developers sometimes believe that they cannot defend the application from someone who has access to the configuration, but this attitude makes an attacker’s job easier. Good password management guidelines require that a password must never be stored in plaintext. The question is why not utilizing a machine learning platform that can be trained to search text in a computer resource, detect a string of plaintext characters, and analyze the string of characters to predict or detect a plaintext password on a computer resource asset. Since plaintext passwords can be stored anywhere on a computer network, including on a computer resource asset, such as, for example, a file (for example, a configuration file), a router, a switch, a computer, a server, a database or source code, the solution can be arranged to target computer resource assets on the network and search those computer resource assets. The machine will be able to detect a plaintext password in a character string by analyzing plaintext character strings for common password complexity, such as, for example, including at least one uppercase letter, lowercase letter, number, special character, and text length (for example, minimum of eight characters). Then check the similarity of the character string against a database comprising passwords, including, for example, passwords that were previously found or identified by the solution, or passwords that were input or loaded into the database from a list, table, record, file, or a computer resource that can input passwords to the database. Also, it will predict a level of certainty that a character string includes a password and output a confidence score based on the predicted level of certainty. Finally, it will categorize the confidence score in any number of prediction certainty levels, including, for example, three levels – high, medium, or low.

PassContext and PassActions: transforming authentication into multi-dimensional contextual and interaction sequences

Authorized access to resources by legitimate users plays a crucial role in providing a secure and hassle-free user experience in the digital environments. Password remains the major authentication mechanism though there exist various drawbacks like leakage due to phishing and shoulder surfing, etc. This paper proposes two stronger transformations of the password termed as “PassContext” and “PassActions” which attempts to overcome the vulnerabilities in the plain-text password by harnessing the intricacies of human–computer interaction. The PassContext incorporates the hardware and software oriented context information along with the keyed-in password text during the verification process to provide improved authentication. The PassActions transforms the password from being text-only representation into a dynamic user interaction sequence which improves the strength of the password significantly. The proposed model incorporates methodologies to represent PassContext and PassActions for both validation and persistence purposes. The prototype implementations of PassContext and PassActions are evaluated with a suit of thirteen proposed measures, system usability survey (SUS) for usability analysis and with a well-established comparative framework.

SPSR-FSPG: A Fast Simulative Password Set Generation Algorithm

Identity authentication is a main line of defense for network security, and passwords have long been the mainstream of identity authentication. In the field of password security research, large-scale password datasets have played an important role in the efficiency evaluation of password attack algorithms, the feasibility detection of password strength meters, and the correction of password probability models. However, due to user privacy, timeliness, effectiveness and other factors, it is still very difficult for researchers to obtain real large-scale user plaintext passwords. Based on this, this paper proposes a fast simulative password set generation algorithm based on structure partitioning and string recombination, denoted as SPSR-FSPG. The algorithm uses the probability context-free grammar to model the structure of the password, and constructs a string generation model based on the recurrent neural network to generate different types of strings, so as to learn the character composition of the password in the original dataset. In addition, the model fully considers the user's password reuse and modification behavior. Finally, the method is verified by experiment on six real Chinese and English password sets. The results show that the generation rate of SPSR-FSPG is faster than other algorithms. In terms of true password coverage, the SPSR-FPSG simulative password set is increased by 11.36% and 17.5, respectively, relative to SPPG and PCFG, and is increased by about 122.73% and 130.3%, respectively, compared to OMEN and 4-Markov. And the fit of the Zipf distribution is maintained at a level above 0.95, it is better than 0.9 of SPPG. At the same time, the SPPR-FPSG simulative password set is closer to the real password set in terms of length and character composition.

New Algebraic Groups Produced By Graphical Passwords Based On Colorings And Labellings

Safety of plain text passwords has been questioned in current researching information passwords. Graphical passwords are another way for alternative text-based passwords and to improve the user account security. As we are constructing Topsnut-graphical passwords that can be traced to an idea of “Graph structure plus the number theory” proposed first by Hongyu Wang with her colleagues, we find that some of Topsnut-graphical passwords can be composed of algebraic groups under the principle of Abelian additive finite group. We apply the odd-elegant labelling of graph theory to produce Topsnut-graphical passwords, and verify our Topsnut-graphical passwords can form algebraic groups, called labelling graphical groups . Our results can provide those users who have business in two or more banks, and our methods are easily transformed into algorithms with polynomial times.

An approach to matching fingerprints using cryptographic one-way hashes

Password-based systems authenticate users with cryptographic one-way hashes without storing plaintext passwords. The method prevents a hacker from reversing the hashes and hacking into individual accounts easily. Biometric data cannot be reproduced with 100% accuracy. Therefore, the hashing technique has yet to be utilised directly to secure biometric data. Instead, biometric system manages biometric data in two ways. The first is to store original biometric templates in encrypted formats. However, real-time decryption is required upon authentication during which decrypted data can be stolen. The second is to transform original templates such that matching can be done directly in the transformed domain. However, the requirement of similarity-preserving transformation makes the transformed templates vulnerable to reverse engineering. In this paper we propose a novel approach of transforming fingerprint templates, with which matching can be conducted using cryptographic one-way hashes. Our testing results indicate its feasibility.

EAM: Architecting Efficient Authentication Model for Internet Security using Image-Based One Time Password Technique

In the era of Internet world, passwords are essential to protect our data and the application. Relying on a simple plaintext password would lead to vulnerability. Apart from choosing strong passwords, the authentication model plays a crucial role in Internet Security by protecting the web applications efficiently from various security attacks. Objectives: The aim of the paper is to provide an Efficient Authentication Model and adopt a new technique in generating a dynamic salt from the client. Hence it protects Internet applications from five types of security attacks, namely password-guessing attack, keylogger attack, replay attack, streaming bots, and screen-capture attacks. Methods: The One Time Password (OTP) based image-selection enables the user to protect the Internet application from streaming bots, keyloggers and screen-capture attacks. Findings: The architecture has been designed efficiently to minimize the number of transactions between the client and the server. The dependency on hardware devices for authentication can be completely eradicated by using Efficient Authentication Model (EAM). Hence, the authentication is well-suited for Internet applications requiring higher levels of security. Application: It is a single solution for multiple security problems with minimal cost and highly secured with improved performance. Hence, it can be implemented by banks, financial organization, etc. where security is very significant.

Lightweight Cryptographic MTDAS Algorithm for Wireless Sensor Network Devices

In numerous sensor network devices, security is one of the critical issues. A number of symmetric-key encryption algorithms are employed in sensor network hardware and based on standard cryptography, many security algorithms are enhanced for wireless sensor network devices. However, many of these cryptographic algorithms contain own weakness, such as susceptible to selected plaintext attack, password attacks and computational complexity. In WSN, the security of Radio Frequency Identification (RFID) tags contain drawn wide attention from both academia and industry due to the possible wide RFID exploitation and lightweight cryptography in RFID is a significant mechanism in the security information of RFID devices. Therefore, a lightweight cryptographic Multilanguage Two Dimensional Array Substitution Technique (MTDAS) algorithm is presented for RFID tags in this paper to reduce the computational complexity and increase the security during the deployment. This MTDAS algorithm and its low power computational, sizeoptimized accomplishment goals at very embarrassed devicessuch as passive RFID tags. Our proposed algorithm MTDAS gives cryptographic primitivesat very low cost is of dominant significance for protecting applications of RFID. This MTDA Scryptographic algorithm was implemented by using multilingual characters set table. This table is dynamic in nature, and this type of encryption doesn't have any relationship between cipher text and plaintext, so it is difficult for an intruder to get back the plaintext.

Towards Improving Storage Cost and Security Features of Honeyword Based Approaches

Password based authentication shows its vulnerability against inversion attack model in which adversary obtains plaintext password from its corresponding hashed value. To cope up with such attack, honeyword based authentication technique is introduced. In this technique, along with the original password of user, some dummy passwords or honeywords are also stored. Although this technique is good enough to address the aforementioned security breach, but use of additional storage to store the honeywords is still an overhead associated with such approach. In this paper, we have proposed few directions to minimize the storage cost of some of the existing honeyword generation approaches. We have even found that in some cases no additional storage overhead is required. A comparative analysis at the end also shows that the proposed techniques are able to raise some of the security features compared to existing honeyword generation approaches.

Cracking More Password Hashes With Patterns

It is a common mistake of application developers to store user passwords within databases as plaintext or only as their unsalted hash values. Many real-life successful hacking attempts that enabled attackers to get unauthorized access to sensitive database entries including user passwords have been experienced in the past. Seizing password hashes, attackers perform brute-force, dictionary, or rainbow-table attacks to reveal plaintext passwords from their hashes. Dictionary attacks are very fast for cracking hashes but their success rate is not sufficient. In this paper, we propose a novel method for improving dictionary attacks. Our method exploits several password patterns that are commonly preferred by users when trying to choose a complex and strong password. In order to analyze and show success rates of our developed method, we performed cracking tests on real-life leaked password hashes using both a traditional dictionary and our pattern-based dictionary. We observed that our pattern-based method is superior for cracking password hashes.

Cloudsweeper and data-centric security

Most security online is binary, where being authorized to access a system allows complete access to the requested resource. This binary system amplifies the harm of giving access to an unauthorized individual and motivates system designers to strengthen access control mechanisms to the point where they become so strong as to be nearly insurmountable for illegitimate and legitimate users alike. As a result, Internet users are required to jump through several hoops to access their data: ever longer passwords, multiple authentication factors, or time consuming CAPTCHAs. Users must always provide strong proof of their identity, regardless of whether they want to check their email for something as innocuous as a movie time or as serious as a medical test result. Not surprisingly, users often disable or refuse to use these tedious security options [2, 5, 7]. Users may be better served by a data-centric approach to security, where systems are sensitive to the differing security needs of data, even within a single account or collection. A data-centric approach can apply strong security only when the data being protected warrants it, while allowing users a less encumbered experience the majority of the time. Machine learning techniques can automate the detection of sensitive information, freeing users from the tedious task of sorting their data into low and high security categories. With less friction involved in securing their data, users may be more likely to use strong security where available, resulting in a more secure Internet for everyone. We present Cloudsweeper , a tool that applies a data-centric approach to security to the specific case of plain text password sharing in Gmail accounts. Cloudsweeper detects and applies an additional layer of encryption to plain text passwords in a user's email account, while allowing the user to access the rest of their email archive as normal. Public use of Cloudsweeper shows that such a data-centric approach to securing data can be an effective way of providing users more security while still being acceptably convenient.

Password Cracking Based On Rainbow Tables With A Dynamically Coarse Grain Reconfigurable Architecture

Abstract Rainbow attack is a very efficient attack which uses rainbow tables to offer an almost optimal time-memory tradeoff in the process of recovering the plaintext password from ciphertext hash. In this paper, we proposed a new method which can crack DES password quickly with less power consumption on a coarse grain reconfigurable architecture (CGRA) named reconfigurable encrypt-decrypt system (REEDS). To the best of our knowledge, this is the first try for password cracking based on “Rainbow Tables” under a dynamically CGRA platform presented in the literature. High parallel computing capability and good flexibility make the platform an excellent candidate to process multimedia application, encryption and decryption algorithm etc. In this paper, the whole work of DES password cracking based on rainbow tables is split into several sub tasks, which are mapped onto REEDS respectively and executed in parallel using pipeline approach. Experimental results show that the proposed system with 200 MHz clock r...

Provable Secured Hash Password Authentication

techniques such as secured socket layer (SSL) with client- side certificates are well known in the security research community, most commercial web sites rely on a relatively weak form of password authentication, the browser simply sends a plaintext password to a remote web server, often using SSL. Even when used over an encrypted connection, this form of password authentication is vulnerable to attack. In common password attacks, hackers exploit the fact that web users often use the same password at many different sites. This allows hackers to break into a low security site that simply stores username/passwords in the clear and use the retrieved passwords at a high security site. While password authentication could be abandoned in favor of hardware tokens or client certificates, both options are difficult to adopt because of the cost and inconvenience of hardware tokens and the overhead of managing client certificates. Recently, some collisions have been exposed for a variety of cryptographic hash functions including some of the most widely used today. Many other hash functions using similar constructions can however still be considered secure. Nevertheless, this has drawn attention on the need for new hash function designs. This work developed an improved secure hash function, whose security is directly related to the syndrome decoding problem from the theory of error-correcting codes. The proposal design and develop a user interface, and implementation of a browser extension, password hash, that strengthens web password authentication. Providing customized passwords, can reduce the threat of password attacks with no server changes and little or no change to the user experience. The proposed techniques are designed to transparently provide novice users with the benefits of password practices that are otherwise only feasible for security experts. Experimentation are done with Internet Explorer and Fire fox implementations and report the result of initial user. The hash is implemented using a Pseudo Random Function keyed by the password. Since the hash output is tailored to meet server password requirements, the resulting hashed password is handled normally at the server with no server modifications are required. This technique deters password phishing since the password received at a phishing site is not useful at any other domain. The cryptographic hash makes it difficult to compute hash(pwd,dom2) from hash(pwd,dom1) for any domain dom2 distinct from dom1. For the same reason, passwords gathered by breaking into a low security site are not useful at any other site. The hash attack is always exponential in terms of the length of the hash value. We also study the work-factor of this attack, along with other attacks from coding theory, for non asymptotic range, i.e. for practical values. Accordingly, we propose a few sets of parameters giving a good security and either a faster hashing or a shorter description for the function.