A New Distribution-Sensitive Secure Sketch and Popularity-Proportional Hashing. / Woodage, Joanne; Chatterjee, Rahul ; Dodis, Yevgeniy ; Juels, Ari ; Ristenpart, Thomas .

CRYPTO 2017: Advances in Cryptology – CRYPTO 2017. Springer, 2017. p. 682-710 (Lecture Notes in Computer Science; Vol. 10403).

Research output: Chapter in Book/Report/Conference proceedingChapter

Published

Documents

Links

  • Joanne Woodage
  • Rahul Chatterjee
  • Yevgeniy Dodis
  • Ari Juels
  • Thomas Ristenpart

Abstract

Motivated by typo correction in password authentication, we investigate cryptographic error-correction of secrets in settings where the distribution of secrets is a priori (approximately) known. We refer to this as the distribution-sensitive setting.

We design a new secure sketch called the layer-hiding hash (LHH) that offers the best security to date. Roughly speaking, we show that LHH saves an additional logH0(W) bits of entropy compared to the recent layered sketch construction due to Fuller, Reyzin, and Smith (FRS). Here H0(W) is the size of the support of the distribution W. When supports are large, as with passwords, our new construction offers a substantial security improvement.

We provide two new constructions of typo-tolerant password-based authentication schemes. The first combines a LHH or FRS sketch with a standard slow-to-compute hash function, and the second avoids secure sketches entirely, correcting typos instead by checking all nearby passwords. Unlike the previous such brute-force-checking construction, due to Chatterjee et al., our new construction uses a hash function whose runtime is proportional to the popularity of the password (forcing a longer hashing time on more popular, lower entropy passwords). We refer to this as popularity-proportional hashing (PPH). We then introduce a framework for comparing different typo-tolerant authentication approaches. We show that PPH always offers a better time / security trade-off than the LHH and FRS constructions, and for certain distributions outperforms the Chatterjee et al. construction. Elsewhere, this latter construction offers the best trade-off. In aggregate our results suggest that the best known secure sketches are still inferior to simpler brute-force based approaches.
Original languageEnglish
Title of host publicationCRYPTO 2017
Subtitle of host publicationAdvances in Cryptology – CRYPTO 2017
PublisherSpringer
Pages682-710
Number of pages29
ISBN (Electronic)978-3-319-63697-9
ISBN (Print)978-3-319-63696-2
DOIs
Publication statusPublished - 2017

Publication series

NameLecture Notes in Computer Science
Volume10403
ISSN (Print)0302-9743
This open access research output is licenced under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.

ID: 28239223