Method and system for password protocols in the bounded retrieval mode with security dictionary attacks and intrusions
Efficient secure password protocols are constructed that remain secure against offline dictionary attacks even when a large, but bounded, part of the storage of a server responsible for password verification is retrieved by an adversary through a remote or local connection. A registration algorithm and a verification algorithm accomplish the goal of defeating a dictionary attack. A password protocol where a server, on input of a login and a password, carefully selects several locations from the password files, properly combines their content according to some special function, and stores the result of this function as a tag that can be associated with this password and used in a verification phase to verify access by users. Two main instantiations of our method are given; in one, a combination of mathematical tools, called dispersers and pairwise-independent hash functions is used to achieve security against adaptive intrusions (dispersers make sure that the password of each user depends on randomly chosen locations in a large password file, and pairwise-independent hash functions help in making this dependency sufficiently random); in a second one, a combination of mathematical tools, called k-wise independent hash functions and locally-computable and strong extractors (k-wise independent hash functions make sure that the locations chosen in the large password file from each password are sufficiently random, and locally-computable and strong extractors are used to combine the contents of these locations to generate a single long random value, which makes verification harder for the adversary to foil).
1. A method of constructing login/password protocols for registering and verifying logins/passwords in a server comprising the steps of:
registering the logins/passwords comprising the steps of:
selecting memory storage locations fewer than all memory storage locations in the server for login/password data based on the login/password data;
combining random content of the selected memory storage locations into a first tag; and
storing the first tag; and
verifying the logins/passwords comprising the steps of:
selecting memory storage locations based on the login/password data;
combining random content of the selected memory storage locations into a second tag; and
verifying that the second tag matches the stored first tag;
wherein said selecting memory storage locations selects a quantity of locations in the range [c*log d, m], where d is the number of bits in the password, m is the total quantity of memory storage locations and c is a number that is independent of d and m; and
wherein said selecting memory storage locations includes using extractors and said combining random content uses a pairwise independent hash function.
2. A method of constructing login/password protocols for registering and verifying logins/passwords in a server comprising the steps of:
registering the logins/passwords comprising the steps of:
selecting memory storage locations fewer than all memory storage locations in the server for login/password data based on the login/password data;
combining random content of the selected memory storage locations into a first tag; and
storing the first tag; and
verifying the logins/passwords comprising the steps of:
selecting memory storage locations based on the login/password data;
combining random content of the selected memory storage locations into a second tag; and
verifying that the second tag matches the stored first tag;
wherein said selecting memory storage locations selects a quantity of locations in the range [c*log d, m], where d is the number of bits in the password, m is the total quantity of memory storage locations and c is a number that is independent of d and m; and
wherein said selecting memory storage locations includes using k-wise independent hash functions and said combining random content is based on the content
returned by said selecting memory storage locations and extractors.
3. A server for constructing login/password protocols for registering and verifying logins/passwords comprising:
means for registering the logins/passwords comprising:
means for selecting memory storage locations fewer than all memory storage locations in the server for login/password data based on the login/password data;
means for combining random content of the selected memory storage locations into a first tag; and
means for storing the first tag; and
means for verifying the logins/passwords comprising:
means for selecting memory storage locations based on the login/password data:
means for combining random content of the selected memory storage locations into a second tag; and
means for verifying that the second tag matches the stored first tag;
wherein said selecting memory storage locations selects a quantity of locations in the range [c*log d, m], where d is the number of bits in the password, m is the total quantity of memory storage locations and c is a number that is independent of d and m; and
wherein said means for selecting memory storage locations includes using extractors and said means for combining random content uses a pairwise independent hash function.
4. A server for constructing login/password protocols for registering and verifying logins/passwords comprising:
means for registering the logins/passwords comprising:
means for selecting memory storage locations fewer than all memory storage locations in the server for login/password data based on the login/password data;
means for combining random content of the selected memory storage locations into a first tag; and
means for storing the first tag; and
means for verifying the logins/passwords comprising:
means for selecting memory storage locations based on the login/password data:
means for combining random content of the selected memory storage locations into a second tag; and
means for verifying that the second tag matches the stored first tag;
wherein said selecting memory storage locations selects a quantity of locations in the range [c*log d, m], where d is the number of bits in the password, m is the total quantity of memory storage locations and c is a number that is independent of d and m; and
wherein said means for selecting memory storage locations includes using k-wise independent hash functions and said means for combining random content is based on the content returned by said means for selecting memory storage locations and extractors.