IAENG International Journal of Computer Science, 48:1, IJCS_48_1_16 ______________________________________________________________________________________ Secure Password Storing Using Prime Decomposition Chaovalit Somboonpattanakit and Nawaporn Wisitpongphan Abstract—Nowadays, passwords are widely used for authenti- Key Stretching [7] is an adjustable hash function used for cation and they are the main targets of many hackers. Over the enhancing the security of the password stored in the database. past few years, there were several unfortunate major password The Key Stretching relies on high computing power and large leak incidents. Billions of passwords were exposed to public due to unsecured password storing methods. To further exacerbate memory usage during the hashing process, thus, cracking the situation, many users prefer to use the same password on or reversing is infeasible. Although Key Stretching is the multiple websites or services. Hence, a password leak from one best mechanism for storing passwords, the principle of this source will likely cause damage to users’ data in many other method is still the same as a normal hash method with some systems. In this study, we proposed a secure method for storing additional salt in the plain text format. passwords by incorporating prime decomposition technique. The novel Prime Decomposition Password Storing (PDPS) tech- Storing hashed or salted hashed passwords may no longer nique does not store original or encrypted password, but allows be secure, hence, we propose another way to securely store the same password to be converted differently on different passwords. We claim that the proposed method will be safe systems without adding extra information. We claimed that the even in the event of password leak. proposed PDPS can protect the confidentiality of the password in the event of password database leaked. II. BACKGROUND Index Terms—password, password storing, prime decompo- sition, secure, authentication. According to NIST disclaimer statement [8], most users reuse the same password on multiple systems when forcing them to use a complex password. In addition, if a user I. INTRODUCTION has selected a good password, the system should not force ASSWORD is apparently the most popular authenti- the users to change the password often because users may P cation method for modern applications. During system simply create a new password that is similar to the old one, registration, users have to create a password that is easy to e.g., adding a certain numeric or alphabet pattern at the end remember. Most systems force users to create a complex of the old password. Therefore, when the passwords got password, which is composed of numbers, alphabets, and leaked to the public, the attacker can use those passwords sometimes special characters, to prevent conventional pass- to attack other systems. Therefore, forcing users to come word attacking methods. However, users’ ability to remember up with a complex password does not always imply that deteriorates as the rules for creating passwords get more the users’ password will be secured. To get around this complicated. As a result, many users tend to reuse the same problem, we proposed a novel technique for securing the password on different systems. Therefore, besides forcing stored passwords. The main idea is to allow users to select the users to create a strong password, service providers have any password they want without imposing strict set of rules to also ensure that they provide a secure password storing or requirements. Users can use any password that is easy for system that can protect users’ information in the event of them to remember. password database leak. There many research studies that focused on enhancing A. Authentication mechanisms password storing security. The most popular technique is the use of hash functions [1], [2] or Key Stretching [3], [4]. Authentication is a mechanism that is used to identify a Example of these techniques are MD5, SHA3, SCRYPT, person by using a certain set of data. Typically, users have to ARGON2, etc. provide various personal information to identify themselves However, using a pure hash function without additional on different systems for security purpose. The set of data protection mechanism such as “salt” for storing passwords that is commonly used to identify a user can come from makes this approach vulnerable to time-memory tradeoff these factors [9]: password attack [5] using a pre-computed table, which is 1) Something you know: password, pin readily available on the Internet [6]. Therefore, adding salt 2) Something you have: smart card, hardware token will only make hacking more time and resource consuming, 3) Something you are: fingerprint, iris scan but cracking the salted hashed passwords is still plausible. 4) Somebody who knows you: human relations Authentication mechanisms can include one, two, or multiple Manuscript received May 29, 2020; revised January 14, 2021. factors. Using more than one factor helps increase the secu- C. Somboonpattanakit is a PhD candidate of King Mongkut’s Univer- sity of Technology North Bangkok, Bangkok, Thailand. He is now with rity level during the validation process but also add burden Department of Information Technology, Rajamangala University, Bangkok, to users because it requires extra steps or additional devices, Thailand. (email: [email protected]) e.g., using both the password and the finger scan [10] or re- N. Wisitpongphan is a Assistant Professor of Data Communication and Networking Department, King Mongkut’s University of Technology North questing the users to input the OTP (One-time password) sent Bangkok, Bangkok, Thailand. (e-mail: [email protected]) to them via SMS and validate within a specified time [11]. Volume 48, Issue 1: March 2021 IAENG International Journal of Computer Science, 48:1, IJCS_48_1_16 ______________________________________________________________________________________ B. Password Storing Techniques D. Related Work Usually systems or application developers have various One of the most popular methods for protecting the pass- ways to protect the stored passwords [12]: words is to use hash functions such as MD5 or SHA3 [22]. 1) Plain text password: This is the most unsecured However, these methods are prone to Time-Memory Trade- method for storing passwords because the password is stored Offs attack because of their fast hashing speed. Therefore, as is without any encryption. Hence, attackers who get access the traditional one-way hash function is not the best way to to the password database can readily use the leaked password keep passwords secured, although in general it is still widely to exploit other systems. In 2016, roughly 100 million plain used. As a result, key stretching techniques are becoming text passwords from the large social media website (vk.com) more popular. was exposed to public [13]. The lesson learned from such Unlike traditional hash functions, key stretching runs at an event is that users should come up with unique password a very slow speed and consumes significant amount of for each website. computer resources [3], especially the processing power, in 2) Encrypted password: The password is encrypted with order to prevent an attacker from using a precomputed table. a certain algorithm such as AES, DES or 3DES prior to However, as the processing speed of the GPU or FPGA storing [14], [15]. The key for encrypting the password is hardware increases, the key stretching technique, which relies also stored in the same database because it will be used again solely on the use of processing power, is no longer safe. in the validation process. This method can keep the password secured by making the password unreadable. This, by far, is According to the aforementioned problem, there are sev- the most popular method because of its low complexity and eral studies that resorted to other techniques for securing a slightly higher security level than that of the plain text the password. Colin Percival [4] proposed memory-hard method. However, in the event of database leak, there is a (SCRYPT) algorithm that uses significant amount of memory possibility that the attackers can also obtain the key from the instead of extra processing power to prevent GPU or FPGA same database. attack. This technique is more appealing because the memory 3) Hashed password: This method works by applying a space is typically limited and the advancement in hard drive one-way hash function such as MD5 or SHA3 to a password development is usually slower than that of the processor. and stores the hash results in the database instead of storing However, SCRYPT still has flexibility and complexity prob- the original passwords. When the attackers gain access to the lems, thus, not practical for deploying in a real system. database, they will see only hash values and will have to put Despite these problems, this concept has become a model extra effort to obtain the original passwords. However, this for many ideas later. method is still vulnerable to the rainbow table attack [16]. To overcome the challenge faced by memory consumption- 4) Salted hash password: This method will add a random based approach, LYRA2 algorithm [23] uses cryptographic string to the password before hashing. The goal of adding salt sponge function, which allows flexibility in configuring the to the password [17] is to create a different hashed value of size of the input and output independently. By exploiting the the same password, thereby preventing Time-Memory Trade- properties of a sponge, i.e., absorbing and squeezing, the user Offs attack [18]. However, because the salt must be stored can adjust the parameters to suit any working environment. in the plain text format in the database, attackers who know Among the techniques described in this section, the pass- the salt and the hashed value can still use this information word hash function together with a key stretching is the most to crack the password. secured technique for storing the passwords.