After years of the attempt to replace password with other alternatives such as biometrics and smart cards, password is still the most pervasive user authentication mechanism. The password checking authentication is widely used for financial services, online social networks, and many other applications. This paper aims to analyze the security of a password checker qualitatively and quantitatively, and show how to improve it. Qualitative security analysis, in which it does not allow any information flow from secret date to public data, considers that the password checker is not a secure process. Therefore, an alternative analysis for the password checker is to analyze quantitatively, i.e., quantifying its information flow and determining how much secret information has been leaked. This method can be used to decide whether we can tolerate small leakages. A quantitative security analysis can be seen as a generalization of a qualitative one. To improve the security of the password checker, we propose a noisy-output policy, i.e., a situation where a system operator is able to add noise to the output: instead of always producing the exact outcomes, the system sometimes reports noisy outcomes. The noisy outcomes reduce the correlation between the output and the input, and thus reduce the leakage.
| Published in | Automation, Control and Intelligent Systems (Volume 12, Issue 4) |
| DOI | 10.11648/j.acis.20241204.12 |
| Page(s) | 108-113 |
| Creative Commons |
This is an Open Access article, distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution and reproduction in any medium or format, provided the original work is properly cited. |
| Copyright |
Copyright © The Author(s), 2024. Published by Science Publishing Group |
Password Checker, Noisy-Output Policy, Quantitative Security Analysis
| [1] | M. S. Alvim and M. E. Andrés. On the relation between differential privacy and quantitative information flow. In Proceedings of the 38th international conference on Automata, languages and programming - Volume Part II, ICALP’11, pages 60-76. Springer-Verlag, 2011. |
| [2] | M. S. Alvim, M. E. Andrés, K. Chatzikokolakis, P. Degano, and C. Palamidessi. Differential privacy: on the trade-off between utility and information leakage. CoRR, abs/1103.5188, 2011. |
| [3] | M. S. Alvim, M. E. Andrés, K. Chatzikokolakis, and C. Palamidessi. Quantitative information flow and applications to differential privacy. In A. Aldini and R. Gorrieri, editors, Foundations of security analysis and design VI, pages 211-230. Springer-Verlag, 2011. |
| [4] | M. S. Alvim, K. Chatzikokolakis, A. McIver, C. Morgan, C. Palamidessi, and G. Smith. The Science of Quantitative Information Flow. Information Security and Cryptography. Springer, Springer Nature, United States, 2020. |
| [5] | K. Chatzikokolakis, C. Palamidessi, and P. Panangaden. Anonymity protocols as noisy channels. In Proceedings of the 2nd international conference on Trustworthy global computing, TGC’06, pages 281-300. Springer-Verlag, 2007. |
| [6] | D. Clark, S. Hunt, and P. Malacaria. Quantitative information flow, relations and polymorphic types. J. Log. and Comput., 15: 181-199, 2005. |
| [7] | M. R. Clarkson, A. C. Myers, and F. B. Schneider. Belief in information flow. In In Proc. 18th IEEE Computer Security Foundations Workshop, pages 31-45, 2005. |
| [8] | J. A. Goguen and J. Meseguer. Security policies and security models. In IEEE Symposium on Security and Privacy, pages 11-20, 1982. |
| [9] | M. Huisman and T.M. Ngo. Scheduler-specific confidentiality for multi-threaded programs and its logic-based verification. In Proceedings of the 2011 international conference on Formal Verification of Object-Oriented Software, FoVeOOS’11, pages 178-195. Springer-Verlag, 2012. |
| [10] | S. Jiao, L. Cai, X. Wang, K. Cheng, and X. Gao. A differential privacy federated learning scheme based on adaptive gaussian noise. CMES - Computer Modeling in Engineering and Sciences, 138(2): 1679-1694, 2023. |
| [11] | B. Köpf and M. Dürmuth. A provably secure and efficient countermeasure against timing attacks. In Proceedings of the 2009 22Nd IEEE Computer Security Foundations Symposium, CSF’09, pages 324-335. IEEE Computer Society, 2009. |
| [12] | P. Malacaria. Risk assessment of security threats for looping constructs. J. Comput. Secur., 18: 191-228, 2010. |
| [13] | P. Malacaria and H. Chen. Lagrange multipliers and maximum information leakage in different observational models. In Proceedings of the third ACM SIGPLAN workshop on Programming languages and analysis for security, PLAS’08, pages 135-146. ACM, 2008. |
| [14] | I.S. Moskowitz, R. E. Newman, D.P. Crepeau, and A. R. Miller. Covert channels and anonymizing networks. In Proceedings of the 2003 ACM workshop on Privacy in the electronic society, WPES’03, pages 79-88. ACM, 2003. |
| [15] | T. M. Ngo and M. Huisman. Quantitative security analysis for programs with low input and noisy output. In Proceedings of the 6th international conference on Engineering Secure Software and Systems, ESSoS’14, pages 77-94. Springer-Verlag, 2014. |
| [16] | G. Smith. On the foundations of quantitative information flow. In Proceedings of the 12th International Conference on Foundations of Software Science and Computational Structures, FOSSACS’09, pages 288- 302. Springer- Verlag, 2009. |
| [17] | Y. Xu, M. Gao, Y., B. Chen, and W. Shao. Diffusionassisted quantum noise stream cipher for physical layer security in ufmc. Optics and Laser Technology, 171: 110407, 2024. |
| [18] | S. Zdancewic and A. C. Myers. Observational determinism for concurrent program security. In Proceedings of 16th IEEE Computer Security Foundations Workshop, CSFW’03, pages 29-43. IEEE Computer Society, 2000. |
| [19] | Y. Zhu and R. Bettati. Anonymity vs. information leakage in anonymity systems. In Proceedings of the 25th IEEEInternationalConferenceonDistributedComputing Systems, ICDCS’05, pages 514-524. IEEE Computer Society, 2005. |
APA Style
Ngo, T. M. (2024). How to Improve the Security of Password Checkers. Automation, Control and Intelligent Systems, 12(4), 108-113. https://doi.org/10.11648/j.acis.20241204.12
ACS Style
Ngo, T. M. How to Improve the Security of Password Checkers. Autom. Control Intell. Syst. 2024, 12(4), 108-113. doi: 10.11648/j.acis.20241204.12
Share This Article
Twitter
Linked In
Facebook
Copy
Download@article{10.11648/j.acis.20241204.12,
author = {Tri Minh Ngo},
title = {How to Improve the Security of Password Checkers},
journal = {Automation, Control and Intelligent Systems},
volume = {12},
number = {4},
pages = {108-113},
doi = {10.11648/j.acis.20241204.12},
url = {https://doi.org/10.11648/j.acis.20241204.12},
eprint = {https://article.sciencepublishinggroup.com/pdf/10.11648.j.acis.20241204.12},
abstract = {After years of the attempt to replace password with other alternatives such as biometrics and smart cards, password is still the most pervasive user authentication mechanism. The password checking authentication is widely used for financial services, online social networks, and many other applications. This paper aims to analyze the security of a password checker qualitatively and quantitatively, and show how to improve it. Qualitative security analysis, in which it does not allow any information flow from secret date to public data, considers that the password checker is not a secure process. Therefore, an alternative analysis for the password checker is to analyze quantitatively, i.e., quantifying its information flow and determining how much secret information has been leaked. This method can be used to decide whether we can tolerate small leakages. A quantitative security analysis can be seen as a generalization of a qualitative one. To improve the security of the password checker, we propose a noisy-output policy, i.e., a situation where a system operator is able to add noise to the output: instead of always producing the exact outcomes, the system sometimes reports noisy outcomes. The noisy outcomes reduce the correlation between the output and the input, and thus reduce the leakage.},
year = {2024}
}
TY - JOUR T1 - How to Improve the Security of Password Checkers AU - Tri Minh Ngo Y1 - 2024/12/18 PY - 2024 N1 - https://doi.org/10.11648/j.acis.20241204.12 DO - 10.11648/j.acis.20241204.12 T2 - Automation, Control and Intelligent Systems JF - Automation, Control and Intelligent Systems JO - Automation, Control and Intelligent Systems SP - 108 EP - 113 PB - Science Publishing Group SN - 2328-5591 UR - https://doi.org/10.11648/j.acis.20241204.12 AB - After years of the attempt to replace password with other alternatives such as biometrics and smart cards, password is still the most pervasive user authentication mechanism. The password checking authentication is widely used for financial services, online social networks, and many other applications. This paper aims to analyze the security of a password checker qualitatively and quantitatively, and show how to improve it. Qualitative security analysis, in which it does not allow any information flow from secret date to public data, considers that the password checker is not a secure process. Therefore, an alternative analysis for the password checker is to analyze quantitatively, i.e., quantifying its information flow and determining how much secret information has been leaked. This method can be used to decide whether we can tolerate small leakages. A quantitative security analysis can be seen as a generalization of a qualitative one. To improve the security of the password checker, we propose a noisy-output policy, i.e., a situation where a system operator is able to add noise to the output: instead of always producing the exact outcomes, the system sometimes reports noisy outcomes. The noisy outcomes reduce the correlation between the output and the input, and thus reduce the leakage. VL - 12 IS - 4 ER -
The University of Danang - University of Science and Technology, Danang, Vietnam
Information