English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Modern authentication systems store hashed values of passwords of users usingcryptographic hash functions. Therefore, to crack a password an attacker needsto guess a hash function input that is mapped to the hashed value, as opposedto the password itself. We call a hash function that maps the same number ofinputs to each bin, as \textbf{unbiased}. However, cryptographic hash functionsin use have not been proven to be unbiased (i.e., they may have an unequalnumber of inputs mapped to different bins). A cryptographic hash function hasthe property that it is computationally difficult to find an input mapped to abin. In this work we introduce a structured notion of biased hash functions forwhich we analyze the average guesswork under certain types of brute forceattacks. This work shows that the level of security depends on the set ofhashed values of valid users as well as the statistical profile of a hashfunction, resulting from bias. We examine the average guesswork conditioned onthe set of hashed values, and model the statistical profile through theempirical distribution of the number of inputs that are mapped to a bin. Inparticular, we focus on a class of statistical profiles (capturing the bias) ,which we call type-class statistical profiles, that has an empiricaldistribution related to the probability of the type classes defined in themethod of types. For such profiles, we show that the average guesswork isrelated to basic measures in information theory such as entropy and divergence.We use this to show that the effect of bias on the conditional averageguesswork is limited compared to other system parameters such as the number ofvalid users who store their hashed passwords in the system.

Password Cracking: The Effect of Hash Function Bias on the Average Guesswork