优化密码组合策略
Optimizing Password Composition Policies
摘要：
密码组合策略限制允许密码的空间，以消除易受统计猜测攻击的弱密码。可用性研究表明，现有的密码组合策略有时会导致较弱的密码分布，因此需要一个更有原则的方法。我们介绍的第一个理论模型优化密码组合策略。我们研究了这个问题的计算和样本的复杂性，在不同的假设下的结构的政策和用户的偏好密码。我们的主要积极成果是一个算法，-与高概率-构造几乎最优的政策（这是指定为一个联盟的子集允许的密码），只需要少量的样本用户的首选密码。我们使用3200万个密码的真实数据集进行模拟，以补充我们的理论结果。
英文摘要：
A password composition policy restricts the space of allowable passwords to eliminate weak passwords that are vulnerable to statistical guessing attacks. Usability studies have demonstrated that existing password composition policies can sometimes result in weaker password distributions; hence a more principled approach is needed. We introduce the first theoretical model for optimizing password composition policies. We study the computational and sample complexity of this problem under different assumptions on the structure of policies and on users' preferences over passwords. Our main positive result is an algorithm that -- with high probability --- constructs almost optimal policies (which are specified as a union of subsets of allowed passwords), and requires only a small number of samples of users' preferred passwords. We complement our theoretical results with simulations using a real-world dataset of 32 million passwords.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
