Skeptic：自动、可论证且隐私保护的密码组合策略选择
Skeptic: Automatic, Justified and Privacy-Preserving Password Composition Policy Selection
AI总结：
提出Skeptic工具，基于真实密码数据构建概率分布并模拟用户重选行为，自动选择均匀性最优的密码组合策略，无需访问原始数据即可论证选择，并验证了与实证研究的一致性。
摘要：
在受密码保护的系统中，选择要执行的密码组合策略是一项关键的安全决策，并且已被证明会显著影响用户所选密码对猜测攻击的脆弱性。然而在实践中，这种选择通常不够严谨或缺乏依据，系统管理员往往仅凭直觉来选择密码组合策略。在本工作中，我们提出了一种新颖的方法，该方法利用从大量真实世界密码数据构建的密码概率分布，这些数据已根据各种密码组合策略进行了过滤。随后对密码概率进行重新分配，以模拟不同的用户密码重新选择行为，从而自动确定能够使用户所选密码分布达到最大均匀性的密码组合策略，我们证明该指标是衡量对密码猜测攻击整体抵抗力的有效代理。此外，我们表明，通过将幂律方程拟合到我们生成的密码概率分布，我们可以在不直接访问用户密码数据的情况下论证我们对密码组合策略的选择。最后，我们介绍了Skeptic——一个实现该方法的软件工具包，包括一个领域特定语言（DSL），使没有密码安全背景的系统管理员能够比较和排序密码组合策略，而无需进行昂贵且耗时的用户研究。利用来自3个数据集的205,176,321个密码，我们验证了我们的方法，证明我们获得的结果与先前关于密码组合策略有效性的实证研究结果紧密吻合。
英文摘要：
The choice of password composition policy to enforce on a password-protected system represents a critical security decision, and has been shown to significantly affect the vulnerability of user-chosen passwords to guessing attacks. In practice, however, this choice is not usually rigorous or justifiable, with a tendency for system administrators to choose password composition policies based on intuition alone. In this work, we propose a novel methodology that draws on password probability distributions constructed from large sets of real-world password data which have been filtered according to various password composition policies. Password probabilities are then redistributed to simulate different user password reselection behaviours in order to automatically determine the password composition policy that will induce the distribution of user-chosen passwords with the greatest uniformity, a metric which we show to be a useful proxy to measure overall resistance to password guessing attacks. Further, we show that by fitting power-law equations to the password probability distributions we generate, we can justify our choice of password composition policy without any direct access to user password data. Finally, we present Skeptic -- a software toolkit that implements this methodology, including a DSL to enable system administrators with no background in password security to compare and rank password composition policies without resorting to expensive and time-consuming user studies. Drawing on 205,176,321 pass words across 3 datasets, we lend validity to our approach by demonstrating that the results we obtain align closely with findings from a previous empirical study into password composition policy effectiveness.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
