Fast dictionary attacks on passwords using time-space tradeoff

By Arvind Narayanan, Vitaly Shmatikov. Conference on Computer and Communications Security, 2005

511 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b33dd36b5d60fb2300f94b0e7cf07a06fddbc839

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Cracking Classifiers for Evasion: A Case Study on the Google's Phishing Pages Filter (2016, unknown): “The dictionary attack [42][43][57] is a more intelligent variant of a straight brute force approach.”
Testing metrics for password creation policies by attacking large sets of revealed passwords (2010, methodology): “In [20], A. Narayanan, and V. Shmatikov ran experiments against 142 real user passwords and were able to break 67.6% of them using a Markov based brute force attack.”
"...No one Can Hack My Mind": Comparing Expert and Non-Expert Security Practices (2015, background): “Password managers can make it feasible to use truly random and unique passwords and help move users away from memorable passwords, which are vulnerable to smart-dictionary attacks [36].”
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks (2016, background): “Markov Models Using Markov models to guess passwords, first proposed in 2005 [70], has recently been studied more comprehensively [37, 65].”
Password Strength: An Empirical Analysis (2010, methodology): “Attacks based on pre-computing the hashed version of the most likely passwords [8], [15] are defeated with “salting”: appending a random number to the password before hashing it,”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, methodology): “Password creation has also been modeled as a character-by-character Markov process, first by Narayanan and Shmatikov [16] for password cracking and later by Castelluccia et al. [17] to train a pro-active password checker.”
Cyber-physical systems security: Limitations, issues and future trends (2020, unknown): “…the authenticity of CPS users[167], [168] (mainly engineers and managers) by trying to crack their passwords using brute-force [169], dictionary [170] (mitigated by using key exchange [171]), rainbow table [172], birthday (mitigated by hashing) [173] or online/ofﬂine password guessing attacks…”
Guessing human-chosen secrets (2012, methodology): “For example, Markov models were used as early as 1993 for proactive password checking [77] before being adapted for password cracking [218, 200] and have since been re-adapted for password checking [62].”
Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms (2012, methodology): “discuss a password-cracking technique based on a Markov model, in which password guesses are made based on contextual frequency of characters [27].”
Zipf’s Law in Passwords (2017, unknown): “Narayanan and Shmatikov [32] developed an advanced cracking algorithm that uses Markov chain instead of ad hoc mangling rules to model user password creation patterns.”
A Study of Probabilistic Password Models (2014, methodology): “We note that models used in [3], [8] are not probability models because the values assigned to all strings do not add up to 1.”
Graphical passwords: Learning from the first twelve years (2012, background): “…a continuum from small dictionaries to prioritized brute-force attacks, with smart dictionary attacks combining time-memory trade-offs of exhaustive attacks with higher success probabilities of prioritized dictionaries, in some cases algorithmically generated [Narayanan and Shmatikov 2005].”
Targeted Online Password Guessing: An Underestimated Threat (2016, background): “Therefore, the trawling guessing models [18, 21, 24, 27], which aim to produce a single guess list for all users, are not suitable for characterizing targeted guessing.”
Password Cracking Using Probabilistic Context-Free Grammars (2009, background): “The crucial question then becomes, which word-mangling rules should one try and in which order? Narayanan and Shmatikov use Markov models to generate probable passwords that are phonetically similar to words and that thus may be candidates for guesses [10].”