• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>Progress in Cryptology - AFRICACRYPT 2008 >Password Recovery on Challenge and Response: Impossible Differential Attack on Hash Function
【24h】

Password Recovery on Challenge and Response: Impossible Differential Attack on Hash Function

机译：挑战和响应中的密码恢复：对哈希函数的不可能的差分攻击

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

We propose practical password recovery attacks against two challenge-response authentication protocols using MD4. When a response is computed as MD4(Password||Challenge), passwords up to 12 characters are practically recovered. To recover up to 8 characters, we need 16 times the amount of eavesdropping and 16 times the number of queries, and the off-line complexity is less than 2~(35) MD4 computations. To recover up to 12 characters, we need 2~(10) times the amount of eavesdropping and 2~(10) times the number of queries, and the off-line complexity is less than 2~(40) MD4 computations. When a response is computed as MD4(Password||Challenge||Password), passwords up to 8 characters are practically recovered by 2~8 times the amount of eavesdropping and 2~8 times the number of queries, and the off-line complexity is less than 2~(39) MD4 computations. Our approach is similar to the "Impossible differential attack", which was originally proposed for recovering the block cipher key. Good impossible differentials for hash functions are achieved by using local collision. This indicates that the presence of one practical local collision can damage the security of protocols.
机译：我们针对使用MD4的两种质询响应身份验证协议提出了实用的密码恢复攻击。当将响应计算为MD4（Password || Challenge）时，实际上最多可以恢复12个字符的密码。要恢复最多8个字符，我们需要进行16倍的窃听和16倍的查询，并且离线复杂度小于2〜（35）个MD4计算。要恢复最多12个字符，我们需要侦听量的2〜（10）倍和查询数量的2〜（10）倍，并且离线复杂度小于2〜（40）个MD4计算。当将响应计算为MD4（Password || Challenge ||| Password）时，实际上最多可以恢复8个字符的密码，其窃听量为2〜8倍，查询次数为2〜8倍，并且离线复杂度高小于2〜（39）个MD4计算。我们的方法类似于“不可能的差分攻击”，它最初是为恢复分组密码密钥而提出的。通过使用局部冲突，可以实现哈希函数的良好的不可能微分。这表明一个实际的本地冲突的存在会破坏协议的安全性。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号