New Technique Makes Passwords 14M Percent Harder to Crack, Nonprofit Claims

One method that cryptographers often use to protect a secret is to split it up into multiple smaller pieces and allocate the individual portions for safekeeping to various different parties. It's only when a certain minimum number of those parties bring their portions together that the secret can be reconstructed in its entirety.

Now researchers at Tide — a nonprofit based in Sydney, Australia — have developed a similar approach to protecting usernames and passwords that they claim is some 14 million percent more difficult to hack than current mechanisms.

Tide's method, called "splintering," involves taking encrypted passwords within an authentication system, breaking them up into multiple tiny pieces, and storing the pieces on a decentralized distributed network from which they can be reassembled as needed.

Tide's Delegated Automated Trustee node technology makes it almost infinitely harder for attackers to reconstruct passwords using brute-force password guessing attacks, through reverse engineering and other techniques, according to the nonprofit.

In tests conducted using 60 million LinkedIn passwords that previously had been breached, Tide engineers discovered that splintering passwords reduced the odds of a dictionary attack succeeding from 100% to 0.00072%, an improvement over some 14.1 million percent, Tide claimed Thursday. The nonprofit has launched a campaign through which it is offering a reward to hackers who are able to break even a single username and password. So far, in 6.5 million attempts, not one hacker has been able to crack a single password, according to Tide.

Tide has implemented the new splintering technique in Tide Protocol, a collection of open source technologies it has developed to help organizations protect data better.

Yuval Hertzog, co-founder of Tide, says that within the Tide Protocol, encrypted passwords are splintered and stored over between 20 and 26 nodes on Tide's public blockchain. Each node — or Orchestrated Recluder of Keys, in the Tide Protocol — is tasked with processing the splinter assigned to it and to have the splinter assembled when requested. Only the node assigned to a splinter can decrypt it.

Configurable Security
Hertzog says the number of splinters that each encrypted password is broken up into is determined by the desired cryptographic strength and redundancy requirements of the organization. The minimum number is 20 nodes. "These parameters are configurable, allowing for customizable security and redundancy based on individual needs," he says.

The Tide scheme has been built in such a way that a splintered password can be fully recovered even if one or more of the nodes storing the splinters were to become unavailable for some reason. In fact, the model allows for up to 30% redundancy, meaning that a splintered password can be fully reassembled for authentication even if up to six nodes were to become unavailable, Hertzog says.

How scalable is the splintering approach when it comes to managing millions of passwords? Hertzog says the underlying architecture is based on an improved version of blockchain technology that already has been proven to support millions of users. "The specific implementation under the Tide Protocol has been load-tested to scale to several millions in a controlled environment," he says.

Tide engineers have introduced an intentional built-in 300 millisecond delay for each authentication request to mitigate brute-force and denial-of-service attacks on the network. But even with that, the latencies associated with splintering and reassembling passwords is on par with or even slightly better than existing commonly used authentication provider, Hertzog claims.

In public tests, end-to-end latency results showed the entire splinter-based authentication process to take between 1,500 milliseconds to 4,000 milliseconds with a full complement of nodes across Microsoft Azure, Google, and Amazon networks, he notes. "The splintering technology can be easily used in an almost identical manner to any of the existing OAuth2 authentication schemes and be integrated into any existing organization."

Tide's splintering approach is not available commercially yet. But organizations that want to kick the tires can find code and documentation for the technology on GitHub, where it is available under a special Tide Open Source License.

Tide describes itself as focused on protecting consumer data. Its members include cryptographers, tech entrepreneurs, economists, and media agency heads.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Meet FPGA: The Tiny, Powerful, Hackable Bit of Silicon at the Heart of IoT."