Passwords have been the dominant method of authentication for more than 50 years, a trend that looks set to continue for a long time to come. They are a key part of the security of individuals, systems and critical data, but often represent the weakest point of entry into digital systems. Passwords often reflect the personal characteristics and preferences of their creators, allowing malicious actors to exploit them using available contextual information about the password creator. Recent research has shown that tailored password lists, created on the basis of this contextual information, can significantly improve the effectiveness of password cracking methods.
In this master thesis, we present the optimization of a password cracking method using contextual information. We apply an innovative methodology to construct a contextual dictionary of password rankings in order to increase the probability of early success in password cracking. We make use of large-scale language models in this process in order to optimize password generation using contextual dictionaries. We present the CtxPassGPT model, which is based on the auto-regressive GPT-2 model and uses contextual words to generate passwords. Our hypothesis was that the use of domain-specific contextual information in conjunction with artificial intelligence can improve the performance of attacks.
Experimental results showed that the ctxPassGPT method, especially when combined with the Ignis-10M password set, is very effective in guessing passwords, especially those with higher strength scores. This paper highlights the potential of combining language models and contextual information in improving the performance of dictionary attacks, which has important implications for password security and the development of new methods in this field.
|
