PALPAS - PAsswordLess PA字同步
PALPAS - PAsswordLess PAssword Synchronization
摘要：
在多个用户设备上同步密码的工具通常将加密的密码存储在中央在线数据库中。对于加密，使用基于密码的低熵密钥。这样的数据库可能会受到未经授权的访问，这可能导致通过离线蛮干攻击泄露所有密码。在本文中，我们提出了PALPAS，一个安全和用户友好的工具，在用户设备之间的密码，而不集中存储有关他们的信息。PALPAS的思想是从所有设备共享的高熵秘密和每个服务的随机盐值生成密码。只有盐值存储在服务器上，而不是秘密。盐使用户设备能够生成相同的密码，但在统计上独立于密码。为了使PALPAS能够根据不同的密码策略生成密码，我们还提出了一种自动检索和处理服务密码需求的机制。PALPAS用户只需要记住一个密码，在另一个设备上设置PALPAS只需要一次性传输少量静态数据。
英文摘要：
Tools that synchronize passwords over several user devices typically store the encrypted passwords in a central online database. For encryption, a low-entropy, password-based key is used. Such a database may be subject to unauthorized access which can lead to the disclosure of all passwords by an offline brute-force attack. In this paper, we present PALPAS, a secure and user-friendly tool that synchronizes passwords between user devices without storing information about them centrally. The idea of PALPAS is to generate a password from a high entropy secret shared by all devices and a random salt value for each service. Only the salt values are stored on a server but not the secret. The salt enables the user devices to generate the same password but is statistically independent of the password. In order for PALPAS to generate passwords according to different password policies, we also present a mechanism that automatically retrieves and processes the password requirements of services. PALPAS users need to only memorize a single password and the setup of PALPAS on a further device demands only a one-time transfer of few static data.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
