Single password authentication

Users frequently reuse their passwords when authenticating to various online services. Combined with the use of weak passwords or honeypot/phishing attacks, this brings high risks to the security of the user’s account information. In this paper, we propose several protocols that can allow a user to use a single password to authenticate to multiple services securely. All our constructions provably protect the user from dictionary attacks on the password, and cross-site impersonation or honeypot attacks by the online service providers.     

Token-based graphical password authentication

Given that phishing is an ever-increasing problem, a better authentication system is required. We propose a system that uses a graphical password deployed from a Trojan and virus-resistant embedded device. The graphical password utilizes a personal image to construct an image hash, which is provided as input into a cryptosystem that returns a password. The graphical password requires the user to select a small number of points on the image. The embedded device will then stretch these points into a long alphanumeric password. With one graphical password, the user can generate many passwords from their unique embedded device. The image hash algorithm employed by the device is demonstrated to produce random and unique 256-bit message digests and was found to be responsive to subtle changes in the underlying image. Furthermore, the device was found to generate passwords with entropy significantly larger than that of users passwords currently employed today.     

基于AES的远程访问的认证协议

本文提出了一种基于AES实现的口令认证方法。该算法不使用公开密钥算法,仅采用AES进行远程用户的身份认证。该方法具有速度快,安全性高的特点,易于采用令牌(Token)或IC卡硬件实现。在本文的最后,还对认证协议的安全性进行了讨论。     

口令安全管理

为了计算机系统的安全,系统中的各种资源（文件、数据库、应用系统）需要认证机制的保护,以确保这些资源被已授权的人使用。口令作为一种保护手段被广泛应用于计算机系统中。口令作为用户身份的证明以及系统识别用户的标识,往往是唯一的。在口令系统中,如果每次都使用不同的口令,即动态口令,则可以大大提高系统的安全性。     

Chocolate for password!

A new survey has found that a staggering 71% of office workers polled were willing to reveal their passwords when offered a chocolate bar as a bribe. While this was a less-than-scientific survey, it does demonstrate the real problem facing IT administrators and the benefits to security that a more secure smart card system could bring.     

Advances in password cracking

This paper surveys various techniques that have been used in public or privates tools in order to enhance the password cracking process. After a brief overview of this process, it addresses the issues of algorithmic and implementation optimisations, the use of special purpose hardware and the use of the Markov chains tool. Experimental results are then shown, comparing several implementations.     

一种新的可视化图形口令

对用户的认证是系统安全的核心组成部分之一.基于口令的认证是一种最常用的对用户的认证方法.人们往往选取容易记忆的简单口令,但是它们也容易被攻击.有些图形口令免去了人们记忆口令的烦恼,但是它们要求对用户的培训必须秘密进行,这使得用户设置和修改口令比较困难.提出了一种新的图形口令方案,它利用人们随身携带的普通钥匙作为图形口令,用户通过看看屏幕就可以输入口令,试验表明它简单、易于实现,用户使用起来也十分方便.     

Connectionist password quality tester

Computer security has always been an issue, more so in recent years due to global network access. In this paper, we present a simple connectionist algorithm for testing the quality of computer passwords. A popular method of evaluating password quality is to test it against a large dictionary of words and near-words. Our algorithm is an approximate realization of this method. The large dictionary of words is stored in a network in distributed form. All stored words are stable; however, spurious memories may develop. Although there is no easy way to determine exactly which non-word strings become spurious, nor even exactly how many spurious memories form, numerical simulations reveal that the network works well in distinguishing words and near-words from structureless strings. Thus, to evaluate a password, one would present it to the network and, if the network labeled it a memory, the password would be considered bad     

一个新的动态口令认证方案

介绍并分析了S／KEY口令认证方案和非对称口令认证方案,针对它们无法抵御劫取连接攻击等安全缺陷,在充分吸收它们设计思想的基础上,提出了一个新的动态口令认证方案,给出了具体注册过程、认证过程及参数选择,并进行了安全性分析。分析可得,新方案可抵御劫取连接等攻击。     

采用GPU的ZIP密码恢复算法

常用的zip密码恢复软件使用通用处理器进行密码恢复,每秒尝试密码次数少,往往需要很长时间才能找到正确密码。为了提高密码破解效率,提出了GPU平台上的快速ZIP密码恢复算法,针对GPU的特点,重点优化了寄存器使用以及存储器访问,对AES和HMAC算法进行了并行优化,充分发挥了GPU大规模并行运算的优势,并利用ZIP文档格式中的密码校验位提前筛选密码,大部分错误密码都不需要进行后续运算。实验结果表明,恢复AES-128加密的ZIP文档,基于GPU的算法实现了11.09倍的加速比。     

Shoulder-surfing-proof graphical password authentication scheme

The graphical password authentication scheme uses icons instead of text-based passwords to authenticate users. Icons might be somehow more familiar to human beings than text-based passwords, since it is hard to remember the latter with sufficient security strength. No matter what kind of password is used, there are always shoulder-surfing problems. An attacker can easily get text-based password or graphical password by observation, capturing a video or recording the login process. In this paper, we propose a shoulder-surfing-proof graphical password authentication scheme using the convex-hull graphical algorithm. We give evaluation and comparisons to demonstrate the security strength and the functionality advantages of our scheme.     

基于集合调和的远程口令恢复方法*

基于对多项式编码的集合调和方法的研究,提出一种简单的远程口令恢复新方法。其利用容易记忆的低熵口令集经hash变换后加密并存储高熵口令;利用集合调和多项式容错求解得到原始的低熵口令集,从而恢复高熵口令。同时,提供了两个安全的远程口令恢复协议。分析表明,此方法可以安全广泛地应用到远程应用系统中。     

An assessment of website password practices

Password-based authentication is frequently criticised on the basis of the ways in which the approach can be compromised by end-users. However, a fundamental point in the defence of many users is that they may not know any better, and lack appropriate guidance and support when choosing their passwords and subsequently attempting to manage them. Given that such support could reasonably be expected to come from the systems upon which the passwords are used, this paper presents an assessment of password practices on 10 popular websites, examining the extent to which they provide guidance for password selection, enforce restrictions on password choices, and support easy and effective recovery or reset if passwords are forgotten. The findings reveal that the situation is extremely variable, with none of the assessed sites performing ideally across all of the assessed criteria. Better efforts are consequently required if password practices amongst the general populous are expected to improve.     

QQ密码的破解与防范

随着QQ号码申请越来越难和QQ号码收费现象的出现,QQ密码被盗现象也越来越严重。随之产生的破解工具也越来越多。若要防范QQ密码被盗,了解QQ密码破解的方法是非常必要的。也许有人寄希望于“QQ密码保护”,但破解者有可能在QQ号码取回之前将“好友”删之一空,使“好友”(QQ号码上能联系的人)发来的消息收不到。本文针对几种常见的QQ密码破解,给出了相应的防范措施。