Can I read Cost-Asymmetric Memory Hard Password Hashing on EtoBox?

Cost-Asymmetric Memory Hard Password Hashing by Bai, Wenjie; Blocki, Jeremiah; Ameri, Mohammad Hassan is a scholarly article available to read on EtoBox.

What is Cost-Asymmetric Memory Hard Password Hashing about?

In the past decade, billions of user passwords have been exposed to the dangerous threat of offline password cracking attacks. An offline attacker who has stolen the cryptographic hash of a user's password can check as many password guesses as s/he likes limited only by the resources that s/he is willing to invest to crack the password. Pepper and key-stretching are two techniques that have been proposed to deter an offline attacker by increasing guessing costs. Pepper ensures that the cost of rejecting an incorrect password guess is higher than the (expected) cost of verifying a correct password guess. This is useful because most of the offline attacker's guesses will be incorrect. Unfortunately, as we observe the traditional peppering defense seems to be incompatible with modern memory hard key-stretching algorithms such as Argon2 or Scrypt. We introduce an alternative to pepper which we call Cost-Asymmetric Memory Hard Password Authentication which benefits from the same cost-asymmetry as the classical peppering defense i.e., the cost of rejecting an incorrect password guess is larger than the expected cost to authenticate a correct password guess. When configured properly we pr

Author

Bai, Wenjie; Blocki, Jeremiah; Ameri, Mohammad Hassan

Published

2022

Language

EN