Source-linked AI summary
PassGAN: A Deep Learning Approach for Password Guessing
Briland Hitaj, Paolo Gasti, Giuseppe Ateniese, Fernando Perez-Cruz
TL;DR
Password guessing rules are effective but laborious to design and limited to manually anticipated password structures. PassGAN uses a GAN to learn password distributions from leaked data without a priori password knowledge, achieving competitive or superior guessing results and adding 51%-73% more unique guesses when combined with HashCat. Its main practical limitation is that matching rule-based performance requires a larger output volume.
Problem
Existing password-guessing heuristics require specialized expertise and are limited to manually specified password structures.
Method
PassGAN trains a Generative Adversarial Network on leaked passwords to autonomously learn their distribution and generate password guesses.
Results
PassGAN matched the performance of other state-of-the-art password-generation tools and generated 51%-73% additional unique guesses when combined with HashCat.
Takeaways & Limitations
PassGAN can complement rule-based guessing by generating passwords that existing rules do not cover, without manual password analysis or domain knowledge.
Takeaways & Limitations
PassGAN requires substantially more generated passwords than rule-based tools to achieve the same result, creating an output-size cost.
Abstract
from arXiv · showhide
State-of-the-art password guessing tools, such as HashCat and John the Ripper, enable users to check billions of passwords per second against password hashes. In addition to performing straightforward dictionary attacks, these tools can expand password dictionaries using password generation rules, such as concatenation of words (e.g., "password123456") and leet speak (e.g., "password" becomes "p4s5w0rd"). Although these rules work well in practice, expanding them to model further passwords is a laborious task that requires specialized expertise. To address this issue, in this paper we introduce PassGAN, a novel approach that replaces human-generated password rules with theory-grounded machine learning algorithms. Instead of relying on manual password analysis, PassGAN uses a Generative Adversarial Network (GAN) to autonomously learn the distribution of real passwords from actual password leaks, and to generate high-quality password guesses. Our experiments show that this approach is very promising. When we evaluated PassGAN on two large password datasets, we were able to surpass rule-based and state-of-the-art machine learning password guessing tools. However, in contrast with the other tools, PassGAN achieved this result without any a-priori knowledge on passwords or common password structures. Additionally, when we combined the output of PassGAN with the output of HashCat, we were able to match 51%-73% more passwords than with HashCat alone. This is remarkable, because it shows that PassGAN can autonomously extract a considerable number of password properties that current state-of-the art rules do not encode.
1 INTRODUCTION
Password guessing tools rely on manually designed heuristics that are effective but laborious and limited in coverage. PassGAN replaces these rules with a GAN that learns password distributions from leaked data and generates competitive guesses without a priori password knowledge.
- Password leaks show that users commonly choose easy-to-guess passwords composed of frequent strings and variants.
- Existing tools combine dictionaries, leaked passwords, transformation heuristics, and Markov models to generate candidate guesses.Examples include word concatenation, mixed letter case, and leet speak.
- Manual rules are ad hoc, capture only intuition-defined subsets of the password space, and require specialized expertise to develop and test.These constraints limit the scalability of rule development.
- PassGAN uses a GAN trained on leaked passwords to autonomously learn password characteristics and generate samples following the learned distribution.The generator produces guesses while the discriminator distinguishes leaked passwords from generated samples.
- PassGAN was competitive with state-of-the-art tools and eventually guessed more passwords, but required substantially more output than rule-based approaches.The paper frames this as a tradeoff between expressiveness and output size.
- 51%-73% additional unique passwords were guessed when PassGAN output was combined with HashCat, compared with HashCat alone.PassGAN matched passwords not generated by existing password rules.
2 BACKGROUND AND RELATED WORK
GANs recast password generation as learning the distribution of training passwords through adversarial discrimination between real and generated samples. PassGAN builds on this framework to avoid assumptions about Markovian password structure.
- Generative Adversarial Networks: GANs generate samples from the same distribution as their training set by turning density estimation into binary classification.A discriminator distinguishes true samples from generator-produced fake samples, guiding generator learning.
- Generative Adversarial Networks: The discriminator distinguishes true samples from fake samples, while the generator seeks to mimic the underlying password distribution.The paper formalizes this as a clash between discriminator and generator objectives.
- Generative Adversarial Networks: PassGAN relies on IWGAN as a foundation because IWGAN is described as a stable approach for text generation via GANs.The paper uses IWGAN as the building foundation for its password-generation approach.
- Password Guessing: Password guessing attacks repeatedly test candidate passwords, with JTR and HashCat supporting brute force, dictionaries, rules, and Markov-model-based strategies.Rule-based attacks transform dictionary words into password guesses, and both tools are described as notably effective.
- Related Work: Prior work extended password guessing from manually defined Markov rules to PCFGs that learn rules from password distributions and recurrent neural networks for password strength estimation.The cited neural-network methods primarily target password strength estimation rather than password guessing.
- PassGAN: PassGAN is presented as avoiding a priori knowledge or assumptions about the Markovian structure of user-chosen passwords.This distinguishes its approach from methods relying on predefined or assumed password structures.
3 EXPERIMENT SETUP
The experiments instantiate PassGAN with IWGAN components and compare it with established password-generation methods using RockYou training data and RockYou and LinkedIn tests. The setup evaluates both same-distribution prediction and cross-dataset generalization.
- Model Configuration: PassGAN uses IWGAN with ADAM optimization and five residual blocks in both the generator and discriminator.Each residual block contains two one-dimensional convolutional layers connected by ReLU activations; the block output adds 0.3 times the convolutional output to the identity input.
- Hyperparameters: The model uses batch size 64, 199,000 training iterations, 10 discriminator iterations per generator iteration, and 128 dimensions per convolutional layer.Further iterations produced diminishing returns in the number of matches.
- Hyperparameters: The generator receives inputs of 128 floating-point numbers, while the GAN loads the entire training dataset as its maximum number of examples.The setup also specifies ADAM parameters including β1=0.5, β2=0.9, and learning rate 10^-4.
- Training and Testing: The evaluation trains GAN, JTR, HashCat, Markov, PCFG, and FLA methods on passwords from the RockYou leak.The comparison targets state-of-the-art password-generation rules and related machine-learning approaches.
- Datasets: RockYou contains 32,503,388 passwords; the study selected 29,599,680 passwords of length 10 characters or less and trained on 80% of them.The training portion contained 23,679,744 passwords, including 9,926,278 unique passwords.
- Datasets: The LinkedIn test set contains 43,354,871 unique passwords of length 10 characters or less that were not in the RockYou training dataset.Frequency counts were unavailable for LinkedIn, and the dataset was used to assess cross-dataset performance.
- Training and Testing: The procedures measure same-distribution performance on a distinct RockYou subset and generalization from RockYou training data to LinkedIn testing data.Testing excludes passwords present in the training set when evaluating generation of new passwords.
- Baseline Generation: HashCat Best64 generated 754,315,842 passwords, including 361,728,683 unique passwords of length 10 characters or less.For HashCat gen2 and JTR SpiderLab, the study uniformly sampled 10^9 outputs from their generated password sets.
4 EVALUATION
The evaluation measures PassGAN’s output space, training tradeoffs, and password-matching performance against rule-based and machine-learning tools across RockYou and LinkedIn datasets. It also examines complementary coverage with HashCat and differences from FLA in generated-password distributions.
- Evaluation design: PassGAN’s evaluation compares its password matches with FLA, Markov models, PCFGs, JTR rules, and HashCat rules.The study also evaluates PassGAN combined with HashCat and compares probability densities and password distributions with FLA.
- PassGAN’s Output Space: Increasing PassGAN’s generated-password count increases unique passwords and matches, although both growth rates diminish slightly at larger sample sizes.The authors attribute this pattern to simpler passwords being matched earlier while more complex passwords require substantially more attempts.
- PassGAN’s Output Space: Further training likely increases overfitting risk: matches rose with iterations but tapered around 125,000-135,000 and 190,000-195,000 iterations.Training stopped around 190,000-195,000 iterations, which the authors considered adequate for the RockYou training set.
- Evaluating the Passwords Generated by PassGAN: Across both RockYou and LinkedIn, PassGAN generated at least as many matches as each comparison tool using a password count within one order of magnitude.The comparison used PassGAN’s generated passwords against outputs from the evaluated tools, including passwords of length 10 characters or less.
- Evaluating the Passwords Generated by PassGAN: PassGAN matched more passwords than HashCat within fewer attempts on LinkedIn: 2.1 · 10^9–3.6 · 10^9 versus 4.8 · 10^9–5.06 · 10^9 for RockYou.This result concerns performance when guessing passwords from a dataset different from the one used for training.
- Combining PassGAN with HashCat: With 7 · 10^9 PassGAN passwords, the combined approach matched 51% of the new RockYou set and 73% additional passwords from the new LinkedIn set.These corresponded to 320,365 RockYou passwords and 5,262,427 additional LinkedIn passwords after HashCat Best64 matches were removed.
5 REMARKS
PassGAN learns password distributions from leaked data and generates guesses without manually specified password rules. Experiments show strong generalization, complementary coverage to rule-based tools, and practical trade-offs in efficiency and coordination.
- Generalization and matching: 34.2% of passwords in a RockYou test set and 21.9% in LinkedIn were matched when PassGAN trained on RockYou data.The test passwords were not observed during training, and no additional information about the test-only passwords was used.
- Comparison with rules: PassGAN eventually surpassed password-generation rules, although rule-based systems were more efficient when the allowed number of guesses was small.Rule-based systems generate a finite, relatively small password set, limiting their eventual coverage.
- Combining tools: 48% of RockYou test passwords and 30.6% of LinkedIn passwords were matched by combining PassGAN with Best64 rules.These corresponded to increases of 50.8% and about 73.3% in matches, respectively.
- Model expressiveness: PassGAN matched FLA within an order of magnitude of guesses without password-rule knowledge and generated passwords ranked very unlikely by FLA.This supports GANs as more general models than Markov-based guessing approaches.
- Density estimation: PassGAN’s density estimates match high-frequency training passwords well, but deteriorate as password frequency decreases.More generated passwords can reduce the practical relevance of this deterioration, but may increase the number needed for a target match count.
- Operational considerations: Offline generation can produce billions of guesses in advance, while distributed duplicate handling depends on generation, testing, and synchronization costs.When testing is cheaper than generation, periodic coordination may be beneficial; otherwise, cross-node repetition need not be avoided.
- Future improvement: New leaked password datasets could help PassGAN learn new rules and potentially reduce repeated samples.The paper identifies additional leaked data as a possible avenue for improvement.
6 CONCLUSION
The paper introduces PassGAN, a GAN-based password-guessing technique that learns password-distribution information from leaks without explicit rules or Markov assumptions. It performs competitively with existing tools, while requiring more output guesses and leaving several extensions for future work.
- Contribution: PassGAN is introduced as the first password-guessing technique based on generative adversarial networks.It is designed to learn password-distribution information from password leaks.
- Contribution: PassGAN generates passwords without user intervention, domain knowledge about passwords, or manual analysis of password database leaks.This distinguishes it from tools relying on explicit rules or assumptions about password structure.
- Evaluation: PassGAN was competitive with state-of-the-art password-generation tools and generated the same number of matches in the reported experiments.Evaluation tested passwords not used for training and compared output distributions with real password leaks.
- Limitation: PassGAN currently requires outputting more passwords than other tools to reach comparable matching outcomes.The paper suggests larger datasets and more accurate density estimation may reduce this requirement.
- Future work: A conditional GAN might improve guessing when an adversary knows user-specific keywords such as pet or family-member names.Conditioning could focus generation on the search-space region containing those keywords.
- Future work: PassGAN could potentially generate Honeywords, with an extension proposed to reduce their distinguishability from real passwords.The paper leaves this application for future work because distinguishable Honeywords have reduced usefulness.
A CONFIGURATION PARAMETERS FOR RUNNING FLA
This appendix reports the configuration used to run the password-metering and guessing tool introduced in prior work.
- Configuration: The password-metering and guessing tool was run using the parameters listed in Table 6.Table 6 is identified as the training configuration used for FLA.