-As the first protection line for a computer system, the authentication system is of critical importance in the information security area. Despite the steady development of information security mechanisms, the password is the most commonly used authentication tool. The key vulnerability of such a protection mechanism is selecting an insecure password. The period of 2014-2017 saw major Internet companies suffer a number of password database leaks, which followed by a study of real password security. It should be noted that password system protection has not advanced much over the past years; mainly, there has been a clear tendency for imposing stricter requirements on the password entry interface. This being the case, there is still a question, yet to be answered, which passwords can be considered secure and which cannot. The work offers examples of password system assessment and reviews leaked passwords for their security under the current requirements. Security was verified using metrics (password security indices). These metrics provided the basis for defining objective requirements for password system security.
Even though the problems of password system security are subject to permanent studies, this issue remains yet to be dealt with in practice for subjective reasons. For example, some software system developers treat the password system security issue in different ways, while users often fail to meet in full the authentication system security policy.
Over the last two years, there have been a number of major leaks from password databases of communication Internet services (Twitter, Hotmail, Yandex, Google, Mail, Dropbox etc.). This allowed password security to be investigated using informal and formal indices.
II.
PASSWORD SECURITY STRENGTH CONCEPT Let’s consider the password mining probability formula: = ∙ | |
The above makes it possible to formulate simple substantive criteria whereby a password is considered secure:
Password length must be at least 8 characters; Characters of various cases must be taken into account;
Meanwhile, there is a discussion underway in literature as
to formal requirements for password systems [
III.
As is well known, the password requirements were set out in the Orange Book and were actually reduced to password length (6 and 8 characters depending on the system protection class). Current documents define the availability, as a minimum, of a password protection policy at an organization or in a computer system. Some requirements can be made more specific, while others are left in the hands of system administrators (Table 1).
IV.
Listed below are some of the best known password security index classes:
Numerical metrics (e.g. Orange Book);
NIST-recommended password entropy can be calculated by statistics for specific systems, which is not always practicable.
This work will consider the Shannon entropy and heuristic entropy (recommended by NIST SP 800-22). The methods differ in that the Shannon entropy assumes a password to be generated by a random-number generator, while heuristic entropy implies a human created password.
The Shannon entropy is calculated as follows: = log2| | = ∙ log2| | = ln| | ln 2 , where |A| is alphabet capacity, n is password length.
The metric suggests that the more complicated the alphabet and the longer the password, the more secure the latter is.
Given below is the Shannon entropy calculation example (Table 2). of a password containing non-alphanumeric or uppercase characters.
This formula can be described as follows: the first password character receives a value of 4 bits, each subsequent character from the second to the eighth one receives 2 bits, from the ninth to the twentieth – 1.5 bits and each subsequent – 1 bit. If there are non-alphanumeric or uppercase characters, 6 bits are added to the obtained result.
For these metrics, a password is considered secure if it
conforms to the entropy [
The above criteria should be restricted, i.e. if a password is recorded in password brute forcing databases (dictionaries), entropy is reduced to zero. last year. Presented below is certain statistics obtained for each password
database. The outcomes of the study into the compromised password database of
Used alphabet PWD including numerals only PWD composed of characters PWD composed of lowercase letters only PWD similar to mobile phone number PWD coinciding with login PWD similar to dates PWD suitable for secure password informal description PWD suitable as per Shannon security PWD suitable as per NIST security Number of passwords 774,669 1,968,873 1,968,873 22,751 45,010 156,142 0
Comparative analysis of the obtained and earlier known
statistics [
In general, the study confirmed that the authentication system remains highly vulnerable (only 10% of passwords can be considered reliable), which prompts the creation of integrated information protection systems and the improvement of information security management systems.
Finally, it should be noted that using entropic metrics instead of verbal descriptions is more practical in defining technical requirements for information security systems, as they are easier to automate and control. Besides, the use of formal indices helps diminish the degree of subjectivity inherent in system security analysis.