[Paper Review] On the Economics of Offline Password Cracking

Jeremiah Blocki, Benjamin Harsha+1 more|arXiv (Cornell University)|Jun 9, 2020

User Authentication and Security Systems70 references35 citations

TL;DR

The paper builds an economic model of offline password cracking to predict how many passwords a rational attacker would crack after a breach, analyzes Zipf-distributed password choices, and argues for memory-hard hashing to mitigate offline attacks.

ABSTRACT

We develop an economic model of an offline password cracker which allows us to make quantitative predictions about the fraction of accounts that a rational password attacker would crack in the event of an authentication server breach. We apply our economic model to analyze recent massive password breaches at Yahoo!, Dropbox, LastPass and AshleyMadison. All four organizations were using key-stretching to protect user passwords. In fact, LastPass' use of PBKDF2-SHA256 with $10^5$ hash iterations exceeds 2017 NIST minimum recommendation by an order of magnitude. Nevertheless, our analysis paints a bleak picture: the adopted key-stretching levels provide insufficient protection for user passwords. In particular, we present strong evidence that most user passwords follow a Zipf's law distribution, and characterize the behavior of a rational attacker when user passwords are selected from a Zipf's law distribution. We show that there is a finite threshold which depends on the Zipf's law parameters that characterizes the behavior of a rational attacker -- if the value of a cracked password (normalized by the cost of computing the password hash function) exceeds this threshold then the adversary's optimal strategy is always to continue attacking until each user password has been cracked. In all cases (Yahoo!, Dropbox, LastPass and AshleyMadison) we find that the value of a cracked password almost certainly exceeds this threshold meaning that a rational attacker would crack all passwords that are selected from the Zipf's law distribution (i.e., most user passwords). This prediction holds even if we incorporate an aggressive model of diminishing returns for the attacker (e.g., the total value of $500$ million cracked passwords is less than $100$ times the total value of $5$ million passwords). See paper for full abstract.

Motivation & Objective

• Quantify damage from offline password attacks using an economic framework.
• Test whether common hash functions (e.g., BCRYPT, PBKDF2) sufficiently protect passwords under Zipf-like distributions.
• Evaluate how memory-hard functions (MHFs) change attacker incentives and outcomes.
• Analyze real breach data (Yahoo!, Dropbox, LastPass, Ashley Madison) to validate the model.
• Recommend password hashing standards and policies based on quantitative findings.

Proposed method

• Develop a decision-theoretic, Stackelberg-style model of a rational offline attacker with parameters v (value per cracked password), k (cost per hash), and a (diminishing returns).
• Model the attacker as choosing a threshold t to guess the top-t passwords and compute expected cost C(t) and reward R(t).
• Assume password distributions follow Zipf’s law (p_i = z / i^s) or CDF-Zipf (λ_t = y·t^r).
• Derive conditions for the attacker’s optimal threshold t* and the resulting fraction cracked λ_{t*}.
• Compare model predictions under non-memory-hard vs memory-hard hashing by incorporating AT-cost k = τ·CH + τ^2·C_mem for MHFs, versus k = τ for BCRYPT/PBKDF2.
• Apply the model to breach data (Yahoo!, Dropbox, LastPass, Ashley Madison) to assess protection levels and compute expected cracked fractions.

Experimental results

Research questions

• RQ1 What fraction of user passwords would a rational attacker crack after a breach under Zipf/CDF-Zipf distributions?
• RQ2 How do password hashing choices (memory-hard vs non-memory-hard) influence attacker incentives and the overall crack rate?
• RQ3 Do real-world breaches (Yahoo!, Dropbox, LastPass, Ashley Madison) imply that existing protections (BCRYPT/PBKDF2) are insufficient under Zipf-like distributions?
• RQ4 What are the model-free bounds on the fraction of passwords cracked and how do they compare to Zipf-based predictions?
• RQ5 Can memory-hard functions reduce the percent of passwords cracked to below critical thresholds without unacceptable authentication delay?

Key findings

• Zipf’s law provides strong fit to Yahoo! password frequencies, with Yahoo! data (N=70 million) well modeled by CDF-Zipf parameters y and r.
• There exists a threshold T(y,r,a) such that if the first cracked password’s value v ≥ T·k, the attacker’s optimal strategy is to continue until all passwords are cracked under Zipf-like distributions.
• For Yahoo!, Dropbox, LastPass, and Ashley Madison, the value per cracked password typically exceeds the threshold, implying a rational attacker would crack all passwords drawn from Zipf-like distributions.
• Memory-hard functions like SCRYPT or Argon2id substantially raise guessing costs, leading rational attackers to abandon attempts before most passwords are cracked.
• Model-based bounds indicate that greater use of MHFs can meaningfully reduce the percentage of cracked passwords, potentially below 22.2% without pushing authentication delays to a full second.
• The analysis challenges the sufficiency of BCRYPT/PBKDF2 protections and advocates updating standards to require memory-hard hashing and, where feasible, secure distributed password hashing protocols.