集中式与分散式定向蛮干攻击：边信息猜测
Centralized vs Decentralized Targeted Brute-Force Attacks: Guessing with Side-Information
摘要：
根据最近的实证研究，大多数用户在多个密码保护的在线服务中使用相同或非常相似的密码。这种做法可能会产生灾难性的后果，因为一个密码被泄露会使所有其他帐户面临更高的风险。一般来说，攻击者可能会使用他/她拥有的关于用户的任何辅助信息，无论是人口统计信息，以前受损帐户上的密码重复使用，还是任何其他相关信息，以设计更好的蛮力策略（所谓的有针对性的攻击）。在这项工作中，我们考虑了一个分布式的蛮干攻击的情况下，$m$的对手，每个观察一些边信息，试图突破密码安全的系统。我们比较两种策略：一种是不协调攻击，其中攻击者根据他们自己的辅助信息查询系统，直到他们找到正确的密码;另一种是完全协调攻击，其中攻击者将他们的辅助信息集中起来，一起查询系统。对于长度为$n$的密码$\mathbf{X}$，从分布$P_X$独立且相同地生成，当侧信息$\mathbf{Y}_{(m)}$独立于通过无记忆通道$P_{Y|X}$传递$\mathbf{X}$而生成时，我们建立了不协调和协调策略的渐近闭合形式表达式，因为密码$n$的长度趋于无穷大。我们说明了我们的结果，二进制对称通道和二进制擦除通道，两个家庭的边信息通道模型密码重用。我们证明了两个协调代理执行渐近优于任何有限数量的不协调代理这些渠道，这意味着共享边信息是非常有价值的分布式攻击。
英文摘要：
According to recent empirical studies, a majority of users have the same, or very similar, passwords across multiple password-secured online services. This practice can have disastrous consequences, as one password being compromised puts all the other accounts at much higher risk. Generally, an adversary may use any side-information he/she possesses about the user, be it demographic information, password reuse on a previously compromised account, or any other relevant information to devise a better brute-force strategy (so called targeted attack). In this work, we consider a distributed brute-force attack scenario in which $m$ adversaries, each observing some side information, attempt breaching a password secured system. We compare two strategies: an uncoordinated attack in which the adversaries query the system based on their own side-information until they find the correct password, and a fully coordinated attack in which the adversaries pool their side-information and query the system together. For passwords $\mathbf{X}$ of length $n$, generated independently and identically from a distribution $P_X$, we establish an asymptotic closed-form expression for the uncoordinated and coordinated strategies when the side-information $\mathbf{Y}_{(m)}$ are generated independently from passing $\mathbf{X}$ through a memoryless channel $P_{Y|X}$, as the length of the password $n$ goes to infinity. We illustrate our results for binary symmetric channels and binary erasure channels, two families of side-information channels which model password reuse. We demonstrate that two coordinated agents perform asymptotically better than any finite number of uncoordinated agents for these channels, meaning that sharing side-information is very valuable in distributed attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
