On Limitations of Designing Leakage-Resilient Password Systems: Attacks, Principles and Usability

19th Annual Network and Distributed System Security Symposium, NDSS 2012

Volumn , Issue , 2012, Pages

  Yan, Qiang ^a   Han, Jin ^a   Li, Yingjiu ^a   Deng, Robert H ^a  

^a SINGAPORE MANAGEMENT UNIVERSITY   (Singapore)

Author keywords

[No Author keywords available]

Indexed keywords

COGNITIVE SYSTEMS; NETWORK SECURITY; USABILITY ENGINEERING;

ATTACK PRINCIPLES; BRUTE-FORCE ATTACK; DESIGN PRINCIPLES; INTENSIVE RESEARCH; LEAKAGE-RESILIENCE; PASSWORD SYSTEMS; POWER; SECURITY AND USABILITIES; SECURITY COMMUNITY; STATISTICAL ATTACKS;

AUTHENTICATION;

EID: 84894217609     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (35)

1. H. J. Asghar, S. Li, J. Pieprzyk, and H. Wang. Cryptanalysis of the convex hull click human identification protocol. In Proceedings of the 13th international conference on Information security, pages 24-30, 2010.
2. H. J. Asghar, J. Pieprzyk, and H. Wang. A new human identification protocol and coppersmith's baby-step giant-step algorithm. In Proceedings of the 8th international conference on Applied cryptography and network security, pages 349-366, 2010.
3. A. D. Baddeley. The Essential Handbook of Memory Disorders for Clinicians, chapter 1, pages 1-13. John Wiley & Sons, 2004.
4. X. Bai, W. Gu, S. Chellappan, X. Wang, D. Xuan, and B. Ma. Pas: Predicate-based authentication services against powerful passive adversaries. In Proceedings of the 2008 Annual Computer Security Applications Conference, pages 433-442, 2008.
5. R. Biddle, S. Chiasson, and P. C. van Oorschot. Graphical passwords: Learning from the first twelve years. In Technical Report TR-11-01, 2011.
6. J. I. D. Campbell and Q. Xue. Cognitive arithmetic across cultures. Journal of Experimental Psychology: General, 130(2):299-315, 2001.
7. L. Corbina and J. Marquer. Effect of a simple experimental control: The recall constraint in sternberg's memory scanning task. European Journal of Cognitive Psychology, 20(5):913-935, 2008.
8. B. Coskun and C. Herley. Can "something you know" be saved? In Proceedings of the 11th international conference on Information Security, pages 421-440, 2008.
9. N. Cowan. The magical number 4 in short-term memory: a reconsideration of mental storage capacity. Behavioral and Brain Sciences, 24(1):87-114, 2001.
10. F. I. Craik and J. M. McDowd. Age differences in recall and recognition. Journal of Experimental Psychology: Learning, Memory, and Cognition, 13(3):474-479, 1987.
11. P. Dunphy, A. P. Heiner, and N. Asokan. A closer look at recognition-based graphical passwords on mobile devices. In Proceedings of the Sixth Symposium on Usable Privacy and Security, pages 3:1-3:12, 2010.
12. D. L. Fisher. Central capacity limits in consistent mapping, visual search tasks: Four channels or more? Cognitive Psychology, 16(4):449-484, 1984.
13. P. Golle and D. Wagner. Cryptanalysis of a cognitive authentication scheme (extended abstract). In Proceedings of the 2007 IEEE Symposium on Security and Privacy, pages 66-70, 2007.
14. R. M. Hogan and W. Kintsch. Differential effects of study and test trials on long-term recognition and recall. Journal of Verbal Learning and Verbal Behavior, 10(5):562-567, 1971.
15. N. J. Hopper and M. Blum. Secure human identification protocols. In Proceedings of the 7th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology, pages 52-66, 2001.
16. T. S. Horowitz and J. M. Wolfe. Search for multiple targets: Remember the targets, forget the search. Perception & Psychophysics, 63(2):272-285, 2001.
17. M. Lei, Y. Xiao, S. Vrbsky, C.-C. Li, and L. Liu. A virtual password scheme to protect passwords. In Proceedings of IEEE International Conference on Communications, pages 1536-1540, 2008.
18. S. Li, H. Asghar, J. Pieprzyk, A.-R. Sadeghi, R. Schmitz, and H. Wang. On the security of pas (predicate-based authentication service). In Proceedings of the 2009 Annual Computer Security Applications Conference, pages 209-218, 2009.
19. S. Li, S. A. Khayam, A.-R. Sadeghi, and R. Schmitz. Breaking randomized linear generation functions based virtual password system. In Proceedings of the 2010 IEEE International Conference on Communications, pages 23-27, 2010.
20. S. Li and H. yeung Shum. Secure human-computer identification (interface) systems against peeping attacks: SecHCI. In Cryptology ePrint Archive, Report 2005/268, 2005.
21. J. Long and J. Wiles. No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing. Syngress, 2008.
22. T. Matsumoto and H. Imai. Human identification through insecure channel. In Proceedings of the 10th annual international conference on Theory and application of cryptographic techniques, pages 409-421, 1991.
23. P. A. Nobel and R. M. Shiffrin. Retrieval processes in recognition and cued recall. Journal of Experimental Psychology: Learning, Memory, and Cognition, 27(2):384-413, 2001.
24. T. Perkovic, A. Mumtaz, Y. Javed, S. Li, S. A. Khayam, and M. Cagalj. Breaking undercover: Exploiting design flaws and nonuniform human behavior. In Proceedings of the Seventh Symposium on Usable Privacy and Security, 2011.
25. D. Rohrer and J. Wixted. An analysis of latency and interresponse time in free recall. Memory. & Cognition, 22(5):511-524, 1994.
26. V. Roth, K. Richter, and R. Freidinger. A pin-entry method resilient against shoulder surfing. In Proceedings of the 11th ACM conference on Computer and communications security, pages 236-245, 2004.
27. H. Sasamoto, N. Christin, and E. Hayashi. Undercover: authentication usable in front of prying eyes. In Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, pages 183-192, 2008.
28. S. Sternberg. Memory-scanning: Mental processes revealed by reaction-time experiments. American Scientist, 57:421-457, 1969.
29. N. Unsworth and R. W. Engle. The nature of individual differences in working memory capacity: Active maintenance in primary memory and controlled search from secondary memory. Psychological Review, 114(1):104-132, 2007.
30. E. Vogel and M. Machizawa. Neural activity predicts individual differences in visual working memory capacity. Nature, 428(6984):748-751, 2004.
31. D. Weinshall. Cognitive authentication schemes safe against spyware (short paper). In Proceedings of the 2006 IEEE Symposium on Security and Privacy, pages 295-300, 2006.
32. S. Wiedenbeck, J. Waters, L. Sobrado, and J.-C. Birget. Design and evaluation of a shoulder-surfing resistant graphical password scheme. In Proceedings of the working conference on Advanced visual interfaces, pages 177-184, 2006.
33. G. F. Woodman and M. M. Chun. The role of working memory and long-term memory in visual search. Visual Cognition, 14(4-8):808-830, 2006.
34. G. F. Woodman and S. J. Luck. Visual search is slowed when visuospatial working memory is occupied. Psychonomic Bulletin and Review, 11(2):269-274, 2004.
35. H. Zhao and X. Li. S3pas: A scalable shoulder-surfing resistant textual-graphical password authentication scheme. In Proceedings of the 21st International Conference on Advanced Information Networking and Applications Workshops - Volume 02, pages 467-472, 2007.