Resistant Protocol To Resist Large-Scale Online Password Guessing Attacks
Mohd Muzaffaaruddin Arshad, Ayesha Siddiqua, Ishrath Nousheen · 2013
Passwords, passphrases and security codes are used in virtually every interaction between users and information systems. Unfortunately, with such a central role in security, easily guessed passwords are often the weakest link. They grant attackers access to system resources; and bring them significantly closer to being able to access other accounts, nearby machines, and perhaps even administrative privileges. The purpose of this research is to introduce the concept and methodology, follow it by some real-life examples, and scare organizations into implementing stronger password policies. Brute force and dictionary attacks on password-only remote login services are now widespread and ever increasing. Enabling convenient login for legitimate users while preventing such attacks is a difficult problem. We proposes a new Password Guessing Resistant Protocol (PGRP), derived upon revisiting prior proposals designed to restrict such attacks. While PGRP limits the total number of login attempts from unknown remote hosts to as low as a single attempt per username, legitimate users in most cases (e.g., when attempts are made from known, frequently-used machines) can make several failed login attempts before being challenged with an ATT.