Advanced Software Research Center, Incheon National University, Incheon 22012, Korea.
ITM Programme, Department of Industrial Engineering, Seoul National University of Science and Technology, Seoul 01811, Korea.
Sensors (Basel). 2021 Jan 6;21(2):345. doi: 10.3390/s21020345.
To meet password selection criteria of a server, a user occasionally needs to provide multiple choices of password candidates to an on-line password meter, but such user-chosen candidates tend to be derived from the user's previous passwords-the meter may have a high chance to acquire information about a user's passwords employed for various purposes. A third party password metering service may worsen this threat. In this paper, we first explore a new on-line password meter concept that does not necessitate the exposure of user's passwords for evaluating user-chosen password candidates in the server side. Our basic idea is straightforward; to adapt fully homomorphic encryption (FHE) schemes to build such a system but its performance achievement is greatly challenging. Optimization techniques are necessary for performance achievement in practice. We employ various performance enhancement techniques and implement the NIST (National Institute of Standards and Technology) metering method as seminal work in this field. Our experiment results demonstrate that the running time of the proposed meter is around 60 s in a conventional desktop server, expecting better performance in high-end hardware, with an FHE scheme in HElib library where parameters support at least 80-bit security. We believe the proposed method can be further explored and used for a password metering in case that password secrecy is very important-the user's password candidates should not be exposed to the meter and also an internal mechanism of password metering should not be disclosed to users and any other third parties.
为了满足服务器的密码选择标准，用户偶尔需要向在线密码计量器提供多个密码候选，但此类用户选择的候选密码往往源自用户之前的密码——计量器很有可能获取到用户用于各种目的的密码信息。第三方密码计量服务可能会加剧这种威胁。在本文中，我们首先探索了一种新的在线密码计量器概念，该概念不需要在服务器端暴露用户的密码，即可评估用户选择的密码候选。我们的基本思路很直接；通过自适应全同态加密（FHE）方案来构建这样的系统，但其实践中的性能实现极具挑战性。需要优化技术才能实现性能。我们采用了各种性能增强技术，并实现了 NIST（美国国家标准与技术研究院）计量方法，作为该领域的开创性工作。我们的实验结果表明，所提出的计量器在传统桌面服务器上的运行时间约为 60 秒，在高端硬件上有望实现更好的性能，使用 HElib 库中的 FHE 方案，其参数支持至少 80 位的安全性。我们相信，在密码保密性非常重要的情况下，可以进一步探索和使用所提出的方法进行密码计量——用户的密码候选不应暴露给计量器，并且密码计量的内部机制也不应向用户和任何其他第三方公开。
