Brute force analysis of PsychoPass-generated Passwords

Abstract

Background: Recently, Cipresso et al proposed a novel method for generating textual passwords. The PsychoPass password can be created, memorized and recalled by thinking of an action sequence instead of a string of characters.Objective: The objective of this paper is to analyze how and when the PsychoPass passwords are resilient to brute force attacks and how they compare to randomly generated ones.Methods: The PsychoPass method was studied analytically. The number of possible different passwords that can be created using PsychoPass method was calculated for different possible settings.Results: The PsychoPass generates passwords that are resilient to brute force attacks with password lengths comparable to those generated randomly. A PsychoPassgenerated password with 18 characters is as strong as a completely randomly generated password of length 11 characters with mixed upper and lowercase letters, numbers and symbols, but can easily be remembered. Conclusion: The PsychoPass method is an alternative to the existing passwords and is resilient to brute force attack.There is no known dictionary to enable the dictionary attack. The PsychoPass passwords look like random ones, eg. »aEy|dX%7Tu]6hJ«, but a user can easily remember it based on the action sequence instead of remembering its characters.

System-Assigned Passwords: The Disadvantages of the Strict Password Management Policies

“…All in all, there are 45 1 • 54 13 (= 1.493.933.931.608.915.411.066.880 = 1,4E+24) different passwords of length 14, although PsychoPass passwords of length 10 are sufficient today (Brumen et al, 2013) and those of length 11 should be sufficiently safe in ten years from now. A detailed discussion on the strength of the psychopass passwords can be found in Brumen and Černezel (2014).…”