论文标题
关于离线密码破解的经济学
On the Economics of Offline Password Cracking
论文作者
论文摘要
我们开发了一个离线密码饼干的经济模型，该模型使我们能够对账户的比例进行定量预测，而该帐户的比例是，在身份验证服务器漏洞的情况下，理性密码攻击者会破裂。我们应用经济模型来分析Yahoo！，Dropbox，LastPass和Ashleymadison的最新大规模密码漏洞。这四个组织都使用钥匙拉伸来保护用户密码。实际上，LastPass使用$ 10^5 $哈希迭代的PBKDF2-SHA256超过了2017年NIST最低建议按数量级。尽管如此，我们的分析描绘了一幅惨淡的图片：采用的钥匙拉伸级别为用户密码提供了不足的保护。特别是，我们提供了有力的证据表明，大多数用户密码都遵循ZIPF的法律分布，并在从ZIPF的法律分布中选择用户密码时表征了理性攻击者的行为。我们表明，有一个有限的阈值取决于ZIPF的定律参数来表征理性攻击者的行为 - 如果破裂密码的值（按计算密码哈希功能的成本归一化的价值超过此阈值），那么对手的最佳策略始终继续攻击，直到每个用户密码都破裂。在所有情况下（Yahoo！，Dropbox，LastPass和Ashleymadison），我们发现破裂密码的值几乎可以肯定超过了此阈值，这意味着有理攻击者会破解从ZIPF定律分布（即大多数用户密码）中选择的所有密码。即使我们纳入了攻击者的收益降低的积极模型（例如，$ 5亿美元的破解密码的总价值小于$ 100 $ $ 500万美元密码的$ 100 $倍）。 请参阅纸张以获取完整摘要。
We develop an economic model of an offline password cracker which allows us to make quantitative predictions about the fraction of accounts that a rational password attacker would crack in the event of an authentication server breach. We apply our economic model to analyze recent massive password breaches at Yahoo!, Dropbox, LastPass and AshleyMadison. All four organizations were using key-stretching to protect user passwords. In fact, LastPass' use of PBKDF2-SHA256 with $10^5$ hash iterations exceeds 2017 NIST minimum recommendation by an order of magnitude. Nevertheless, our analysis paints a bleak picture: the adopted key-stretching levels provide insufficient protection for user passwords. In particular, we present strong evidence that most user passwords follow a Zipf's law distribution, and characterize the behavior of a rational attacker when user passwords are selected from a Zipf's law distribution. We show that there is a finite threshold which depends on the Zipf's law parameters that characterizes the behavior of a rational attacker -- if the value of a cracked password (normalized by the cost of computing the password hash function) exceeds this threshold then the adversary's optimal strategy is always to continue attacking until each user password has been cracked. In all cases (Yahoo!, Dropbox, LastPass and AshleyMadison) we find that the value of a cracked password almost certainly exceeds this threshold meaning that a rational attacker would crack all passwords that are selected from the Zipf's law distribution (i.e., most user passwords). This prediction holds even if we incorporate an aggressive model of diminishing returns for the attacker (e.g., the total value of $500$ million cracked passwords is less than $100$ times the total value of $5$ million passwords). See paper for full abstract.
