MIPRO 2018, May 21-25, 2018, Opatija Croatia

 
 
 
 
  


    

 ! "# $
 %

% &  & ' 

()  )  
"# 
 ! 
 #  ** #  # *


$EVWUDFW$QLQIRUPDWLRQV\VWHPLVRQO\DVVHFXUHDVLWV !       && 
 
ZHDNHVWSRLQW,QPDQ\LQIRUPDWLRQV\VWHPVWKDWUHPDLQVWR  &  &  
EHWKHKXPDQIDFWRUGHVSLWHFRQWLQXRXVDWWHPSWVWRHGXFDWH >   !  &         
 
WKH XVHUV DERXW WKH LPSRUWDQFH RI SDVVZRUG VHFXULW\ DQG   #
 &# 
HQIRUFLQJSDVVZRUGFUHDWLRQSROLFLHVRQWKHP)XUWKHUPRUH  <;=
QRW RQO\ GR WKH DYHUDJH XVHUV¶ SDVVZRUG FUHDWLRQ DQG
PDQDJHPHQW KDELWV UHPDLQ PRUH RU OHVV WKH VDPH EXW WKH @!    A& #! 


  
SDVVZRUG FUDFNLQJ WRROV DQG PRUH LPSRUWDQWO\ WKH
    
 &       
FRPSXWHU KDUGZDUH NHHS LPSURYLQJ DV ZHOO ,Q WKLV VWXG\ 0          &  
ZH SHUIRUPHG D EURDG WDUJHWHG DWWDFN FRPELQLQJ VHYHUDO #
     & 
#    
ZHOOHVWDEOLVKHG FUDFNLQJ WHFKQLTXHV VXFK DV EUXWHIRUFH
    
     # 
GLFWLRQDU\ DQG K\EULG DWWDFNV RQ WKH SDVVZRUGV XVHG E\ $   !    
   !
WKH VWXGHQWV RI D 6ORYHQLDQ XQLYHUVLW\ WR DFFHVV WKH RQOLQH    
  
   ,


JUDGLQJV\VWHP2XUJRDOZDVWRGHPRQVWUDWHKRZHDV\LWLV    &
 & B
   
   
WR FUDFN PRVW RI WKH XVHUFUHDWHG SDVVZRUGV XVLQJ VLPSOH       &        
DQG SUHGLFWDEOH SDWWHUQV 7R LGHQWLI\ GLIIHUHQFHV EHWZHHQ
    >   &    
 &  
WKHP ZH SHUIRUPHG DQ DQDO\VLV RI WKH FUDFNHG DQG
  & 
     
 
XQFUDFNHG SDVVZRUGV DQG PHDVXUHG WKHLU VWUHQJWK 7KH
       <C=
UHVXOWV KDYH VKRZQ WKDW HYHQ D VLQJOH ORZ WR PLGUDQJH
PRGHUQ*38FDQFUDFN RYHURISDVVZRUGVLQMXVWIHZ ?        
 
GD\V ZKLOH D PRUH GHGLFDWHG V\VWHP FDQ FUDFN DOO EXW WKH && &   #    
VWURQJHVWRIWKHP
 & &


 
! & &  &&
0     !
   &   
Keywords ± password cracking; password security; brute  & 
 
 
  #
 B & A
force attack; dictionary attack; hashed passwords
  !  # ! 
  

    & &         
) )+,-./ ',).+  ,  !

  
0  #  
      

&&& <2=

    &  & 

     

 $  
#& #
 
 1 &  D    &1!
 
#  
 
   ! 
  & !   &    #
 &  
       
  ,      ! #  
  &  & 
    
  23  &    "    ,   
 
   &#
 
    +)4   
 >  



  &         & !    &       

    

  ,

   &  5       

     #!#


 /%6     
    7 
 <E= >     

  #
  
  #         
 #
  ! 
 
 
 ,    &    
! #
    

F!    


 &  8  


    &      # 
!&'0  93:   & 
#     !
   D 

;3 
 ,        
      
  &  &  
       #   
#   >   
  
B 
  
 <9=  
 & #  
 &   # 
> 
       # $     #       
 & 
?        
  #    
# <8=
 

 &      &   ,       

     
 ! ,

        !  #      

   !G  

 
    #


1161
& &    #         >"/- -Y;X34XF ->"5//-C98330'C
  
#       1  9;X33 YYY;2 '>Y6   E28:3 5*2FAD6 
     
 #   

 & 1  930 57826.


 B  

   
  $    "/E  
   &   
       


    7XY33"A() 



  


      
1 dF$ 
, 
 &#    4 0
 82F  ->" 5//-2 ;233 0'2 9Y;33 98
98986 :8:335*2FAD6 7" 57826.
)) />,>>'W )),).+ 
#    & #
 

 7XXE33"A(
9XE82C     "/E A>9   A>;E8
   5      76  
B  >7

& ,#),

 9E99C8   B , 
 #  & #   
 
9YX3   ;39C       

   !G       


&  B
 #
  & &  ,          

7
 
   ,       
  
 
 &! 
  &      
 &  
     
  
    
  
!  G    $ 
   # ,  !      &       
 
 
 
   
   
      

 ) 
  7 &        ,  9E2E3E    &
 
  
  
#   
5XC;CZ6     
 922;E3 5:::Z6         &  )     #

   93;EE5EE;Z6            

 #
# 
,   C99CX 598::Z6      & 
 

& 
A. Brute-force approach
0!   &  # #
 
     
#   <9= <;=   <C= 0        
  
0   &     ! !  # !    
 &     
      &   
  
  &
!    
 '
 &   
   
 &             
    7 ;3 
  
   
#  <:= >      922;E3 
 5       


      #       
 6 !  
    %
 
        

    &
 #  93    ;3
        , 
 # & 
     

 [\G  []G   !   [G [^G   [_G 

! & # &  
/
    &&   &   #    #
 

#   #    #  & & % & #  
 
+7
    # 
   
  
 
 
  7

 
    & 
 
 
#     &  & ;     9; 
    &
# <X= 9;3E8   ,     #    
&   &!  !



%


      "     C     9X 
  

 8E8
   &  
   $   
     &
 &    #  
    #    
 
 

 $
 D# !
!
G 
   


 
 &  &&
,   
           

      &     

    #
 5&  6      
  


   
 

   
   >
 99 5;6 >
 9C 5;6 
, 
  
 >
C;5C6 /0 
 /
!<Y=  
   &   && > 
 &
 


5[G6 

))) %4%' ,).+.$,A%>,,>'?       #  & 
   #
 
   

       &  :
&     


  

     93     
#  !          
 
 &

 
 &&

   
 



 
  `b 5 9X9 6 `^b 5 983 ,


&   
6 `_b5:26`]b59C6  !  &  &  
 `\b526
 & 
       
  
   
#  &     c& !

    
  1   

 )   

 
 
   # 
   # #  

 


  )/


>
  &
!233 
 7#    # )      
7    
    & F0 

1162
 ,>%) >0%-$.-"%/>,,>'?1),A +)W %0>1.-/'. +,>+/,)"%.$%4%' ,).+

$WWDFN &RXQW  7LPH

6\VWHP
6HT
QR $//$WWDFNV   aKRXUVPLQ

 %UXWHIRUFH   aKRXUVPLQ

9 9 . 5; 

  #2&6 99E2YX :8XY ;3


; 9 )
   &757
 6 9;3E8 X3C ; 9;


C 9 /&   &: 9; 8E8 322 C 9:



2 9 )
   &X5 

 
6 :3Y2 2:; ;; 8


E 9  &Y 9357
 

 6 ;3:9 9CX ># eC3 

8 9 )
   &Y5 &  &&
6 C8 33C ># e9E 

92 9 ) ! 57  &X6 Y:39 828 93 ;3 

98 ;  &93 
% &# 8: 33E 2Y CC


9: ;  &93 
% &# & ;;; 39E e;3 

 'LFWLRQDU\   VHF

X 9 8:23Y8 
  ;2X 39: 9


93 9 922E:;82 
  C8 33C 9


 &RPELQDWRU   PLQVHF

: 9 928E; 
 
#  ;3; 39C 9


9; 9 8:23Y8 
 
#  X93 3E2 ; CC


 +\EULG   KRXUVPLQVHF

Y 9 928E; 
  &2
 
#  :C 33E 8 23


99 9 8:23Y8 
  &2
 
#  EY3 3CY 8 ;8


92 ; ;9EF
 
   &E#  C2 33; ; : 

9E ; 5XOHV5;9EF
 

6   PLQVHF

9C 9 2QOLQHGDWDEDVH   aPLQ

 
  ,      # & 
B. Dictionary attacks !      58:23Y8 6 
 
>& 
 
 7
  


  & 


 #    & 

    
    
! 
   
 
  
# >&&    
#   


 <C= <2= 
 
  
      !  &&   #  >   #   # &  
    

  
       

 && #  & 
 
  , 

       &    
           , 
 
  &  
      !


 
  #  #B 
 && &  #  !   
,  
! 

 
  &922E:;82 59C2"6
  
#    #  &
#  
 &  
 $   #  
#   
        

 #  

  
 $
        7
 &  # 
 ,
8:23Y8 # !   
        5928E; 6 Y;? 
  
# 
 && 58XC"6      >  & ;9EF 

928E; 5Y;?6
 
  /
 
7
  &#
 
    5    !  6   
  
     #
 # 

 #
#       #    2  ,   
   


5
 &  6  


  9E   &      
    9
 #    
 
 
& 
 && &
  & 
 &
 
! # 
A
 #

  & 
   %!   
    
#   

 #
   &      
#   
 1 &  
 &   ,  
  &
!   &   &   #
  
 &    #         

1163
# 
   
 
  7 &    #&
    


#
1       
      
 1    &  #   

!     

#   
 #  %                
 7##

  !    
  <9;
 
# & 92=)  
 "# 


     + #
B
      " &;5+6 ,# ))
  
C. Rule-based attack ! #    &!   
-
  #        
      &  # 
   #
#     & 
    


 &


  !!    ,
 #    
 #

g
 
 
7   
          ;Y 
[G & & &#

 
)  
  Y

 )  #       #
 0      #      & 
,
      

  `#!D  &b    
 &     

  # & ` 8Cb ,    

    

 



  #5 &       

 & 
   6 !       
! 
,   &D 
&    , !   CC;9Y#   . 
  &
 &   
 #        &  7    
  

   !  
 A !   
  
  


 
#  
   &     #  0 !         
 
7        C;92EC   !  B  
 

  5

  C3     !&  

    
  !6 #        & &     ! %      ! 
  2YCEY2# &##  &
 &&! 


  >
D. Pre-computed wordlists " 1      


0    
            & 
      
#  

,   

 5Uh2;CEX9k33336
  

   
  >   &  
   &  


.    !# 
         
 
 #  #  &    &  & 
 )  
  &         
> &   9Y3F 9E#     #  7    &      


!# 

  <93=  ! X;Y:;8#    # 
+ 

"/E 

<99=7   #   &>  & 
 # &  
,      

     !
!  #  &    
#     
 !A !#

 
 !  
 
     
    #  
  
   
  # &          
     

 &

  #  
#% &   ,#)))1"/E
  &
 &  && #  #   
  

 &    #
#> !
 
 A>
)d >+>c) 9/# &
 #  
    &  

.   9XE82C   YEC 53E9Z6    
 #

        ,

 

  
Y;C53EZ6 B

 #' 
 E) &
,!  &

 &
 
  
    
    
   
, # 


 & ,          
 
 # !  &      
!# 

 

# 
%!  & #
 

  
 #
  # 

 &
   
g
     &    & 
,>%)) A>A$ +',).+%,)">,%/'->'?)+F,)"%
,>%))) 0>1.-/%+,-.0c
(VWLPDWHGWLPHGHVNWRS3&
(QWURS\ +DVK
3DVVZRUGV IXQFWLRQ Brute-force Dictionary
Average (Std. Dev.) Min Max (second pattern) (6.83MB)
> CCC;Y858X3CC6 CC;9Y 92C8:9: "/E 93 C:  8

'
 CC92YE58;Y9C6 CC;9Y 92C8:9: A>9 ;9 2C  :



 8X;C;359933:86 2C839: 99XE;YC #'5E6 l93 C3X9X 

1164
 ,>%)d +)W %'->'?%/>+/ +'->'?%/0>1.-/ ,>%d +)W %'->'?%/>+/ +'->'?%/0>1.-/
'."0>-%/c0>1.-/%+F,A '."0>-%/c'A>->',%-%,

3DVVZRUGV 3DVVZRUGV
&KDUDFWHU
/HQJWK &UDFNHG 8QFUDFNHG &UDFNHG 8QFUDFNHG
VHWV
Count % Count % Count % Count %

> & 9E3;9C 93333 Y;C 93333    9;2::E XC3: EX: 8C83

92

 92:9 3YX 3 333 7  93;99 8X3 9 399

E

 9C98 3XX 3 333   :Y9; E;: 9Y8 ;9;2

8

 9;2YYY XC;9 3 333 
 828X 2C9 9 399

:

 C32: ;3C ; 3;;   ;:; 39X 3 333

X

 92Y82 YY8 C 3CC  
  Y; 338 E2 EXE

Y

 ;322 9C8 9C 929  
 :8 33E 9X 9YE

93

 9CE: 3Y3 C9 CC8 
  9; 339 3 333

99

 2X; 3C; ;2; ;8;; 
 2 333C 3 333

9;

 ;:8 39X ;3: ;;2C  9 3333: 3 333

9C

 9E2 393 92E 9E:9 7
  3 333 : 3:8

92

 83 332 99X 9;:X 
   
         #    
9E

 ;8 33; Y: 93E9 5     ` b6 1G   
 
98

 92 339 ;; ;CX    !    
  
  

  #   
 
  
 
9:n

 C 333; 2C 288   !  !, & 
    !# 
  #        
x "/EgE:3X8"A( % &       
    && #
+!  
  # &   
#  
x A>9g;:Y;3"A( <2= #   
 
x #'g2:89A( 1   # 

 
.     &        &    
 # !            
  # 

 &         
&  &7
 
 &         

   
 

  # 7 ) # &  
  &
  &
  1 
 

 & 
    


 

 
!          #  # #  
 & F     &    
 
 
   & & 
  >  
 7    

 & # &   

      ;33    
     
 #

  #
+7 ,# )d
     
    

   & )     !    
! &   &

 7    
       
  & #

> #  & ,#d))   #  
   9;

  !   
    &! >  Y9Y3;52YEZ6 
      
  &

  
> ,# d &&  &   
 ,>%d) 0>1.-/'."0>-%/c,A%%4.$,A% %-
   &   
      &
7
 
          6H[
 7RWDO

# .#!     
  7
   Male Female
  


           

  Count Y9Y3; Y;:XX 9X28Y3
<HV
&UDFNHG

.      

    % of total 2YE3 2YYX YY2Y

  
 
#      Count EYC C83 YEC
  
 7       
  1R
-
#! #  
  % of total 3;Y 39Y 3E9
   #      &      Count Y;2YE YC92X 9XE82C
  
      !    7RWDO
!    !   & ) 

   % of total 2XXC E39: 93333

1165
# Y;:XX52YYXZ6 #    ,
  #  
 #  & 



 $     " 1   

             
 #   &
  #!  

  
 #  
, 
 


 & 
 &  !  #          <9E= 0   

 # 5U = 2;;:E92Y38E
  
 & 
   


k33336> &

  #
 
 &
 #   ,      
  

 
  > &
7 
      ,   & 
         #      


    

 #       ! !
 &
 &
7 !5U h93;X38h3CC:6  
   #   # 
 # 
   
 

 1  


 G  
   # 
 !&
 
& 
 # #   # 
 #        7
  G    !   
 # 7    &  
 
       5 h 3;39  k 33336 , 
#' 
    

  & 

 7  
  ! & ! 
 
$ !   !& # -%$%-%+'%
 G g 
 
 <9= - "    ? ,   `0  
g > '
 
 
   1
   A b Commun. ACM !  ;;  99  EY2sEY: + !
       
     9Y:Y
# & &  9:XE9X , 
 <;= / ' $   0 - ?  ` +)4   
   
 b Y >  )    '  & ' 
 
  ?1  
      >!
 '  &228C9YXY
& 
  
 #   
     <C= " @!    1  A& `0  
g   

 & 5
  gq;5;6hX:292Y b   " & )   ! 9E
k33336      989s9XE9YYY
& 
 
#    &  <2= /? `$  &

g>!   !  
,   
C;E8  #   
b 0
 &   ;  %+)4 

CCYC      C23;    
 C23C:   1  E929YY3
C2322 
 
  


! <E=  %&  >      ) " ! ? D  !  
'A`/ "0 F   %! ug,)
 
0  "  0  
 b   0
 &  
d '.+' ).+ )F'A) ' 
  A  $
    '  & 
;39C;C:Ys;CXX
%!  &  
 

 <8= d ,  " A^       `)
  

#   7

  %
  0 ' &b)    '  
 
! +      &      ,
  & %
 
   "
 
 
 5")0-.6 CX
 

#
 
  )   ' !  ;39E9CE9s9CEE
!      $   !# <:=          `1        
 & &#
& &    ub )      '  
 
,
  & %
 
   "
 
 
 5")0-.6 CY
   &    
   #
 !   )   ' !  ;39892C3s92CE
!
<X=      , " `-
   v  
>  & #  &  
b )      '  
  ,
  &
%
 
   "
 
 
 5")0-.6 23 )   
&  #     ' !  ;39:92Y9s92YE
&7
 # 
 
<Y= `% -7b/
!YE(28(%' %  0  
   
& ! #    !&  )  ' 
 ;2.
 #9YYE  
   !
          
  &    &    
 &         

   ,    
    !   
  9YYE <.  = >!#g g((
 
 #  !&  !   7 (7 !(7 ! uh'%%4gC9YYE33
>   &          28g gA,"

g>;398

<93= '
  <.  = >!#g g((

  (

 
 #
   

/
#;39:
$         &     <99= A?
 <.  = >!#g g((
(
E
7

/
#;39:

 #    &        <9;= "  "D   `" & 0  F#    
           7   %  !b >'" )F>'

  '  w

#   
/
, '  
 
;39C9:C9X8
&    
   &      &  
 <9C= 0 F ? `F >&  5  >&    >& 6g " &
  &       :::8   0   & #  & 0 '
 &
>& b)%%%  
 0!
;39;
!#     && 1     E;CEC:
 ! #      7 %
      <92= " " , `.     &  g 0 

 #   &  
 !  +#        Bb)   '  '  &

  ! #  

     7   %

 %
 
% &  &;39C2Y:E39
     
   &          <9E= /
 <.  = >!#g g(( 
(e  (



$#;39X

! %
        9;Y # 

1166