Utilization of a protected module to prevent offline dictionary attacks

摘要

Various technologies pertaining to authenticating a password in a manner that prevents offline dictionary attacks are described. A protected module, which can be a hardware security module, a trusted platform module, or the like, is in communication with an authentication server. The protected module comprises a key that is restricted to the protected module. The key is employed in connection with authenticating the password on the protected module.

主权项

1. A method executed by a computer processor in a protected hardware module, the method comprising:
executing a hash function over a string to generate a first hash value, wherein the string comprises:
first data that is indicative of a purported password for a user account; anda key, the key unable to be removed from the protected hardware module; comparing the first hash value with a second hash value, the second hash value previously generated by the protected hardware module, the protected hardware module previously generated the second hash value by executing the hash function over a second string, the second string comprises:
second data that is indicative of a proper password for the user account; andthe key; when the protected hardware module determines that the first hash value is equivalent to the second hash value, outputting a signal that indicates that the purported password matches the proper password.