A Password Meter without Password Exposure

Area of Science:

• Computer Science
• Cryptography
• Information Security

Background:

• Online password meters often require users to submit password candidates, risking exposure of sensitive information.
• Third-party password metering services can exacerbate these privacy and security threats.
• Existing password metering methods may not adequately protect user data from the metering service itself.

Purpose of the Study:

• To develop a novel online password meter concept that evaluates user-chosen password candidates without exposing them to the server.
• To address the privacy concerns associated with traditional password metering systems.
• To explore the practical application of fully homomorphic encryption (FHE) in secure password strength evaluation.

Main Methods:

• Adaptation of fully homomorphic encryption (FHE) schemes to create a privacy-preserving password meter.
• Implementation of performance enhancement techniques to overcome FHE computational challenges.
• Utilizing the NIST (National Institute of Standards and Technology) password metering method as a benchmark.

Main Results:

• The proposed FHE-based password meter achieves a running time of approximately 60 seconds on a conventional desktop server.
• The system employs an FHE scheme within the HElib library, supporting at least 80-bit security.
• Experimental results validate the feasibility of using FHE for secure password metering, with potential for improved performance on higher-end hardware.

Conclusions:

• The developed password meter effectively evaluates password strength while ensuring user password candidates remain confidential from the server.
• This approach significantly enhances password secrecy, protecting against unauthorized access and disclosure.
• The method offers a promising direction for password metering systems where utmost privacy is critical, safeguarding both user inputs and internal algorithms.