Skip to main content
SpringerLink
Log in

HoneyHash: Honeyword Generation Based on Transformed Hashes

  • Conference paper
  • First Online:
Secure IT Systems (NordSec 2020)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 12556))

Included in the following conference series:

Abstract

Since systems using honeywords store a set of decoy passwords together with real passwords of users to confuse adversaries, they are strongly dependent on the algorithm for generating honeywords. However, all of the existing honeyword generating algorithms are based on raw passwords of users and they either need lots of storage space or show weaknesses in flatness or usability. This paper proposes HoneyHash, a new direction of generating honeywords - generating by transforming password hashes. Analyses show that our algorithm attains expected levels of flatness, security, performance and usability.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 59.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 79.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Gross, D.: 50 million compromised in Evernote hack. In: CNN (2013)

    Google Scholar 

  2. Gaylord, C.: LinkedIn, Last.fm, now Yahoo? Don’t ignore news of a password breach. In: Christian Science Monitor (2012)

    Google Scholar 

  3. Kontaxis, G., Athanasopoulos, E., Portokalidis, G., Keromytis, A.D.: Sauth: protecting user accounts from password database leaks. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, pp. 187–198. ACM (2013)

    Google Scholar 

  4. Cappos, J.: PolyPassHash: protecting passwords in the event of a password file disclosure. In: Password Hashing Competition (PHC) (2014)

    Google Scholar 

  5. Almeshekah, M.H., Gutierrez, C.N., Atallah, M.J., Spafford, E.H.: ErsatzPasswords: ending password cracking and detecting password leakage. In: Proceedings of ACSAC, pp. 311–320 (2015)

    Google Scholar 

  6. Juels, A., Rivest, R. L.: Honeywords: making password-cracking detectable. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, pp. 145–160. ACM (2013)

    Google Scholar 

  7. Cohen, F.: The use of deception techniques: honeypots and decoys. In: Bidgoli, H. (ed.) Handbook of Information Security, vol. 3, pp. 646–655 (2006)

    Google Scholar 

  8. Bojinov, H., Bursztein, E., Boyen, X., Boneh, D.: Kamouflage: loss-resistant password management. In: Gritzalis, D., Preneel, B., Theoharidou, M. (eds.) ESORICS 2010. LNCS, vol. 6345, pp. 286–302. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-15497-3_18

    Chapter  Google Scholar 

  9. Erguler, I.: Achieving flatness: selecting the honeywords from existing user passwords. IEEE Trans. Depend. Secur. Comput. 13(2), 284–295 (2016)

    Article  Google Scholar 

  10. Chatterjee, R., Bonneau, J., Juels, A., Ristenpart, T.: Cracking-resistant password vaults using natural language encoders. IEEE Secur. Privacy 481–498 (2016)

    Google Scholar 

  11. Chakraborty, N., Mondal, S.: Few notes towards making honeyword system more secure and usable. In: Proceedings of 8th International Conference Security and Information Network, pp. 237–245 (2015)

    Google Scholar 

  12. Golla, M., Beuscher, B., Dürmuth, M.: On the security of cracking-resistant password vaults. In: Proceedings of ACM CCS, pp. 1230–1241 (2016)

    Google Scholar 

  13. Chakraborty, N., Mondal, S.: On designing a modified-UI based honeyword generation approach for overcoming the existing limitations. Comput. Secur. 66, 155–168 (2017)

    Article  Google Scholar 

  14. Pasquini, C., Schöttle, P., Böhme, R.: Decoy password vaults: at least as hard as steganography? In: De Capitani di Vimercati, S., Martinelli, F. (eds.) SEC 2017. IAICT, vol. 502, pp. 356–370. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-58469-0_24

    Chapter  Google Scholar 

  15. Genç, Z.A., Kardaş, S., Kiraz, M.S.: Examination of a new defense mechanism: honeywords. In: Hancke, G., Damiani, E. (eds.) Information Security Theory and Practice. WISTP 2017. Lecture Notes in Computer Science, vol. 10741. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-93524-9_8

  16. Wang, D., Cheng, H., Wang, P., Yan, J., Huang, X.: A security analysis of honeywords. In: NDSS (2018)

    Google Scholar 

  17. Gutierrez, C.N., Almeshekah, M.H., Bagchi, S., Spafford, E.H.: A hypergame analysis for Ersatzpasswords. In: Janczewski, L.J., Kutyłowski, M. (eds.) SEC 2018. IAICT, vol. 529, pp. 47–61. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-99828-2_4

    Chapter  Google Scholar 

  18. Akshima, C.D., Goel, A., Mishra, S., Sanadhya, S. K.: Generation of secure and reliable honeywords, preventing false detection. IEEE Trans. Depend. Secure Comput. 16(5), 757–769, (2019)

    Google Scholar 

  19. Wang, D., Cheng, H., Wang, P., Yan, J., Huang, X.: Targeted online password guessing: An underestimated threat. In: Proceedings of ACM SIGSAC Conference on Computing Communication Security, pp. 1242–1254 (2016)

    Google Scholar 

  20. Choi, H., Nam, H., Hur, J.: Password typos resilience in honey encryption. In: Proceedings of IEEE 2017 ICOIN, pp. 594–598 (2017)

    Google Scholar 

  21. Karuna, P., Purohit, H., Ganesan, R., Jajodia, S.: Generating hard to comprehend fake documents for defensive cyber deception. IEEE Intell. Syst. 33(5), 16–25 (2018)

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Peking University, Beijing, China

    Canyang Shi & Huiping Sun

Authors
  1. Canyang Shi
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Huiping Sun
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Huiping Sun .

Editor information

Editors and Affiliations

  1. Linköping University, Linköping, Sweden

    Mikael Asplund

  2. Linköping University, Linköping, Sweden

    Simin Nadjm-Tehrani

Rights and permissions

Reprints and permissions

Copyright information

© 2021 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Shi, C., Sun, H. (2021). HoneyHash: Honeyword Generation Based on Transformed Hashes. In: Asplund, M., Nadjm-Tehrani, S. (eds) Secure IT Systems. NordSec 2020. Lecture Notes in Computer Science(), vol 12556. Springer, Cham. https://doi.org/10.1007/978-3-030-70852-8_10

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-70852-8_10

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-70851-1

  • Online ISBN: 978-3-030-70852-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation