An Oblivious Password Cracking Server

An Oblivious Password Cracking Server

Aureliano Calvo [email protected]

Ariel Futoransky [email protected]

Carlos Sarraute [email protected]

Corelabs Core Security Technologies

2012-08-31

Agenda

1 Intro And Motivation

2 Standing On The Shoulders of Giants Hash-Reversing Tables

Private Information Retrieval

3 _{Our Work}

4 _{Future Work}

Intro

• _{Reversing cryptographically-strong hashes is really}

resource intensive.

• _{What if a resource constrained hacker wants to crack a}

password?

• _{Hash reversing tables to the rescue!}

Intro

• _{Reversing cryptographically-strong hashes is really}

resource intensive.

• _{What if a resource constrained hacker wants to crack a}

password?

• _{Hash reversing tables to the rescue!}

Intro

• _{Reversing cryptographically-strong hashes is really}

resource intensive.

• _{What if a resource constrained hacker wants to crack a}

password?

• _{Hash reversing tables to the rescue!}

Space-Time trade-off

• _{Rainbow tables allow to useO(N}2/3_{)space andO(N}2/3₎

time to invert a hash whereN is the size of the pre-image.

• _{For instance a rainbow table used to breakLM takes} 34GBytes.

• _{What if the password cracker cannot store the tables?}

Space-Time trade-off

• _{Rainbow tables allow to useO(N}2/3_{)space andO(N}2/3₎

time to invert a hash whereN is the size of the pre-image.

• _{For instance a rainbow table used to breakLM takes}

34GBytes.

• _{What if the password cracker cannot store the tables?}

Space-Time trade-off

• _{Rainbow tables allow to useO(N}2/3_{)space andO(N}2/3₎

time to invert a hash whereN is the size of the pre-image.

• _{For instance a rainbow table used to breakLM takes}

34GBytes.

• _{What if the password cracker cannot store the tables?}

Privacy implications

• _{A server serves the tables.} • _But...

• _{Now the server can know the passwords being cracked :(.}

Privacy implications

• _{A server serves the tables.} • _But...

• _{Now the server can know the passwords being cracked :(.}

Privacy implications

• _{A server serves the tables.} • _But...

• _{Now the server can know the passwords being cracked :(.}

Agenda

1 Intro And Motivation

2 Standing On The Shoulders of Giants

Hash-Reversing Tables Private Information Retrieval

3 _{Our Work}

4 _{Future Work}

Agenda

1 Intro And Motivation

2 Standing On The Shoulders of Giants

Hash-Reversing Tables

Private Information Retrieval

3 _{Our Work}

4 _{Future Work}

Hellman Tables

• _{Store initial password and ending hash for each chain}

(lengthM).

• _{Each table storesMchains.}

• _{M tables. Each one uses its own reduction function.}

Hellman Tables

• _{Store initial password and ending hash for each chain}

(lengthM).

• _{Each table storesMchains.}

• _{M tables. Each one uses its own reduction function.}

Hellman Tables

• _{Store initial password and ending hash for each chain}

(lengthM).

• _{Each table storesMchains.}

• _{M tables. Each one uses its own reduction function.}

Hellman Tables with Distinguished End-Points

Differences with Hellman Tables

• _{End-points have a property that distinguishes them} • _{Such as number of leading 0s}

• _{The expected length of chains isM.}

• _{Minimizes number of queries made to the tables (justM).}

Hellman Tables with Distinguished End-Points

Differences with Hellman Tables

• _{End-points have a property that distinguishes them}

• _{Such as number of leading 0s}

• _{The expected length of chains isM.}

• _{Minimizes number of queries made to the tables (justM).}

Hellman Tables with Distinguished End-Points

Differences with Hellman Tables

• _{End-points have a property that distinguishes them}

• _{Such as number of leading 0s}

• _{The expected length of chains isM.}

• _{Minimizes number of queries made to the tables (justM).}

Hellman Tables with Distinguished End-Points

Differences with Hellman Tables

• _{End-points have a property that distinguishes them}

• _{Such as number of leading 0s}

• _{The expected length of chains isM.}

• _{Minimizes number of queries made to the tables (justM).}

Rainbow Tables

• _{Just one table withM}2_entries.

• _{Collisions are avoided by using a different reduction}

function for each step.

• _{This is the most popular kind of hash reversing tables.}

Rainbow Tables

• _{Just one table withM}2_entries.

• _{Collisions are avoided by using a different reduction}

function for each step.

• _{This is the most popular kind of hash reversing tables.}

Rainbow Tables

• _{Just one table withM}2_entries.

• _{Collisions are avoided by using a different reduction}

function for each step.

• _{This is the most popular kind of hash reversing tables.}

Table sizes

• _{Number of chains =M}2

• _{M chains for each of theM tables for Hellman Tables and} Hellman Tables With Distinguished Endpoints.

• _{Chain length =M}

• _{Average chain length for Hellman Tables With Distinguished}

Endpoints.

• _{M =}−p3

ln(1−α)·N where:

• _{Nis the size of the preimage}

• _{αis the probability that a preimage can be found using the}

table.

Table sizes

• _{Number of chains =M}2

• _{M chains for each of theM tables for Hellman Tables and}

Hellman Tables With Distinguished Endpoints. • _{Chain length =M}

• _{Average chain length for Hellman Tables With Distinguished}

Endpoints.

• _{M =}−p3

ln(1−α)·N where:

• _{Nis the size of the preimage}

• _{αis the probability that a preimage can be found using the}

table.

Table sizes

• _{Number of chains =M}2

• _{M chains for each of theM tables for Hellman Tables and}

Hellman Tables With Distinguished Endpoints. • _{Chain length =M}

• _{Average chain length for Hellman Tables With Distinguished} Endpoints.

• _{M =}−p3

ln(1−α)·N where:

• _{Nis the size of the preimage}

• _{αis the probability that a preimage can be found using the}

table.

Table sizes

• _{Number of chains =M}2

• _{M chains for each of theM tables for Hellman Tables and}

Hellman Tables With Distinguished Endpoints. • _{Chain length =M}

• _{Average chain length for Hellman Tables With Distinguished}

Endpoints. • _{M =}−p3

ln(1−α)·N where:

• _{Nis the size of the preimage}

• _{αis the probability that a preimage can be found using the}

table.

Table sizes

• _{Number of chains =M}2

• _{M chains for each of theM tables for Hellman Tables and}

Hellman Tables With Distinguished Endpoints. • _{Chain length =M}

• _{Average chain length for Hellman Tables With Distinguished}

Endpoints. • _{M =}−p3

ln(1−α)·N where:

• _{Nis the size of the preimage}

• _{αis the probability that a preimage can be found using the} table.

Table sizes

• _{Number of chains =M}2

• _{M chains for each of theM tables for Hellman Tables and}

Hellman Tables With Distinguished Endpoints. • _{Chain length =M}

• _{Average chain length for Hellman Tables With Distinguished}

Endpoints. • _{M =}−p3

ln(1−α)·N where:

• _{Nis the size of the preimage}

• _{αis the probability that a preimage can be found using the} table.

Table sizes

• _{Number of chains =M}2

• _{M chains for each of theM tables for Hellman Tables and}

Hellman Tables With Distinguished Endpoints. • _{Chain length =M}

• _{Average chain length for Hellman Tables With Distinguished}

Endpoints. • _{M =}−p3

ln(1−α)·N where:

• _{Nis the size of the preimage}

• _{αis the probability that a preimage can be found using the}

table.

Agenda

1 Intro And Motivation

2 Standing On The Shoulders of Giants Hash-Reversing Tables

Private Information Retrieval

3 _{Our Work}

4 _{Future Work}

Problem to be solved

• _{Ask for a bit in a database stored by a server without}

revealing the requested bit to the server.

• _{Without sending the entire database (!).}

Problem to be solved

• _{Ask for a bit in a database stored by a server without}

revealing the requested bit to the server.

• _{Without sending the entire database (!).}

Problem to be solved

"Something being imposible does not imply that it has never been done" (Fernando Russ)

Classic PIR

Eyal Kushilevitz and Rafail Ostrovsky

Replication is not needed: Single database, computationally-private information retrieval.

Proceedings of the 38th Annu. IEEE Symp. on Foudations of Computer Science, pages:364–373, 1997.

Classic PIR - Complexities

• _{Server processing complexity: O(n).} • _{Client processing complexity: O(}√_n). • _{Transfer complexity: O(}√_n).

• _{Wherenis the number of bits in the database.}

Classic PIR - Complexities

• _{Server processing complexity: O(n).} • _{Client processing complexity: O(}√_n). • _{Transfer complexity: O(}√_n).

• _{Wherenis the number of bits in the database.}

Classic PIR - Complexities

• _{Server processing complexity: O(n).} • _{Client processing complexity: O(}√_n). • _{Transfer complexity: O(}√_n).

• _{Wherenis the number of bits in the database.}

Classic PIR - Complexities

• _{Server processing complexity: O(n).} • _{Client processing complexity: O(}√_n). • _{Transfer complexity: O(}√_n).

• _{Wherenis the number of bits in the database.}

Agenda

1 Intro And Motivation

2 Standing On The Shoulders of Giants Hash-Reversing Tables

Private Information Retrieval

3 _{Our Work}

4 _{Future Work}

Our Work

Hellman Tables With Distinguished Endpoints as Hash-Reversing Tables queried using Classic PIR.

Calculating the tables

• _{(begin,end)pairs are stored in a closed hash table.} • _{The size of each table isβM, whereβ >1.}

• _{Each entry has an index, representing the initial plain-text,}

and the end-of-chain hash.

• _{The key of the entry is the end-of-chain hash.}

• _{Hash-Table Collisions are discarded when the tables are}

generated.

Calculating the tables

• _{(begin,end)pairs are stored in a closed hash table.} • _{The size of each table isβM, whereβ >1.}

• _{Each entry has an index, representing the initial plain-text,}

and the end-of-chain hash.

• _{The key of the entry is the end-of-chain hash.}

• _{Hash-Table Collisions are discarded when the tables are}

generated.

Calculating the tables

• _{(begin,end)pairs are stored in a closed hash table.} • _{The size of each table isβM, whereβ >1.}

• _{Each entry has an index, representing the initial plain-text,}

and the end-of-chain hash.

• _{The key of the entry is the end-of-chain hash.}

• _{Hash-Table Collisions are discarded when the tables are}

generated.

Calculating the tables

• _{(begin,end)pairs are stored in a closed hash table.} • _{The size of each table isβM, whereβ >1.}

• _{Each entry has an index, representing the initial plain-text,}

and the end-of-chain hash.

• _{The key of the entry is the end-of-chain hash.}

• _{Hash-Table Collisions are discarded when the tables are}

generated.

Calculating the tables

• _{(begin,end)pairs are stored in a closed hash table.} • _{The size of each table isβM, whereβ >1.}

• _{Each entry has an index, representing the initial plain-text,}

and the end-of-chain hash.

• _{The key of the entry is the end-of-chain hash.}

• _{Hash-Table Collisions are discarded when the tables are}

generated.

Reversing a Hash

• _{The client calculates theM ends-of-chain for the hash}

being reversed. One for each table.

• _{It requests the corresponding server buckets, viaMPIR}

requests.

• _{For each response, it checks if the end-of-chain is the one}

needed. If so, it navigates the chain looking for the preimage of the hash being reversed.

Reversing a Hash

• _{The client calculates theM ends-of-chain for the hash}

being reversed. One for each table.

• _{It requests the corresponding server buckets, viaMPIR}

requests.

• _{For each response, it checks if the end-of-chain is the one}

needed. If so, it navigates the chain looking for the preimage of the hash being reversed.

Reversing a Hash

• _{The client calculates theM ends-of-chain for the hash}

being reversed. One for each table.

• _{It requests the corresponding server buckets, viaMPIR}

requests.

• _{For each response, it checks if the end-of-chain is the one}

needed. If so, it navigates the chain looking for the preimage of the hash being reversed.

Complexity

• _{Single hash-reversing client processing complexity:} O(M2).

• _{Single hash-reversing server processing complexity:} O(M2).

• _{Transfer complexity: O(M}3/2_). • _{Server storage complexity: O(M}2_). • _{Table calculation complexity: O(M}3_).

Complexity

• _{Single hash-reversing client processing complexity:} O(M2).

• _{Single hash-reversing server processing complexity:} O(M2).

• _{Transfer complexity: O(M}3/2_). • _{Server storage complexity: O(M}2_). • _{Table calculation complexity: O(M}3_).

Complexity

• _{Single hash-reversing client processing complexity:} O(M2).

• _{Single hash-reversing server processing complexity:} O(M2).

• _{Transfer complexity: O(M}3/2_). • _{Server storage complexity: O(M}2_). • _{Table calculation complexity: O(M}3_).

Complexity

• _{Single hash-reversing client processing complexity:} O(M2).

• _{Single hash-reversing server processing complexity:} O(M2).

• _{Transfer complexity: O(M}3/2_). • _{Server storage complexity: O(M}2_). • _{Table calculation complexity: O(M}3_).

Complexity

• _{Single hash-reversing client processing complexity:} O(M2).

• _{Single hash-reversing server processing complexity:} O(M2).

• _{Transfer complexity: O(M}3/2_). • _{Server storage complexity: O(M}2_). • _{Table calculation complexity: O(M}3_).

Experimental Results

Agenda

1 Intro And Motivation

2 Standing On The Shoulders of Giants Hash-Reversing Tables

Private Information Retrieval

3 _{Our Work}

4 _{Future Work}

Future Work

• _{Optimize using other PIR schemes} • _{Paralelize cracking}

• _{Devise a way to use the current rainbow tables with a PIR}

scheme

• _{Use PIR to reverse hashes in the client while the server}

brute forces it (no tables stored).

Future Work

• _{Optimize using other PIR schemes} • _{Paralelize cracking}

• _{Devise a way to use the current rainbow tables with a PIR}

scheme

• _{Use PIR to reverse hashes in the client while the server}

brute forces it (no tables stored).

Future Work

• _{Optimize using other PIR schemes} • _{Paralelize cracking}

• _{Devise a way to use the current rainbow tables with a PIR}

scheme

• _{Use PIR to reverse hashes in the client while the server}

brute forces it (no tables stored).

Future Work

• _{Optimize using other PIR schemes} • _{Paralelize cracking}

• _{Devise a way to use the current rainbow tables with a PIR}

scheme

• _{Use PIR to reverse hashes in the client while the server}

brute forces it (no tables stored).

Any Question?

Thank you!