SweetPAKE: Key exchange with decoy passwords

ePrint Report: SweetPAKE: Key exchange with decoy passwords

Afonso Arriaga, Peter Y.A. Ryan, Marjan Skrobot

Decoy accounts are often used as an indicator of the compromise of sensitive data, such as password files. An attacker targeting only specific known-to-be-real accounts might, however, remain undetected. A more effective method proposed by Juels and Rivest at CCS'13 is to maintain additional fake passwords associated with each account. An attacker who gains access to the password file is unable to tell apart real …

accounts attacker compromise data decoy eprint report exchange files key password passwords peter real report sensitive sensitive data targeting undetected