"Give Me Letters 2, 3 and 6!": Partial Password Implementations and Attacks
Date: April 2013
Publication: Proceedings of the 17th International Conference on Financial Cryptography and Data Security 2013 / Lecture Notes in Computer Science, Volume 7859
Page(s): 126 - 143
Source 1: http://fc13.ifca.ai/proc/4-1.pdf
Source 2: http://groups.inf.ed.ac.uk/security/passwords/pps.pdf
Source 3: http://dx.doi.org/10.1007/978-3-642-39884-1_11 - Subscription or payment required
Abstract or Summary:
A partial password is a query of a subset of characters from a full password, posed as a challenge such as "Give me letters 2, 3 and 6 from your password". Partial passwords are commonly used in the consumer financial sector, both online and in telephone banking. They provide a cheap way of providing a varying challenge that prevents eavesdroppers or intermediate systems learning a shared secret in a single step. Yet, despite widespread adoption among millions of consumers, this mechanism has had little attention in the academic literature. Answers to obvious questions are not clear, for example, how many observations are needed for an attacker to learn the complete password, or to successfully answer the next challenge? In this paper we survey a number of online banking implementations of partial passwords, and investigate the security of the mechanism. In particular, we look at guessing attacks with a projection dictionary ranked by likelihood, and recording attacks which use previous information collected by an attacker. The combination of these techniques yields the best attack on partial passwords.
Do you have additional information to contribute regarding this research paper? If so, please email firstname.lastname@example.org with the details.