Untargeted Attacks in (Password-Based) Cryptography

管理/ 123456;用户/标准;根/ vizxv;farshim /*********.密码在我们的生活中无处不在：我们网上银行、商业和通信的安全性和隐私性都深深依赖于密码。然而，它们是安全系统中最薄弱的环节之一。以明文形式存储用户名密码虽然方便，但严重破坏了安全性，这一点经常被泄露。散列密码，即应用隐藏密码的转换，可以在允许身份验证的同时降低风险。然而，“123456”很可能是某人选择的密码，然后被泄露。该提案将解决当前我们对多实例环境中每个人都是目标的基于密码的密码学的理解差距。我们将研究用于减轻此类环境中相关风险的基本加密技术。我们方法的新颖之处在于，除了考虑系统范围的风险外，我们还将考虑预处理攻击，这可以将密码破解的速度提高几个数量级。我们的目标是表明，攻击用户所需的密码分析工作随着目标用户的数量以及系统范围内密码的“不可猜测”程度而很好地扩展。制定和研究不可猜测性的措施将是我们的出发点。这些指标将根据加密上下文的使用情况进行开发。例如，我们将询问密码散列在多大程度上保持其不可猜测性。至关重要的是，我们将纳入适当的预处理建模，以便考虑摊销的对抗性资源，例如“彩虹表”的使用。除了将用户的安全“解耦”的常用做法“腌制”之外，我们还将考虑更深层次的对策。其中包括迭代，它降低了散列的速度，以及现代内存硬设计，它利用不同平台上内存访问速度的一致性来阻止硬件辅助攻击。除了不可猜测性之外，还将研究更强的安全概念，以保证在各种上下文中的安全组合。将特别注意推导与根据最知名攻击设置的（真实世界）参数兼容的安全边界。此外，我们还将深入了解基础密码学理论，因为多实例安全性与硬度放大密切相关。密码的使用在安全和ITC行业很普遍，它们的弱点是众所周知的，特别是在多用户场景中（如物联网环境）。该项目将促进密码哈希加密标准的创建，这些标准得到安全证明的严格支持。最终的结果将是增强我们对网络空间弹性的信心。

admin/123456; user/qwerty; root/vizxv; farshim/*********. Passwords permeate our lives: the security and privacy of many (perhaps all) of our on-line banking, commerce, and communication deeply rely on passwords. Yet they are one of the weakest links in securing systems. Storing username-passwords in plaintext, although convenient, seriously undermines security as evidenced by frequent leaks. Hashing passwords, i.e., applying a transformation that hides them, can reduce risks while still allowing for authentication. However, "123456" may well be a password chosen by someone, and then compromised. This proposal will address a current gap in our understanding of password-based cryptography in multi-instance environments where everyone is a target. We will investigate fundamental cryptographic techniques that are used to mitigate some of the risks associated in such environments. The novelty of our approach is that besides considering system-wide risks, we will consider preprocessing attacks which can speed up password-cracking by orders of magnitude. Our goal will be to show that the cryptanalytic effort needed to compromise users scales up well with the number of users targeted, and according to how "unguessable" system-wide passwords are. Formulating and studying measures of unguessability will be our starting point. These metrics will be developed with the view of usage in cryptographic contexts. For example, we will ask to what extent hashing of passwords preserves their unguessability. Crucially, we will incorporate appropriate modelling of preprocessing, so that amortised adversarial resources, such as the use of "rainbow tables," are accounted for. Alongside salting, which is a common practice to "decouple" security of users, we will consider deeper countermeasures. These include iteration, which slows down the rate of hashing, and modern memory-hard designs, which exploit uniformity of memory-access speeds across different platforms to thwart hardware-assisted attacks. In addition to unguessability, stronger notions of security that guarantee secure composition in a variety of contexts will be studied. Special attention will be paid to derive security bounds that are compatible with (real-world) parameters set according to best-known attacks. Alongside, we will also develop a solid understanding of the foundational cryptographic theory, as multi-instance security enjoys close links with amplification of hardness. The use of passwords is widespread in the security and ITC industries and their weakness is well recognised, especially in multi-user scenarios (such as IoT environments). This project will promote the creation of cryptographic standards for password hashing that are rigorously supported by security proofs. The final outcome will be an increased confidence in the resilience of our cyberspace.