Clipaha: A Scheme to Perform Password Stretching on the Client

Francisco Izquierdo Riera, Magnus Almgren, Pablo Picazo-Sanchez, Christian Rohner

2023

Abstract

Password security relies heavily on the choice of password by the user but also on the one-way hash functions used to protect stored passwords. To compensate for the increased computing power of attackers, modern password hash functions like Argon2, have been made more complex in terms of computational power and memory requirements. Nowadays, the computation of such hash functions is performed usually by the server (or authenticator) instead of the client. Therefore, constrained Internet of Things devices cannot use such functions when authenticating users. Additionally, the load of computing such functions may expose servers to denial of service attacks. In this work, we discuss client-side hashing as an alternative. We propose Clipaha, a client-side hashing scheme that allows using high-security password hashing even on highly constrained server devices. Clipaha is robust to a broader range of attacks compared to previous work and covers important and complex usage scenarios. Our evaluation discusses critical aspects involved in client-side hashing. We also provide an implementation of Clipaha in the form of a web library 1 and benchmark the library on different systems to understand its mixed JavaScript and WebAssembly approach’s limitations. Benchmarks show that our library is 50% faster than similar libraries and can run on some devices where previous work fails.

Paper Citation

in Harvard Style

Izquierdo Riera F., Almgren M., Picazo-Sanchez P. and Rohner C. (2023). Clipaha: A Scheme to Perform Password Stretching on the Client. In Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-624-8, pages 58-69. DOI: 10.5220/0011653200003405

in Bibtex Style

@conference{icissp23,
author={Francisco Izquierdo Riera and Magnus Almgren and Pablo Picazo-Sanchez and Christian Rohner},
title={Clipaha: A Scheme to Perform Password Stretching on the Client},
booktitle={Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2023},
pages={58-69},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011653200003405},
isbn={978-989-758-624-8},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Clipaha: A Scheme to Perform Password Stretching on the Client
SN - 978-989-758-624-8
AU - Izquierdo Riera F.
AU - Almgren M.
AU - Picazo-Sanchez P.
AU - Rohner C.
PY - 2023
SP - 58
EP - 69
DO - 10.5220/0011653200003405