IEEE Consumer Electronics Magazine - January/February 2022 - 84

Special Section on Secure and High-Speed Electronic Systems
Table 2. Some frequently used rules for password guessing.
Name
Description
Lowercase
Capitalize
Reverse
Duplicate
Lowercase all letters
Capitalize the first letter and
lower the rest
Reverse the entire word
Duplicate entire word
Ouput word
p@ssw0rd
P@ssw0rd
dr0Wss@p
p@ssW0rdp@ssW0rd
PASSWORD GUESSING METHODS
In the brute-force attack, an attacker desires
to find the correct password as quickly as possible.
Instead of trying every combination of characters,
this attacker can take advantage of a
high-quality password guessing method that
would help significantly reduce the number of
attempts.
Rules
The rule-based attack is an efficient password
guessing method provided by the popular password
recovery tools, John the Ripper and Hashcat.
It is able to generate new passwords from
transforming passwords in a dictionary. Table 2
lists some of the frequently used rules and the
corresponding output words when the input
word is " p@ssW0rd. " Although the rule-based
attack works well in practice, it needs specialized
expertise to further expand the passwords.
Markov Model and PCFG
Guessing passwords with the Markov models
was first proposed by Narayanan and Shmatikov.9
As users' passwords are likely to be similar to their
native language, it is possible to use the Markov
modeling techniques to reduce the size of the
search space. The Markov model gives the probability
of a character which appears in a certain
string. For example, if there is a 4-B string " ilov, "
then it is very likely that the next character is " e. "
Different from learning the model from natural
languages, PCFG learns these features from password
distributions, which was first adopted by
Weir et al.10. This method parses the password
into a base structure with three types of segments:
the alpha strings (L), digit strings (D), and
special strings (S). For example, the password
" pass123@ " could be denoted as L4D3S1.Then,
the probabilities of these base structures and the
84
probabilities of strings in each segment are
learned from the leaked password dataset. With
this information, the probability of a password
can be derived. Therefore, PCFG can guess the
passwords based on their order in probability.
Neural Networks
Compared with traditional password guessing
methods, neural networks are the most powerful
tools to learn features from the password
datasets. One remarkable work dubbed PassGAN
by Hitaj et al.11 uses the generative adversarial
network (GAN) to generate passwords that have
similar distributions with the training dataset.
PassGAN has one discriminator and one generator,
and its discriminator is used to score a given
string's similarity to a real password, whereas
its generator is used to generate a " fake " password
string that cannot be distinguished by the
discriminator. By alternatively improving the
generator and the discriminator, the output of
the generator will eventually be brought close to
the real password dataset. The experimental
results show that PassGAN has the same guess
accuracy as the best rules in Hashcat. One
advantage of PassGAN is that it can generate an
unlimited number of passwords, whereas the
number of passwords generated from the rulebased
method is limited by the size of the dictionary
and the number of rules applied.
ACCELERATOR DESIGN
METHODOLOGY
As password recovery is highly parallelizable,
it is important that an accelerator can
explore parallelism. Typically, there are two
methods to improve the parallelism in an accelerator,
which includes the multicore-based
design and the pipeline-based design, as introduced
in this section. Some of the novel techniques
and the problems they help solve are also
described.
Multicore-Based Design
Multicore-based designs improve parallelism
by exploring more processing cores. GPU falls
into this category, where thousands of relatively
simple cores are available and work together.
In the FPGA-based solutions, the sha256crypt
IEEE Consumer Electronics Magazine
IEEE Consumer Electronics Magazine - January/February 2022

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - January/February 2022
