Passwords should be easy to remember, yet expiration policies mandate their frequent change. Caught in the crossfire between these conflicting requirements, users often adopt creative methods to perform slight variations over time. While easily fooling the most basic checks for similarity, these schemes lead to a substantial decrease in actual security, because leaked passwords, albeit expired, can be effectively exploited as seeds for crackers. This work describes an approach based on Bloom Filters to detect password similarity, which can be used to discourage password reuse habits. The proposed scheme intrinsically obfuscates the stored passwords to protect them in case of database leaks, and can be tuned to be resistant to common cryptanalytic techniques, making it suitable for usage on exposed systems.

Davide Berardi, FRANCO CALLEGATI, Andrea Melis, MARCO PRANDINI (2021). Password Similarity Using Probabilistic Data Structures. JOURNAL OF CYBERSECURITY AND PRIVACY, 1(1), 78-92 [10.3390/jcp1010005].

Password Similarity Using Probabilistic Data Structures

Davide Berardi;FRANCO CALLEGATI;Andrea Melis
;
MARCO PRANDINI
2021

Abstract

Passwords should be easy to remember, yet expiration policies mandate their frequent change. Caught in the crossfire between these conflicting requirements, users often adopt creative methods to perform slight variations over time. While easily fooling the most basic checks for similarity, these schemes lead to a substantial decrease in actual security, because leaked passwords, albeit expired, can be effectively exploited as seeds for crackers. This work describes an approach based on Bloom Filters to detect password similarity, which can be used to discourage password reuse habits. The proposed scheme intrinsically obfuscates the stored passwords to protect them in case of database leaks, and can be tuned to be resistant to common cryptanalytic techniques, making it suitable for usage on exposed systems.
2021
Davide Berardi, FRANCO CALLEGATI, Andrea Melis, MARCO PRANDINI (2021). Password Similarity Using Probabilistic Data Structures. JOURNAL OF CYBERSECURITY AND PRIVACY, 1(1), 78-92 [10.3390/jcp1010005].
Davide Berardi; FRANCO CALLEGATI; Andrea Melis; MARCO PRANDINI
File in questo prodotto:
File Dimensione Formato  
jcp-01-00005.pdf

accesso aperto

Tipo: Versione (PDF) editoriale
Licenza: Licenza per Accesso Aperto. Creative Commons Attribuzione (CCBY)
Dimensione 684.46 kB
Formato Adobe PDF
684.46 kB Adobe PDF Visualizza/Apri

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11585/788911
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 6
  • ???jsp.display-item.citation.isi??? ND
social impact