2 Related Work
There is a fair amount of literature related to the textual
password equivalent of this work. Many password cracking
dictionaries and tools are available on the Internet such as Crack [17]
and John the Ripper [18]. Understanding these tools and the
dictionaries they use is important to perform effective proactive password checking. Yan [28]
discusses some popular proactive password checkers such as cracklib.
Pinkas et al. [23] discuss human-in-the-loop methods to prevent online
dictionary attacks; see also Stubblebine et al. [24]. One defense against offline dictionary
attacks is to reduce the probability of cracking through enforcing password policies
and proactive password checking.
In the open literature to date, there have been surprisingly few graphical
password schemes proposed. One using
hash visualization [22] was implemented in
a program called Déjà Vu [6],
based on psychological findings that people
recognize pictures better than recalling them.
Generally, in this scheme a user has a portfolio of pictures of
cardinality F that they must be able to distinguish within a
group of presented pictures of cardinality T.
Birget et al. [2] recently proposed another scheme employing
exactly repeatable passwords, which requires a user to click on several
points on a background picture.
The DAS scheme ([11]; see §4.1)
uses user-defined drawings as graphical passwords.
The main difference from graphical pattern recognition is that
DAS passwords must be exactly repeatable (as defined within DAS).
Exact repetition allows for the password to be stored as the output of a one-way function, or used to
generate cryptographic keys. Given reasonable-length passwords in a 5 × 5 grid,
the full password space of DAS was shown to be larger
than that of the full textual password space.
In our analysis (see §4), we assume DAS as the underlying scheme for encoding graphical passwords,
thus we do not consider passwords that are disallowed within DAS.
Regarding memorability issues for graphical passwords,
Davis et al. [5] examine user choice in graphical password schemes.
Particular to the DAS scheme, Jermyn et al. [11] argue that the DAS scheme has a large memorable
password space by modeling user choice. They examine the size
of the password space for combinations of one or two rectangles, and
show that this is comparable to the size of many textual password dictionaries.2
A second approach to characterize memorable passwords was based on
the existence of a short program to describe the password,
under the assumption that all passwords that can be
described by a short program are also memorable (rather than on
findings from psychology or user studies).
A separate user study on memorability performed by Goldberg et al. [8] showed that people are
less likely to recall the order in which they drew a DAS password
than the resulting image.
Jermyn et al. [11] suggest that the security of graphical password
schemes benefit from the current lack of knowledge of their probability distribution;
this motivates our present work.