"Give me letters 2, 3 and 6!": Partial password implementations and attacks

David Aspinall, Mike Just

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Citations (Scopus)

Abstract

A partial password is a query of a subset of characters from a full password, posed as a challenge such as "Give me letters 2, 3 and 6 from your password". Partial passwords are commonly used in the consumer financial sector, both online and in telephone banking. They provide a cheap way of providing a varying challenge that prevents eavesdroppers or intermediate systems learning a shared secret in a single step. Yet, despite widespread adoption among millions of consumers, this mechanism has had little attention in the academic literature. Answers to obvious questions are not clear, for example, how many observations are needed for an attacker to learn the complete password, or to successfully answer the next challenge? In this paper we survey a number of online banking implementations of partial passwords, and investigate the security of the mechanism. In particular, we look at guessing attacks with a projection dictionary ranked by likelihood, and recording attacks which use previous information collected by an attacker. The combination of these techniques yields the best attack on partial passwords.

Original languageEnglish
Title of host publication17th International Conference on Financial Cryptography and Data Security
PublisherSpringer
Pages126-143
Number of pages18
Volume7859
ISBN (Print)978-3-642-39883-4
DOIs
Publication statusPublished - 5 Sep 2013
Event17th International Conference on Financial Cryptography and Data Security - Okinawa, United Kingdom
Duration: 1 Apr 20135 Apr 2013

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume7859 LNCS
ISSN (Print)03029743
ISSN (Electronic)16113349

Conference

Conference17th International Conference on Financial Cryptography and Data Security
Abbreviated titleFC 2013
CountryUnited Kingdom
CityOkinawa
Period1/04/135/04/13

Keywords

  • bank security
  • dictionary attack
  • passwords
  • PINs
  • recording attack

Fingerprint Dive into the research topics of '"Give me letters 2, 3 and 6!": Partial password implementations and attacks'. Together they form a unique fingerprint.

  • Cite this

    Aspinall, D., & Just, M. (2013). "Give me letters 2, 3 and 6!": Partial password implementations and attacks. In 17th International Conference on Financial Cryptography and Data Security (Vol. 7859 , pp. 126-143). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7859 LNCS). Springer. https://doi.org/10.1007/978-3-642-39884-1_11