PassFlow: Guessing Passwords with Generative Flows

TL;DR

PassFlow introduces a flow-based generative model for password guessing, outperforming previous GAN-based methods with smaller training sets and producing human-like password samples.

Contribution

This paper presents PassFlow, a novel flow-based model for password guessing that enables precise likelihood computation and effective latent space exploration.

Findings

PassFlow outperforms state-of-the-art GAN-based approaches.

Requires significantly smaller training datasets.

Generates password samples closely resembling human passwords.

Abstract

Recent advances in generative machine learning models rekindled research interest in the area of password guessing. Data-driven password guessing approaches based on GANs, language models and deep latent variable models have shown impressive generalization performance and offer compelling properties for the task of password guessing. In this paper, we propose PassFlow, a flow-based generative model approach to password guessing. Flow-based models allow for precise log-likelihood computation and optimization, which enables exact latent variable inference. Additionally, flow-based models provide meaningful latent space representation, which enables operations such as exploration of specific subspaces of the latent space and interpolation. We demonstrate the applicability of generative flows to the context of password guessing, departing from previous applications of flow-networks which are mainly limited to the continuous space of image generation. We show that PassFlow is able to outperform prior state-of-the-art GAN-based approaches in the password guessing task while using a training set that is orders of magnitudes smaller than that of previous art. Furthermore, a qualitative analysis of the generated samples shows that PassFlow can accurately model the distribution of the original passwords, with even non-matched samples closely resembling human-like passwords.