Password similarity checking using homomorphic encryption operations
Various embodiments include systems and methods to implement a password requirement conformity check. During a password reset process, a proposed password is received. A homomorphic encryption operation may be performed on the proposed password to generate a first character string. The first character string may be compared to a previous character string associated with a previous password to determine a password similarity metric. The password similarity metric may or may not satisfy at least a distance threshold. Responsive to determining that the password similarity metric does not satisfy the distance threshold, there may be a rejection of the proposed password and a prompt to receive an alternative proposed password during the password reset process.
1. A system, comprising:
a password management system implemented by a one or more computer systems, configured to:
perform a password conformity check on a first password, including to:
perform a homomorphic encryption operation on the first password to obtain a first character string, wherein the homomorphic encryption operation when performed on two given strings produces two encrypted strings that preserve a distance between the two given strings;
compare the first character string to a previous character string stored in a password data store and generated by the homomorphic encryption operation on a previous password to determine a first password similarity value between the first password and the previous password; and
based on the first password similarity value, reject the first password and request an alternative password;
perform the password conformity check on the alterative password, including to:
perform the homomorphic encryption operation on the alternative password to generate a second character string;
compare the second character string to the previous character string to determine a second password similarity value;
accept the alternative password based on the second password similarity value; and
store the second character string generated from the alternative password in the password data store.
2. The system of claim 1 , wherein the password management system is configured to perform the password conformity check as part of a periodic password reset process.
3. The system of claim 1 , wherein the first similarity value is a first edit distance between the first character string and the previous character string, and the second similarity value is a second edit distance between the second character string and the previous character string.
4. The system of claim 3 , wherein the first edit distance counts a minimum number of edit operations to transform the previous character string into the first character string, wherein the edit operations include one or more character insertions, character deletions, or character replacements.
5. The system of claim 4 , wherein the password management system is configured to reject the first password based on an edit distance threshold.
6. The system of claim 5 , wherein the password management system is configured receive configuration input to tune the edit distance threshold.
7. The system of claim 1 , wherein:
the alternative password is associated with a user account; and
the password management system is configured perform the password conformity check on the alternative password against multiple previous passwords of the user account that satisfy a recency threshold.
8. The system of claim 1 , wherein the password conformity check performs a check of the alternative password against a password complexity requirement.
9. The system of claim 1 , wherein to reject the first password, the password management system is configured to prevent leakage of information about the previous password through repeated password change attempts.
10. The system of claim 1 , wherein the homomorphic encryption operation is performed using an encryption key, and the encryption key is stored separately from the password data store.
11. A method, comprising:
performing, by a password management system implemented by a one or more computer systems:
performing a password conformity check on a first password, including:
performing a homomorphic encryption operation on the first password to obtain a first character string, wherein the homomorphic encryption operation when performed on two given strings produces two encrypted strings that preserve a distance between the two given strings;
comparing the first character string to a previous character string stored in a password data store and generated by the homomorphic encryption operation on a previous password to determine a first password similarity value between the first password and the previous password; and
based on the first password similarity value, rejecting the first password and requesting an alternative password;
performing the password conformity check on the alterative password, including:
performing the homomorphic encryption operation on the alternative password to generate a second character string;
comparing the second character string to the previous character string to determine a second password similarity value;
accepting the alternative password based on the second password similarity value; and
storing the second character string generated from the alternative password in the password data store.
12. The method of claim 11 , wherein the password conformity check is performed as part of a periodic password reset process.
13. The method of claim 11 , wherein the first similarity value is a first edit distance between the first character string and the previous character string, and the second similarity value is a second edit distance between the second character string and the previous character string.
14. The method of claim 13 , wherein the first edit distance counts a minimum number of edit operations to transform the previous character string into the first character string, wherein the edit operations include one or more character insertions, character deletions, or character replacements.
15. The method of claim 14 , wherein the first password is rejected based on an edit distance threshold.
16. The method of claim 15 , further comprising the password management system receiving configuration input to tune the edit distance threshold.
17. The method of claim 11 , wherein:
the alternative password is associated with a user account; and
the password conformity check of the alternative password is performed against multiple previous passwords of the user account that satisfy a recency threshold.
18. The method of claim 11 , wherein the password conformity check of the alternative password includes a check of the alternative password against a password complexity requirement.
19. The method of claim 11 , wherein the rejecting of the first password prevents leakage of information about the previous password.
20. The method of claim 11 , wherein the homomorphic encryption operation is performed using an encryption key, and the encryption key is stored separately from the password data store.