Abstract

Given the choice, most users pick poor passwords that are vulnerable to attack. Using random machine generated passwords can ensure that `good' passwords are chosen, but are user-unfriendly. Machine generated passwords which are `pronounceable' represent a potential compromise between security considerations and user friendliness. Several such generators have been designed, perhaps the most prominent being the scheme developed by Morrie Gasser [5] in 1977 and which has being recently adopted as a standard by NIST [3]. The security of such generators is typically characterized by the overall size of the password space, which is typically a fairly large number. This is a fairly good security parameter, if the objective of the attacker is to try and compromise a particular account. On the other hand, if an attacker achieves her objective by compromising any account(s) on the system, then the overall size of the password space, in itself, provides an insufficient characterization of the l...