Authors:
Francisco Izquierdo Riera
1
;
Magnus Almgren
1
;
Pablo Picazo-Sanchez
2
and
Christian Rohner
3
Affiliations:
1
Chalmers University of Technology, 412 96 Göteborg, Sweden
;
2
School of Information Technology, Halmstad University, Sweden
;
3
Uppsala University, Box 534, 751 21 Uppsala, Sweden
Keyword(s):
Password Stretching, Password-based Authentication, IoT Security, Server Relief, Web Security, Argon2.
Abstract:
Password security relies heavily on the choice of password by the user but also on the one-way hash functions used to protect stored passwords. To compensate for the increased computing power of attackers, modern password hash functions like Argon2, have been made more complex in terms of computational power and memory requirements. Nowadays, the computation of such hash functions is performed usually by the server (or authenticator) instead of the client. Therefore, constrained Internet of Things devices cannot use such functions when authenticating users. Additionally, the load of computing such functions may expose servers to denial of service attacks. In this work, we discuss client-side hashing as an alternative. We propose Clipaha, a client-side hashing scheme that allows using high-security password hashing even on highly constrained server devices. Clipaha is robust to a broader range of attacks compared to previous work and covers important and complex usage scenarios. Our e
valuation discusses critical aspects involved in client-side hashing. We also provide an implementation of Clipaha in the form of a web library 1 and benchmark the library on different systems to understand its mixed JavaScript and WebAssembly approach’s limitations. Benchmarks show that our library is 50% faster than similar libraries and can run on some devices where previous work fails.
(More)