[Paper Review] Naturally Rehearsing Passwords

Jeremiah Blocki, Manuel Blum+1 more|arXiv (Cornell University)|Feb 20, 2013

User Authentication and Security Systems37 references19 citations

TL;DR

This paper introduces Shared Cues, a novel password management scheme that leverages the Chinese Remainder Theorem to naturally increase rehearsal frequency through user account visits, thereby enhancing usability without sacrificing security. By modeling human memory with rehearsal schedules based on cognitive science, the scheme minimizes extra rehearsals while providing provable security against online, offline, and plaintext leak attacks.

ABSTRACT

We introduce quantitative usability and security models to guide the design of password management schemes --- systematic strategies to help users create and remember multiple passwords. In the same way that security proofs in cryptography are based on complexity-theoretic assumptions (e.g., hardness of factoring and discrete logarithm), we quantify usability by introducing usability assumptions. In particular, password management relies on assumptions about human memory, e.g., that a user who follows a particular rehearsal schedule will successfully maintain the corresponding memory. These assumptions are informed by research in cognitive science and validated through empirical studies. Given rehearsal requirements and a user's visitation schedule for each account, we use the total number of extra rehearsals that the user would have to do to remember all of his passwords as a measure of the usability of the password scheme. Our usability model leads us to a key observation: password reuse benefits users not only by reducing the number of passwords that the user has to memorize, but more importantly by increasing the natural rehearsal rate for each password. We also present a security model which accounts for the complexity of password management with multiple accounts and associated threats, including online, offline, and plaintext password leak attacks. Observing that current password management schemes are either insecure or unusable, we present Shared Cues--- a new scheme in which the underlying secret is strategically shared across accounts to ensure that most rehearsal requirements are satisfied naturally while simultaneously providing strong security. The construction uses the Chinese Remainder Theorem to achieve these competing goals.

Motivation & Objective

• Address the critical gap in existing password management schemes that are either insecure or unusable due to poor usability.
• Formalize usability as a function of rehearsal requirements and user visitation frequency, grounded in cognitive science models of human memory.
• Develop a security model that accounts for real-world threats, including online, offline, and plaintext password leak attacks.
• Design a scheme that simultaneously satisfies strong usability and provable security guarantees through strategic sharing of secrets across accounts.
• Demonstrate that natural rehearsal from regular account access reduces the need for extra, artificial rehearsals, improving user adoption and retention.

Proposed method

• Introduce a usability model based on cognitive science, quantifying memory retention through rehearsal schedules such as the expanding rehearsal (ER) and squared rehearsal (SQ) assumptions.
• Define a password management scheme as a generator function producing public cue-password pairs and a prescribed rehearsal schedule.
• Apply the Chinese Remainder Theorem to construct Shared Cues (SC), where the underlying secret is shared across accounts to ensure natural rehearsal via visitation frequency.
• Model user visitation schedules with frequency λ (e.g., 1/365 for infrequent accounts), and compute extra rehearsals required beyond natural ones.
• Use the squared rehearsal assumption (R(c,i) = i²σ) to derive sufficient rehearsal intervals that maintain high memory availability over time.
• Evaluate usability via expected extra rehearsals over one year (E[X₃₆₅]) under different user profiles (very active, typical, occasional, infrequent).

Experimental results

Research questions

• RQ1 How can password management schemes be designed to minimize the number of extra rehearsals users must perform beyond natural account visits?
• RQ2 To what extent does password reuse improve usability through increased natural rehearsal, and can this benefit be preserved without compromising security?
• RQ3 Can a scheme be constructed that provably resists online, offline, and plaintext password leak attacks while maintaining strong usability?
• RQ4 What rehearsal schedules based on cognitive science models (e.g., ER, SQ) are sufficient to maintain long-term memory retention of passwords?
• RQ5 How does the Shared Cues construction using the Chinese Remainder Theorem balance natural rehearsal with cryptographic security?

Key findings

• The Shared Cues (SC) scheme significantly reduces the number of extra rehearsals required—e.g., SC-0 and SC-1 require approximately 0 to 12.74 extra rehearsals per year for typical users, compared to 882.8 for Strong Random and Independent (SRI).
• Under the squared rehearsal assumption (SQ), SC-1 requires 7.086 extra rehearsals per year for a typical user, while SC-2 requires 12.74, demonstrating strong usability with provable security.
• For infrequent users (λ = 1/365), SRI requires 1176.4 extra rehearsals annually, whereas SC-2 requires 125.24, showing a substantial usability improvement.
• The Lifehacker scheme (B+D) requires nearly zero extra rehearsals but is highly insecure, highlighting the trade-off between usability and security in existing schemes.
• The Shared Cues construction achieves provable security against all three attack types (online, offline, plaintext leak) while leveraging natural visitation patterns to satisfy rehearsal requirements.
• The study confirms that natural rehearsal from regular account access can replace artificial rehearsal, especially when the Chinese Remainder Theorem is used to align cue-password associations with visitation frequency.