On the Economics of Offline Password Cracking

Abstract

We develop an economic model of an offline password cracker which allows us to make quantitative predictions about the fraction of accounts that a rational password attacker would crack in the event of an authentication server breach. We apply our economic model to analyze recent massive password breaches at Yahoo!, Dropbox, LastPass and AshleyMadison. All four organizations were using key-stretching to protect user passwords. In fact, LastPass' use of PBKDF2-SHA256 with 10 5 hash iterations exceeds 2017 NIST minimum recommendation by an order of magnitude. Nevertheless, our analysis paints a bleak picture: the adopted key-stretching levels provide insufficient protection for user passwords. In particular, we present strong evidence that most user passwords follow a Zipf's law distribution, and characterize the behavior of a rational attacker when user passwords are selected from a Zipf's law distribution. We show that there is a finite threshold which depends on the Zipf's law parameters that characterizes the behavior of a rational attacker -if the value of a cracked password (normalized by the cost of computing the password hash function) exceeds this threshold then the adversary's optimal strategy is always to continue attacking until each user password has been cracked. In all cases (Yahoo!, Dropbox, LastPass and AshleyMadison) we find that the value of a cracked password almost certainly exceeds this threshold meaning that a rational attacker would crack all passwords that are selected from the Zipf's law distribution (i.e., most user passwords). This prediction holds even if we incorporate an aggressive model of diminishing returns for the attacker (e.g., the total value of 500 million cracked passwords is less than 100 times the total value of 5 million passwords). On a positive note our analysis demonstrates that memory hard functions (MHFs) such as SCRYPT or Argon2i can significantly reduce the damage of an offline attack. In particular, we find that because MHFs substantially increase guessing costs a rational attacker will give up well before he cracks most user passwords and this prediction holds even if the attacker does not encounter diminishing returns for additional cracked passwords. Based on our analysis we advocate that password hashing standards should be updated to require the use of memory hard functions for password hashing and disallow the use of non-memory hard functions such as BCRYPT or PBKDF2.

Why Botnets Work: Distributed Brute-Force Attacks Need No Synchronization

“…The statistics of password generation were studied in [25][26][27][28]. Password frequencies have been shown to follow closely variants of the Zipf's law distribution.…”

“…Password frequencies have been shown to follow closely variants of the Zipf's law distribution. In particular, the so-called CDF-Zipf's law model introduced in [25,26] is a modification of the Zipf's law which captures the frequencies of passwords, both for very frequent passwords, and the tails, as exhibited by the close empirical fit to multiple password datasets (see [26,25,27]). Note that an adversary can benefit greatly from the the non-uniformity of these distributions to design more powerful brute-force attacks.…”

Study on Massive-Scale Slow-Hash Recovery Using Unified Probabilistic Context-Free Grammar and Symmetrical Collaborative Prioritization with Parallel Machines

“…Recently, Blocki et al [20,29,30] proposed theoretical, economic models to evaluate the economics of offline password cracking for different slow-hash algorithms. However, they did not realize that password reuse could be a major contribution to boost slow-hash recovery.…”

Centralized vs Decentralized Targeted Brute-Force Attacks: Guessing With Side-Information

“…We also mention several papers which are relevant in the study of password generation and brute-force attacks such as [23][24][25][26]. In [26], a large corpus of password datasets is studied, and several quantities of interest, such as Guesswork, are empirically evaluated.…”

“…PDF-Zipf and CDF-Zipf), and validate this model on real-world datasets. The modeling according to a CDF-Zipf's law has also been validated in [25]. We refer to the aforementioned references for more details on the subject.…”