Improving Usability Through Password-Corrective Hashing
We propose a way to increase the usability of password authentication systems by compensating for transposition and substitution errors. We show how to correct for these errors with low false positive rates (i.e., low probability that an arbitrary string will be accepted as the password for authentication). Thus our techniques increase usability with provably little loss of security.
In particular, we propose applying a single password-corrective hash function to each entered password attempt. The key property of the hash function is that two strings differing by a single data entry error be likely to be hashed to the same key, while more substantially differing strings are hashed to different keys.
We develop precise analytical formulae for the precision/recall tradeoffs for a variety of corrective hash functions. We evaluate these methods at parameter values reflecting common classes of keys/passwords. Finally, we evaluate these schemes using a popular crack-list (dictionary) of 680,000 common words. We show that we can correct for all user transposition errors while reducing the computational cost of a crack attack by only 13%.
KeywordsHash Function Alphabet Size Perfect Recall Substitution Error Sorting Network
Unable to display preview. Download preview PDF.
- 2.MacKenzie, I., Soukoreff, R.: A character-level error analysis technique for evaluating text entry methods. In: Proceedings of the second nordic conference on human-computer interaction. Nordic Conference on Human-Computer Interaction, pp. 241–244 (2002)Google Scholar
- 3.Peterson, J.L.: A note on undetected typing errors. Communications of the ACM 29(7) (July 1986)Google Scholar
- 4.Sasse, M.A., Brostoff, S., Weirich, D.: Transforming the weakest link? a human/computer interaction approach to usable and effective security. British Telecom Technology Journal 19(3), 122–131 (2001)Google Scholar
- 5.T’s, J., Eckstein, R., Collier-Brown, D.: Using Samba. O’Reilly, Sebastopol (2003)Google Scholar
- 9.Cranor, L.F., Garfinkel, S.: Security and Usability. O’Reilly, Sebastopol (2005)Google Scholar
- 10.Knuth, D.E.: The Art of Computer Programming, vol. 3. Addison-Wesley Publishing Company, Reading (1973)Google Scholar