实验室1篇论文被IEEE TIFS录用！
题目：TransPCFG: Transferring the Grammars from Short Passwords to Guess Long Passwords Efficiently
期刊：IEEE Transactions on Information Forensics & Security. (TIFS) (CCF A类)
作者：Weili Han, Ming Xu, Junjie Zhang, Chuanwang Wang, Kai Zhang, X. Sean Wang
简介：长口令是当前口令策略中备受推崇的安全口令策略，本文针对长口令设计了高效攻击方法TransPCFG，TransPCFG利用了短口令中的知识高效破解长口令，实验表明与PCFGv4.1相比，TransPCFG在破解16位长口令时可以相对提高56.10%。另外，我们发现包含更多段数的长口令(比如12zxcvbnword1997)更能抵御长口令攻击(包括TransPCFG, Markov, LSTM攻击)。我们因此推荐安全实用的口令策略是有四段或更多段的长口令。
The overview of TransPCFG
Abstract:
Long passwords are gaining popularity in password policy recommendations; however, data-driven guessing studies are woefully inadequate in adapting to long passwords, lacking in both guessing efficiency and their composition guidelines. For state-of-the-art data-driven password guessing methods such as PCFGs (Probabilistic Context-free Grammars), their guessing efficiency is limited by the presence of a large scale training data, or the lack thereof. Given that long passwords leaked in the real world are typically scarce, coupled with the fact that the data-driven methods’ performance depends on training data, obtaining good performance on long passwords has become a key challenge.
To overcome the dataset limitation, we propose a framework TransPCFG, that transfers the knowledge, (i.e., grammars in PCFGs), from short passwords to facilitate long password guessing. We further perform an empirical evaluation based on three real-world datasets and the results demonstrate superior performance over the state-of-the-art data-driven guessing methods under 1014 offline guesses. For passwords with 16 characters, TransPCFG can compromise an average of 23.30% of the passwords, outperforming PCFG_v4.1 by 56.10%. Additionally, for better password-composition guidelines, we find that long password-composition policies requiring more segments are more resistant to guessing attacks. For the segment, the password 12zxcvbnword1997 has four segments since it follows the template Digit2Keyboard6Letter4Year4. We thus recommend users to create long passwords with four or more segments instead of the widely recommended more character classes for security.