Search Results (19)

Rainbow tables are precomputed tables used to cache the output of cryptographic hash functions in a collection of chains consisting of alternating password and hash values constructed using a cryptographic hash function and a reduction function. Generating these tables is computationally intensive, and several researchers have proposed utilizing parallel computing to speed up the generation process. However, very little work was done on heterogeneous CPU clusters in the rainbow tables generation context. In this paper, we bridge this gap by proposing a parallel MPI-based rainbow tables generation method designed for heterogeneous CPU environments. We utilized the static load balancing algorithm using a simple weighting scheme to assign a different number of chains to different processes based on their speeds and capabilities. The experiments were executed on a cluster with ten nodes with heterogeneous CPU architectures: five nodes with the i7-12700 architecture featuring a hybrid architecture of P-cores and E-cores and an additional five with the i7-6700 architecture. In the experiments, rainbow tables were generated for four different cryptographic hash functions: SHA-256, SHA-512, MD5 and NTLMv2, with 90,000 rows each with 50,000 entries. During the experiments, we observed lower execution times as more processes join the work compared to a naïve implementation that shows jumps in execution times. Also, the speedup gained is much higher compared to the equivalent naïve implementation. In addition, our benchmark-based load balancing strategy significantly reduces the load imbalance to below 6%. Full article

BitLocker Drive Encryption has evolved from an optional feature into a hardware-integrated encryption framework widely deployed on modern Windows systems with TPM-based device encryption enabled by default. This survey is an in-depth analysis of the architecture and Trusted Platform Module (TPM) incorporation of BitLocker and 18-years of attack vector development (2006–2025). We record a progressive loss of forensic practicability: the reported attack success rates are now down to less than 5% in current TPM 2.0 defended systems as compared to the 60–70% success rates reported in early software based implementations. We name and define the Hardware Isolation Gap—a paradigm shift in architecture where encryption keys are implanted into hardware, and where the traditional offline and memory based forensic methods do not work anymore by design. To the best of our knowledge, this is the first version-correlated attack taxonomy, which shows that the practical attack surface size is reduced by approximately 80%. We also provide exploratory empirical validation using controlled experiments on a single Intel-based Windows 11 platform (Dell Precision 5570 (Xiamen, China), Intel Core i7-12800H with firmware TPM); while these results directionally confirm literature-reported forensic success rates below 5% against default TPM 2.0 settings, they represent preliminary single-platform observations and may not generalize to AMD Ryzen, Microsoft Pluton, or other OEM hardware configurations. We have found that forensic inaccessibility today is not the failure of tooling but rather the intentional result of security engineering. Literature suggests that cloud-based recovery and weak-password cracking remain the only viable strategies against default Windows 11 settings; however, cloud-based recovery was not empirically tested in this study due to ethical and legal constraints and is characterized based on secondary literature analysis. We determine the existence of crucial methodological gaps and suggest a failure-conscious forensic research agenda that can act within the hard cryptographic constraints. Full article

In modern cybersecurity and deep learning, conditional password guessing plays a critical role in improving password-cracking efficiency by leveraging known patterns and constraints. In contrast with traditional brute-force or dictionary-based attacks, we developed an approach that adopts a latent diffusion model to simulate human password selection behavior, generating more realistic password candidates. We incorporated masked character inputs as conditions and applied advanced feature extraction to capture common patterns such as character substitutions and typing habits. Furthermore, we employed visualization techniques, including autoencoders and principal component analysis, to analyze password distributions, enhancing model interpretability and aiding both offensive and defensive security strategies. Full article

Rainbow table attacks utilize a time-memory trade-off to efficiently crack passwords by employing precomputed tables containing chains of passwords and hash values. Generating these tables is computationally intensive, and several researchers have proposed utilizing parallel computing to speed up the generation process. This paper introduces a modification to the traditional master-slave parallelization model using the MPI framework, where, unlike previous approaches, the generation of starting points is decentralized, allowing each process to generate its own tasks independently. This design is proposed to reduce communication overhead and improve the efficiency of rainbow table generation. We reduced the number of inter-process communications by letting each process generate chains independently. We conducted three experiments to evaluate the performance of the parallel rainbow tables generation algorithm for four cryptographic hash functions: NTLMv2, MD5, SHA-256 and SHA-512. The first experiment assessed parallel performance, showing near-linear speedup and 95–99% efficiency across varying numbers of nodes. The second experiment evaluated scalability by increasing the number of processed chains from 100 to 100,000, revealing that higher workloads significantly impacted execution time, with SHA-512 being the most computationally intensive. The third experiment evaluated the effect of chain length on execution time, confirming that longer chains increase computational cost, with SHA-512 consistently requiring the most resources. The proposed approach offers an efficient and practical solution to the computational challenges of rainbow tables generation. The findings of this research can benefit key stakeholders, including cybersecurity professionals, ethical hackers, digital forensics experts and researchers in cryptography, by providing an efficient method for generating rainbow tables to analyze password security. Full article

The leakage signals, including electromagnetic, energy, time, and temperature, generated during the operation of password devices contain highly correlated key information, which leads to security vulnerabilities. In traditional encryption algorithms, the length of the key greatly affects the upper limit of its security against cracking. Regarding side-channel attacks on long-key algorithms, traditional template attack methods characterize the energy traces using multivariate Gaussian distribution during the template construction phase. The exhaustive key-guessing process is expected to consume a significant amount of time and computational resources. Therefore, to analyze the effectiveness of obtaining key values from the side information of password devices, we propose an innovative attack method based on a divide-and-conquer logical structure, targeting semi-bytes. We construct a collection of key classification submodules with symmetric correlations. By integrating a differential network model for byte-block sets and an end-to-end direct attack method, we form a holistic symmetric decision framework and propose a key classification structure based on deep transfer learning. This structure consists of three main parts: side information data acquisition, analysis of key-value effectiveness, and determination of attack positions. It employs multiple parallel symmetric subnetworks, effectively improving attack efficiency and reducing the key enumeration range. Experimental results show that the optimal attack accuracy of the network model can reach 91%, with an average attack accuracy of 78%. It overcomes overfitting issues under small sample dataset conditions. Full article

Moodle is a platform designed for universal learning to support pedagogical interactions and educational activities. The information technology (IT) administrator uses standard authentication methods for students logging into the Moodle platform. The need for two-factor authentication has grown as institutions, governments, and individuals realize that passwords are not secure enough to protect user accounts in their current technical format. The classic connection methods have vulnerabilities, and account passwords are easy to crack. Analyzing these aspects, the goal is to create a new safe and reliable alternative to the traditional authentication methods in e-learning platforms. The proposed solution introduces a new authentication factor using digital certificates stored on physical devices or the cloud to address the evolving authentication and security challenges effectively. The absence of this authentication within the Moodle ecosystem has imparted a sense of urgency for its implementation. With the innovative authentication scheme, the users have gained confidence, are satisfied with the new solution, and have not reported security breaches. The result is increased security, data protection, and better account management. Full article

In modern information technology systems, secure storage and transmission of personal and sensitive data are recognized as important tasks. These requirements are achieved through secure and robust encryption methods. Argon2 is an advanced cryptographic algorithm that emerged as the winner in the Password Hashing Competition (PHC), offering a concrete and secure measure. Argon2 also provides a secure mechanism against side-channel attacks and cracking attacks using parallel processing (e.g., GPU). In this paper, we analyze the existing GPU-based implementation of the Argon2 algorithm and further optimize the implementation by improving the performance of the hashing function during the computation process. The proposed method focuses on enhancing performance by distributing tasks between CPU and GPU units, reducing the data transfer cost for efficient GPU-based parallel processing. By shifting several stages from the CPU to the GPU, the data transfer cost is significantly reduced, resulting in faster processing times, particularly when handling a larger number of passwords and higher levels of parallelism. Additionally, we optimize the utilization of the GPU’s shared memory, which enhances memory access speed, especially in the computation of the hash value generation process. Furthermore, we leverage the parallel processing capabilities of the GPU to perform efficient brute-force attacks. By computing the H function on the GPU, the proposed implementation can generate initial blocks for multiple inputs in a single operation, making brute-force attacks in an efficient way. The proposed implementation outperforms existing methods, especially when processing a larger number of passwords and operating at higher levels of parallelism. Full article

In an information-security-assurance system, humans are usually the weakest link. It is partly related to insufficient cybersecurity knowledge and the ignorance of standard security recommendations. Consequently, the required password-strength requirements in information systems are the minimum of what can be done to ensure system security. Therefore, it is important to use up-to-date and context-sensitive password-strength-estimation systems. However, minor languages are ignored, and password strength is usually estimated using English-only dictionaries. To change the situation, a machine learning approach was proposed in this article to support a more realistic model to estimate the strength of Lithuanian user passwords. A newly compiled dataset of password strength was produced. It integrated both international- and Lithuanian-language-specific passwords, including 6 commonly used password features and 36 similarity metrics for each item (4 similarity metrics for 9 different dictionaries). The proposed solution predicts the password strength of five classes with 77% accuracy. Taking into account the complexity of the accuracy of the Lithuanian language, the achieved result is adequate, as the availability of intelligent Lithuanian-language-specific password-cracking tools is not widely available yet. Full article

Studying password-cracking techniques is essential in the information security discipline as it highlights the vulnerability of weak passwords and the need for stronger security measures to protect sensitive information. While both methods aim to uncover passwords, both approach the task in different ways. A brute force algorithm generates all possible combinations of characters in a specified range and length, while the dictionary attack checks against a predefined word list. This study compares the efficiency of these methods using parallel versions of Python, C++, and Hashcat. The results show that the NVIDIA GeForce GTX 1050 Ti with CUDA is significantly faster than the Intel(R) HD Graphics 630 GPU for cracking passwords, with a speedup of 11.5× and 10.4× for passwords with and without special characters, respectively. Special characters increase password-cracking time, making the process more challenging. The results of our implementation indicate that parallel processing greatly improves the speed of password-cracking techniques. The brute force algorithm achieved a speedup of 1.9× with six cores, while the dictionary attack showed a speedup of 4.4× with eight-core static scheduling. Studying password-cracking techniques highlights the need for stronger security measures to protect sensitive information and the vulnerability of weak passwords. Full article

With the increasing prevalence of cyber attacks and data breaches, the importance of strong passwords cannot be overstated. Password generating software has been widely used to generate complex passwords that are difficult to crack, but it has its limitations. One of the main problems with this kind of software is that it often generates passwords that are difficult to remember, leading to users write them down or reuse them across multiple accounts. In recent years, prompt models such as ChatGPT have emerged as a promising solution for generating strong and memorable passwords. By leveraging machine learning algorithms, these models can generate unique and complex passwords tailored to individual users’ preferences, making them easier to remember and more secure. However, the use of prompt models to generate passwords also raises concerns about exposing vulnerable passwords. Hackers can potentially use these models to predict passwords by analyzing a user’s online activity and personal data. Additionally, the constant need to change passwords to stay secure poses a challenge for both password generating software and prompt models. As technology continues to evolve, finding a balance between password security and user convenience remains a complex issue. While prompt models such as ChatGPT can offer a promising solution, it is essential to consider the potential risks and challenges associated with their use, including the constant need for password changes and the potential vulnerability of the generated passwords. Full article

The frequent incidents of password leakage have increased people’s attention and research on password security. Password guessing is an essential part of password cracking and password security research. The progression of deep learning technology provides a promising way to improve the efficiency of password guessing. However, the mainstream models proposed for password guessing, such as RNN (or other variants, such as LSTM, GRU), GAN and VAE still face some problems, such as the low efficiency and high repetition rate of the generated passwords. In this paper, we propose a password-guessing model based on the temporal convolutional neural network (PassTCN). To further improve the performance of the generated passwords, we propose a novel password probability label-learning method, which reconstructs labels based on the password probability distribution of the training set and deduplicates the training set when training. Experiments on the RockYou dataset showed that, when generating ${10}^8$ passwords, the coverage rate of PassTCN with password probability label learning (PassTCN-PPLL) reached 12.6%, which is 87.2%, 72.6% and 42.9% higher than PassGAN (a password-guessing model based on GAN), VAEPass (a password-guessing model based on VAE) and FLA (a password-guessing model based on LSTM), respectively. The repetition rate of our model is 25.9%, which is 45.1%, 31.7% and 17.4% lower than that of PassGAN, VAEPass and FLA, respectively. The results confirm that our approach not only improves the coverage rate but also reduces the repetition rate. Full article

With the development of the Internet, information security has attracted more attention. Identity authentication based on password authentication is the first line of defense; however, the password-generation model is widely used in offline password attacks and password strength evaluation. In real attack scenarios, high-probability passwords are easy to enumerate; extremely low-probability passwords usually lack semantic structure and, so, are tough to crack by applying statistical laws in machine learning models, but these passwords with lower probability have a large search space and certain semantic information. Improving the low-probability password hit rate in this interval is of great significance for improving the efficiency of offline attacks. However, obtaining a low-probability password is difficult under the current password-generation model. To solve this problem, we propose a low-probability generator–probabilistic context-free grammar (LPG–PCFG) based on PCFG. LPG–PCFG directionally increases the probability of low-probability passwords in the models’ distribution, which is designed to obtain a degeneration distribution that is friendly for generating low-probability passwords. By using the control variable method to fine-tune the degeneration of LPG–PCFG, we obtained the optimal combination of degeneration parameters. Compared with the non-degeneration PCFG model, LPG–PCFG generates a larger number of hits. When generating ${10}^7$ and ${10}^8$ times, the number of hits to low-probability passwords increases by $50.4\%$ and $42.0\%$, respectively. Full article

In many smart devices and numerous digital applications, authentication mechanisms are widely used to validate the legitimacy of users’ identification. As a result of the increased use of mobile devices, most people tend to save sensitive and secret information over such devices. Personal Identification Number (PIN)-based and alphanumeric passwords are simple to remember, but at the same time, they are vulnerable to hackers. Being difficult to guess and more user-friendly, graphical passwords have grown in popularity as an alternative to all such textual passwords. This paper describes an innovative, hybrid, and much more robust user authentication approach, named GRA-PIN (GRAphical and PIN-based), which combines the merits of both graphical and pin-based techniques. The feature of simple arithmetic operations (addition and subtraction) is incorporated in the proposed scheme, through which random passwords are generated for each login attempt. In the study, we have conducted a comparative study between the GRA-PIN scheme with existing PIN-based and pattern-based (swipe-based) authentications approaches using the standard Software Usability Scale (SUS). The usability score of GRA-PIN was analyzed to be as high as 94%, indicating that it is more reliable and user friendly. Furthermore, the security of the proposed scheme was challenged through an experiment wherein three different attackers, having a complete understanding of the proposed scheme, attempted to crack the technique via shoulder surfing, guessing, and camera attack, but they were unsuccessful. Full article

Access management of IoT devices is extremely important, and a secure login authentication scheme can effectively protect users’ privacy. However, traditional authentication schemes are threatened by shoulder-surfing attacks, and biometric-based schemes, such as fingerprint recognition and face recognition, that are commonly used today can also be cracked. Researchers have proposed some schemes for current attacks, but they are limited by usability. For example, the login authentication process requires additional device support. This method solves the problem of attacks, but it is unusable, which limits its application. At present, most authentication schemes for the Internet of Things and mobile platforms either focus on security, thus ignoring availability, or have excellent convenience but insufficient security. This is a symmetry problem worth exploring. Therefore, users need a new type of login authentication scheme that can balance security and usability to protect users’ private data or maintain device security. In this paper, we propose a login authentication scheme named PinWheel, which combines a textual password, a graphical password, and biometrics to prevent both shoulder-surfing attacks and smudge attacks and solves the current schemes’ lack of usability. We implemented PinWheel and evaluated it from the perspective of security and usability. The experiments required 262 days, and 573 subjects participated in our investigation. The evaluation results show that PinWheel can at least effectively resist both mainstream attacks and is superior to most existing schemes in terms of usability. Full article

Despite their well-known weaknesses, passwords are still the de-facto authentication method for most online systems. Due to its importance, password cracking has been vibrantly researched both for offensive and defensive purposes. Hashcat and John the Ripper are the most popular cracking tools, allowing users to crack millions of passwords in a short time. However, their rule-based cracking has an explicit limitation of depending on password-cracking experts to come up with creative rules. To overcome this limitation, a recent trend has been to apply machine learning techniques to research on password cracking. For instance, state-of-the-art password guessing studies such as PassGAN and rPassGAN adopted a Generative Adversarial Network (GAN) and used it to generate high-quality password guesses without knowledge of password structures. However, compared with the probabilistic context-free grammar (PCFG), rPassGAN shows inferior password cracking performance in some cases. It was also observed that each password cracker has its own cracking space that does not overlap with other models. This observation led us to realize that an optimized candidate dictionary can be made by combining the password candidates generated by multiple password generation models. In this paper, we suggest a deep learning-based approach called REDPACK that addresses the weakness of the cutting-edge cracking tools based on GAN. To this end, REDPACK combines multiple password candidate generator models in an effective way. Our approach uses the discriminator of rPassGAN as the password selector. Then, by collecting passwords selectively, our model achieves a more realistic password candidate dictionary. Also, REDPACK improves password cracking performance by incorporating both the generator and the discriminator of GAN. We evaluated our system on various datasets with password candidates composed of symbols, digits, upper and lowercase letters. The results clearly show that our approach outperforms all existing approaches, including rule-based Hashcat, GAN-based PassGAN, and probability-based PCFG. The proposed model was also able to reduce the number of password candidates by up to 65%, with only 20% cracking performance loss compared to the union set of passwords cracked by multiple-generation models. Full article