Security of Password Hashing in Cloud
- 1 Department of Information Systems Assurance, St. Cloud State University, St. Cloud, MN, USA
Abstract
Though the History of using password in computing can be traced back to as far as mid of last century little focus has been implied on how to securely store and retrieve password to authenticate and authorize services to the end users. In this paper the current security of various password hashing schemes that are in use today will be investigated through practical proof of concept-GPU based, password hash dump cracking using the power of cloud computing. We will be providing comparison on different password hashing cracking time using the cloud GPU power in AWS. The focus of this paper is to show the possible use of cloud computing in cracking hash dumps and the way to countermeasures them by using secure hashing algorithm and using complex passwords.
- O’Gorman, L. (2003) Comparing Passwords, Tokens, and Biometrics for User Authentication. Proceedings of the IEEE, 91, 2021-2040. https://doi.org/10.1109/JPROC.2003.819611
- Adams, A., Sasse, M.A. and Lunt, P. (1997) Making Passwords Secure and Usable. In: Thimbleby, H., et al., Eds., Proceedings of HCI on People and Computers XII, Springer-Verlag, London, 1-19. https://doi.org/10.1007/978-1-4471-3601-9_1
- (2016) MD5 Message Digest Algorithm Hash Collision Weakness. Securityfocus.com. http://www.securityfocus.com/bid/11849/discuss
- Qiu, W.D., Gong, Z., Guo, Y.D., Liu, B.Z., Tang, X. and Yuan, Y. (2016) GPU-Based High-Performance Password Recovery Technique for Hash Functions. ResearchGate. https://www.researchgate.net/publication/292761539_GPU-Based_High_Performance_Password_Recovery_Technique_for_Hash_Functions
- Thompson, C.J., Hahn, S. and Oskin, M. (2002) Using Modern Graphics Architectures for General-Purpose Computing: A Framework and Analysis. Proceedings of the 35th annual ACM/IEEE International Symposium on Microarchitecture, Istanbul, 18-22 November 2002, 306-317. https://doi.org/10.1109/MICRO.2002.1176259
- Cook, D.L., Ioannidis, J., Keromytis, A.D. and Luck, J. (2005) CryptoGraphics: Secret Key Cryptography Using Graphics Cards. Cryptographers’ Track at the RSA Conference, 334-350.
- Yang, J. and Goodman, J. (2007) Symmetric Key Cryptography on Modern Graphics Hardware. Advances in Cryptology, 249.
- Di Biagio, A., Barenghi, A., Agosta, G. and Pelosi, G. (2009) Design of a Parallel AES for Graphics Hardware Using the CUDA Framework. IEEE International Symposium on Parallel & Distributed Processing, Rome, 23-29 May 2009, 1-8. https://doi.org/10.1109/IPDPS.2009.5161242
- Manavski, S.A. (2007) CUDA Compatible GPU as an Efficient Hardware Accelerator for AES Cryptography. IEEE International Conference on Signal Processing and Communications, Dubai, 24-27 November 2007, 65 p.
- Harrison, O. and Waldron, J. (2007) AES Encryption Implementation and Analysis on Commodity Graphics Processing Units. Cryptographic Hardware and Embedded Systems CHES 2007, 209 p. https://doi.org/10.1007/978-3-540-74735-2_15
- Bernstein, D., Chen, H.C., Cheng, C.M., Lange, T., Niederhagen, R., Schwabe, P. and Yang, B.Y. (2010) ECC2K-130 on NVIDIA GPUs. Progress in Cryptology-Indocrypt, 328-346.
- Hu, G., Ma, J. and Huang, B. (2010) High Throughput Implementation of MD5 Algorithm on GPU. Proceedings of the 4th International Conference on Ubiquitous Information Technologies & Applications, Fukuoka, 20-22 December 2009, 1-5.