使用概率数据结构的口令相似性
Password similarity using probabilistic data structures
摘要：
密码应该容易记住，但过期策略要求频繁更改密码。在这些相互冲突的需求之间的交叉火力中，用户经常采用创造性的方法来执行随着时间的推移而发生的轻微变化。虽然很容易欺骗最基本的相似性检查，但这些方案导致实际安全性大幅下降，因为泄露的密码，尽管过期，可以有效地利用作为破解者的种子。这项工作描述了一种基于Bloom过滤器来检测密码相似性的方法，该方法可以用于阻止密码重复使用的习惯。所提出的方案本质上混淆了存储的密码，以保护他们在数据库泄漏的情况下，并可以调整为抵抗常见的密码分析技术，使其适合在暴露的系统上使用。
英文摘要：
Passwords should be easy to remember, yet expiration policies mandate their frequent change. Caught in the crossfire between these conflicting requirements, users often adopt creative methods to perform slight variations over time. While easily fooling the most basic checks for similarity, these schemes lead to a substantial decrease in actual security, because leaked passwords, albeit expired, can be effectively exploited as seeds for crackers. This work describes an approach based on Bloom filters to detect password similarity, which can be used to discourage password reuse habits. The proposed scheme intrinsically obfuscates the stored passwords to protect them in case of database leaks, and can be tuned to be resistant to common cryptanalytic techniques, making it suitable for usage on exposed systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
