Understanding Offline Password-Cracking Methods: A Large-Scale Empirical Study

Figure 6

Further evaluation of cracking under limited-knowledge II. Each value in this figure represents the fraction of each length or structure type of passwords in the cracked dataset accounts for the corresponding subset of passwords in the targeting dataset in this scenario (e.g., in [1], 0.89 indicates that 89 percent passwords with length of 6 in the CSDN targeting dataset can be cracked by the Rockyou-trained Best64 method). (a) Trained on Rockyou and tested on CSDN-length based evaluation. (b) Trained on Rockyou and tested on 178-length based evaluation. (c) Trained on Rockyou and tested on Phpbb-length based evaluation. (d) Trained on CSDN and tested on Rockyou-length based evaluation. (e) Trained on CSDN and tested on 178-length based evaluation. (f) Trained on CSDN and tested on Phpbb-length based evaluation. (g) Trained on Rockyou and tested on CSDN-structure based evaluation. (h) Trained on Rockyou and tested on 178-structure based evaluation. (i) Trained on Rockyou and Tested on Phpbb-structure based evaluation. (j) Trained on CSDN and tested on Rockyou-structure based evaluation. (k) Trained on CSDN and tested on 178-structure based evaluation. (l) Trained on CSDN and tested on Phpbb-structure based evaluation.

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

(k)

(l)