Skip to main content
SpringerLink
Log in

Quantifying the security advantage of password expiration policies

  • Published:
Designs, Codes and Cryptography Aims and scope Submit manuscript

Abstract

Many security policies force users to change passwords within fixed intervals, with the apparent justification that this improves overall security. However, the implied security benefit has never been explicitly quantified. In this note, we quantify the security advantage of a password expiration policy, finding that the optimal benefit is relatively minor at best, and questionable in light of overall costs.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Similar content being viewed by others

Notes

  1. These probabilities are unknown and change across datasets; estimates are used, based on large datasets accumulated from prior compromises, or from heuristic tools.

  2. More precisely, this is for \(\beta \) guesses per account. The optimal attack tries the most probable password on each account, then the next most probable, etc.

  3. If this is counter-intuitive, note that an attack which guesses key candidates in a fixed sequence actually benefits from a key change if the original target key is more distant in the guessing sequence than the newly updated key. In our analogous problem herein, the implication is that a successful guessing attack cannot be prevented even if a user changes their password continuously, as quickly as system interfaces allow.

References

  1. Bonneau J.: The science of guessing: analyzing an anonymized corpus of 70 million passwords. In: IEEE 2012 Symposium on Security and Privacy.

  2. Bonneau J., Herley C., van Oorschot P.C., Stajano F.: The past, present, and future of password-based authentication on the web. Commun. ACM (2015, to appear).

  3. Burr W., Dodson D.F., Polk W.T., (eds). Electronic authentication guideline. NIST Special Pub 800–63 Version 1.0, June 2004 (Later versions include Burr et al., NIST SP-800-63-2, Aug 2013).

  4. Cheswick W.: Rethinking passwords. Commun. ACM 56(2), 40–44 (2013).

  5. Curry D.A.: UNIX System Security: A Guide for Users and System Administrators. Addison-Wesley, Boston (1992).

  6. Desmedt Y.G.: Unconditionally secure authentication schemes and practical and theoretical consequences. In: Advances in Cryptology—CRYPTO’85 Proceedings, LNCS, vol. 218, pp. 42–55. Springer, Berlin (1986).

  7. van Dijk M., Juels A., Oprea A., Rivest R.L.: FlipIt: the game of “stealthy takeover”. J. Cryptol. 26(4), 655–713 (2013).

  8. Florencio D., Herley C.: Where do security policies come from? In: ACM SOUPS (2010).

  9. Florencio D., Herley C., van Oorschot P.C.: An administrator’s guide to internet password research. In: USENIX LISA (2014).

  10. Herley C., van Oorschot P.C.: A research agenda acknowledging the persistence of passwords. IEEE Secur. Priv. 10(1), 28–36 (2012).

  11. Gage Kelley P., et al.: Guess again (and again and again): measuring password strength by simulating password-cracking algorithms. In: IEEE 2012 Symposium on Security and Privacy.

  12. Mazurek M., et al.: Measuring password guessability for an entire university. In: ACM CCS (2013).

  13. Narayanan A., Schmatikov V.: Fast dictionary attacks on passwords using time-space tradeoff. In: ACM CCS (2005).

  14. Quisquater J.-J., Desmedt Y.G.: Chinese lotto as an exhaustive code-breaking machine. IEEE Comput. 24(11), 14–22 (1991).

  15. Schechter S., Herley C., Mitzenmacher M.: Popularity is everything: a new approach to protecting passwords from statistical-guessing attacks. In: USENIX HotSec (2010).

  16. Weir M., Aggarwal S., de Medeiros B., Glodek B.: Password cracking using probabilistic context-free grammars. In: IEEE 2009 Symposium on Security and Privacy.

  17. Weir M., Aggarwal S., Collins M., Stern H.: Testing metrics for password creation policies by attacking large sets of revealed passwords. In: ACM CCS (2010).

  18. Zhang Y., Monrose F., Reiter M.K.: The security of modern password expiration: an algorithmic framework and empirical analysis. In: ACM CCS (2010).

Download references

Acknowledgments

We thank Joseph Bonneau and anonymous referees for insightful comments which have improved this paper. Both authors acknowledge funding from Canada’s NSERC for Canada Research Chair and Discovery Grant funding.

Author information

Authors and Affiliations

  1. School of Computer Science, Carleton University, Ottawa, Canada

    Sonia Chiasson & P. C. van Oorschot

Authors
  1. Sonia Chiasson
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. P. C. van Oorschot
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to P. C. van Oorschot.

Additional information

This is one of several papers published in Designs, Codes and Cryptography comprising the “Special Issue on Cryptography, Codes, Designs and Finite Fields: In Memory of Scott A. Vanstone”.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Chiasson, S., van Oorschot, P.C. Quantifying the security advantage of password expiration policies. Des. Codes Cryptogr. 77, 401–408 (2015). https://doi.org/10.1007/s10623-015-0071-9

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10623-015-0071-9

Keywords

Mathematics Subject Classification

Search

Navigation