A password meter without password exposure

Pyung Kim, Younho Lee, Youn Sik Hong, Taekyoung Kwon

Research output: Contribution to journalArticlepeer-review

1 Citation (Scopus)

Abstract

To meet password selection criteria of a server, a user occasionally needs to provide multiple choices of password candidates to an on-line password meter, but such user-chosen candidates tend to be derived from the user’s previous passwords—the meter may have a high chance to acquire information about a user’s passwords employed for various purposes. A third party password metering service may worsen this threat. In this paper, we first explore a new on-line password meter concept that does not necessitate the exposure of user’s passwords for evaluating user-chosen password candidates in the server side. Our basic idea is straightforward; to adapt fully homomorphic encryption (FHE) schemes to build such a system but its performance achievement is greatly challenging. Optimization techniques are necessary for performance achievement in practice. We employ various performance enhancement techniques and implement the NIST (National Institute of Standards and Technology) metering method as seminal work in this field. Our experiment results demonstrate that the running time of the proposed meter is around 60 s in a conventional desktop server, expecting better performance in high-end hardware, with an FHE scheme in HElib library where parameters support at least 80-bit security. We believe the proposed method can be further explored and used for a password metering in case that password secrecy is very important—the user’s password candidates should not be exposed to the meter and also an internal mechanism of password metering should not be disclosed to users and any other third parties.

Original languageEnglish
Article number345
Pages (from-to)1-25
Number of pages25
JournalSensors (Switzerland)
Volume21
Issue number2
DOIs
Publication statusPublished - 2021 Jan 2

Bibliographical note

Funding Information:
Funding: This work was supported by the National Research Foundation of Korea (NRF) grant funded by the Korean government (MSIT) (No. NRF-2019R1A2C1088802, NRF-2019R1A2C4069769).

All Science Journal Classification (ASJC) codes

  • Analytical Chemistry
  • Biochemistry
  • Atomic and Molecular Physics, and Optics
  • Instrumentation
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'A password meter without password exposure'. Together they form a unique fingerprint.

Cite this