Usable Human Authentication: A Quantitative Treatment Jeremiah Blocki CMU-CS-14-108 June 30, 2014 School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213 Thesis Committee: Manuel Blum, Co-Chair Anupam Datta, Co-Chair Luis von Ahn Ron Rivest, MIT Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy. Copyright c 2014 Jeremiah Blocki This research was sponsored by the Naval Surface Warfare Center under grant number N00164- 03-DG6623-0009, the National Science Foundation under grant numbers CNS-0831178, CCR- 0122581, DGE-0750271, DGE-1252522, and CCF-0424422, and the Air Force under grant number FA95501210040. The views and conclusions contained in this document are those of the author and should not be interpreted as representing the official policies, either expressed or implied, of any sponsoring institution, the U.S. government or any other entity. Keywords: Human Authentication, Passwords, Password Management Scheme, Usability Model, Security Model, Password Composition Policy, GOTCHA I would like to thank my beautiful wife Heather for her love and support. I would also like to thank my parents for raising me and caring for me over the years. Finally, I would like to thank my Lord and Savior Jesus Christ for creating me, saving me and placing all of the people I mentioned above into my life. iv Abstract A typical computer user today manages passwords for many dif- ferent online accounts. Users struggle with this task — often forgetting their passwords or adopting insecure practices, such as using the same passwords for multiple accounts and selecting weak passwords. While there are many books, articles, papers and even comics about select- ing strong individual passwords, there is very little work on password management schemes — systematic strategies to help users create and remember multiple passwords. Before we can design good password management schemes it is necessary to address a fundamental ques- tion: How can we quantify the usability or security of a password management scheme. One way to quantify the usability of a password management scheme would be to conduct user studies evaluating each user’s success at remembering multiple passwords over an extended period of time. However, these user studies would necessarily be slow and expensive and would need to be repeated for each new password management scheme. Our thesis is that user models and security mod- els can guide the development of password management schemes with analyzable usability and security properties. We present several results in support of this thesis. First, we introduce Naturally Rehearsing Pass- word schemes. Notably, our user model, which is based on research on human memory about spaced rehearsal, allows us to analyze the us- ability of this family of schemes while experimentally validating only the common user model underlying all of them. Second, we introduce Human Computable Password schemes, which leverage human capa- bilities for simple arithmetic operations. We provide constructions that make modest demands on users and we prove that these constructions provide strong security: an adversary who has seen about 100 10-digit passwords of a user cannot compute any other passwords except with very low probability. Our password management schemes are pre- cisely specified and publishable: the security proofs hold even if the adversary knows the scheme and has extensive background knowl- edge about the user (hobbies, birthdate, etc.). They do not require any significant server-side changes. In further support of our thesis, we show that user models and security models can also be used to develop server-side defenses against online and offline attacks. vi Acknowledgments I am indebted to my advisors Manuel Blum and Anupam Datta for all of their guidance and encouragement over the years. I would like to thank Luis Von Ahn and Ron Rivest for serving on my thesis committee and for giving me helpful comments and suggestions about my work. I would like to thank Ariel Procaccia, Saranga Komanduri and Or Sheffet who coauthored the paper Optimizing Pass- word Composition Policies with me. Saranga Komanduri has also collaborated with me to run user studies to empirically test several of the usability models pre- sented in this thesis. Calvin Beideman, a bright high school student, worked with me on the paper Set Families with Low Pairwise Intersection, and Shikun Zhang has been working with me to develop a password management application based on ideas from this thesis. I would also like to thank Santosh Vempala for many helpful discussions about statistical algorithms and random planted satisfiability problems, and Ryan O’Donnell for pointing me to recent general hypercontractiv- ity results. These discussions helped me to obtain the main technical result in my work on Human Computable Passwords. I am thankful to Steven Rudich for running Andrew’s Leap, a summer program at Carnegie Mellon University for high school students interested in computer science, and for his continued interest in my research. The Andrew’s Leap program helped me to decide to study computer science as an undergraduate at CMU. I am thankful to Lenore Blum for helping me find a summer Research Experience for Undergraduates program while I was a sophomore at CMU, and I am thankful to Ryan Williams and Manuel Blum for advising me during the summer. My experience during the summer REU convinced me to pursue a PhD in computer science. vii Some passages have been quoted verbatim from the following sources: Optimizing Password Composition Policies [34, 35] by Jeremiah Blocki, Saranga Komanduri, Ariel Procaccia and Or Sheffet. GOTCHA Password Hackers! [31, 32] by Jeremiah Blocki, Manuel Blum and Anupam Datta. Naturally Rehearsing Passwords [30, 33] by Jeremiah Blocki, Manuel Blum and Anupam Datta. Human Computable Passwords [36] by Jeremiah Blocki, Manuel Blum and Anupam Datta. Set Families with Low Pairwise Intersection[25] by Calvin Beideman and Jeremiah Blocki. The material from Chapter 4 is based on ongoing research with Anupam Datta, Saranga Koman- duri and Lorrie Cranor. viii Contents 1 Overview 1 1.1 Introduction . .1 1.2 Statement of Thesis . .4 1.2.1 User Models . .4 1.2.2 Quantitative Security Model . .8 1.2.3 Developing Human Authentication Schemes with Analyz- able Security and Usability Properties . .8 1.3 Usable and Secure Password Management . 11 1.3.1 Overview . 12 1.4 Human Computable Passwords . 16 1.4.1 Overview . 17 1.5 Empirical Validation of User Model . 22 1.6 A Defense against Online Attacks . 23 1.6.1 Overview . 23 1.7 A Defense Against Offline Attacks . 25 1.7.1 Background . 25 1.7.2 GOTCHAs . 26 1.7.3 Overview . 26 2 Naturally Rehearsing Passwords 29 2.1 Introduction . 29 ix 2.2 Related Work. 32 2.3 Definitions . 35 2.3.1 Associative Memory and Cue-Association Pairs . 35 2.3.2 Visitation Schedules and Rehearsal Requirements . 36 2.3.3 Password Management Scheme . 37 2.4 Usability Model . 38 2.4.1 Rehearsal Requirements . 39 2.4.2 Visitation Schedules. 40 2.5 Security Model . 42 2.6 Our Construction . 45 2.6.1 Constructing n; `; γ -sharing set families . 46 2.6.2 Shared Cues . 48 2.6.3 Usability and Security Analysis . 49 2.7 Discussion and Future Work . 51 3 Human Computable Passwords 53 3.1 Introduction . 53 3.2 Related Work . 57 3.3 Definitions . 59 3.3.1 Notation . 59 3.3.2 Requirements for a Human Computable Function . 61 3.3.3 Password Unforgeability . 62 3.3.4 Security Parameters of f ..................... 63 3.4 Statistical Adversaries and Lower Bounds . 64 3.4.1 Statistical Algorithms . 64 3.4.2 Statistical Dimension Lower Bounds . 66 3.5 Security Analysis . 68 3.5.1 Breaking UF-RCA is Equivalent to Secret Recovery . 68 3.5.2 Gaussian Elimination . 71 x 3.6 Candidate Secure Human Computable Functions . 72 3.6.1 Candidate Scheme 1 . 74 3.6.2 Candidate Scheme 2 . 75 3.6.3 Usability: . 75 3.6.4 Statistical Algorithms: Security Upper Bound . 78 3.7 Discussion . 79 3.7.1 Human Computable Passwords Challenge . 79 3.7.2 Security Under Continuous Leakage . 80 3.7.3 Open Questions . 80 4 Empirical Validation of User Model 83 4.1 Introduction . 83 4.2 Related Work . 85 4.3 Study Design . 87 4.3.1 Recruitment Text . 88 4.3.2 Memorization Phase . 88 4.3.3 Rehearsal Phase . 93 4.3.4 Follow Up Survey . 94 4.3.5 Rehearsal Schedules . 95 4.3.6 List of People, Actions and Objects from the User Study . 96 4.4 Preliminary Results . 97 4.4.1 Discussion . 103 5 Password Composition Policies: A Defense Against Online Attacks 105 5.1 Introduction . 105 5.1.1 Our Model . 106 5.1.2 Our Results . 108 5.1.3 Related Work . 110 5.2 A Model of Password Composition Policies . 111 xi 5.3 Ranking Model: Complexity Results . 113 5.3.1 Positive Rules: Efficient Algorithm for Constant k ...... 114 5.3.2 Special Case k = 1......................... 115 5.3.3 The General Case . 116 5.3.4 Singleton Rules: Hardness for Large k ............. 118 5.3.5 Negative Rules: Hardness of Approximation for k = 1 . 120 5.4 Normalization Model: Complexity Results . 123 5.4.1 Singleton Rules: Efficient Algorithm for large k ........ 123 5.4.2 Negative Rules: Hardness for k = 1 .............. 124 5.4.3 Positive Rules: Hardness of Approximation for Large k ... 126 5.5 Efficient Sampling Algorithms . 126 5.6 Experiments . 128 5.6.1 Experiment Rules . 129 5.6.2 Baselines . 130 5.6.3 Performance . 130 5.7 Discussion . 131 6 GOTCHAs: A Defense Against Offline Attacks 135 6.1 Introduction . 135 6.1.1 Related Work .