More Like this

1. Incremental Offline/Online PIR

   Ma, Yiping; Zhong, Ke; Rabin, Tal; Angel, Sebastian (August 2022, USENIX Security Symposium)

   Recent private information retrieval (PIR) schemes preprocess the database with a query-independent offline phase in order to achieve sublinear computation during a query-specific online phase. These offline/online protocols expand the set of applications that can profitably use PIR, but they make a critical assumption: that the database is immutable. In the presence of changes such as additions, deletions, or updates, existing schemes must preprocess the database from scratch, wasting prior effort. To address this, we introduce incremental preprocessing for offline/online PIR schemes, allowing the original preprocessing to continue to be used after database changes, while incurring an update cost proportional to the number of changes rather than the size of the database. We adapt two offline/online PIR schemes to use incremental preprocessing and show how it significantly improves the throughput and reduces the latency of applications where the database changes over time 

   more » « less
2. On the Economics of Offline Password Cracking

   https://doi.org/10.1109/SP.2018.00009  

   Blocki, Jeremiah; Harsha, Benjamin; Zhou, Samson (May 2018, 2018 IEEE Symposium on Security and Privacy (SP) (2018))

   We develop an economic model of an offline password cracker which allows us to make quantitative predictions about the fraction of accounts that a rational password attacker would crack in the event of an authentication server breach. We apply our economic model to analyze recent massive password breaches at Yahoo!, Dropbox, LastPass and AshleyMadison. All four organizations were using key-stretching to protect user passwords. In fact, LastPass' use of PBKDF2-SHA256 with $10^5$$ hash iterations exceeds 2017 NIST minimum recommendation by an order of magnitude. Nevertheless, our analysis paints a bleak picture: the adopted key-stretching levels provide insufficient protection for user passwords. In particular, we present strong evidence that most user passwords follow a Zipf's law distribution, and characterize the behavior of a rational attacker when user passwords are selected from a Zipf's law distribution. We show that there is a finite threshold which depends on the Zipf's law parameters that characterizes the behavior of a rational attacker --- if the value of a cracked password (normalized by the cost of computing the password hash function) exceeds this threshold then the adversary's optimal strategy is {\em always} to continue attacking until each user password has been cracked. In all cases (Yahoo!, Dropbox, LastPass and AshleyMadison) we find that the value of a cracked password almost certainly exceeds this threshold meaning that a rational attacker would crack all passwords that are selected from the Zipf's law distribution (i.e., most user passwords). This prediction holds even if we incorporate an aggressive model of diminishing returns for the attacker (e.g., the total value of $$500$ million cracked passwords is less than $100$ times the total value of $$5$$ million passwords). On a positive note our analysis demonstrates that memory hard functions (MHFs) such as SCRYPT or Argon2i can significantly reduce the damage of an offline attack. In particular, we find that because MHFs substantially increase guessing costs a rational attacker will give up well before he cracks most user passwords and this prediction holds even if the attacker does not encounter diminishing returns for additional cracked passwords. Based on our analysis we advocate that password hashing standards should be updated to require the use of memory hard functions for password hashing and disallow the use of non-memory hard functions such as BCRYPT or PBKDF2. 

   more » « less
3. Offline Evaluation Matters: Investigation of the Influence of Offline Performance on Real-Time Operation of Electromyography-Based Neural-Machine Interfaces

   https://doi.org/10.1109/TNSRE.2022.3226229  

   Hinson, Robert M.; Berman, Joseph; Filer, William; Kamper, Derek; Hu, Xiaogang; Huang, He (January 2023, IEEE Transactions on Neural Systems and Rehabilitation Engineering)
4. Conservative Offline Distributional Reinforcement Learning

   Jason Ma, Yecheng; Jayaraman, Dinesh; Bastani, Osbert (January 2022, Advances in neural information processing systems)
5. Corruption-robust offline reinforcement learning

   Zhang, Xuezhou; Chen, Yiding; Zhu, Xiaojin; Sun, Wen (January 2022, The 25th International Conference on Artificial Intelligence and Statistics)