Towards a Rigorous Statistical Analysis of Empirical Password Datasets. (arXiv:2105.14170v2 [cs.CR] UPDATED)

A central challenge in password security is to characterize the attacker's
guessing curve i.e., what is the probability that the attacker will crack a
random user's password within the first $G$ guesses. A key challenge is that
the guessing curve depends on the attacker's guessing strategy and the
distribution of user passwords both of which are unknown to us. In this work we
aim to follow Kerckhoffs' principle and analyze the performance of an optimal
attacker who knows the password …

analysis datasets password