drPass: A Dynamic and Reusable Password Generator Protocol

In general, alphanumeric passwords are used for authentication due to its simplicity and deployability. Strong and distinct alphanumeric passwords are inconvenient to memorize. So, users often pick weak passwords and reuse them. Also, users employ some simple tricks to derive passwords from a basic one. However, such weak and easy to derive passwords could not provide sufficient strength to protect users confidential resources. These passwords reduce the work of attackers to a great extent. Although the strong and distinct passwords reduce brute force attack, they are prone to theft and are often compromised under different vulnerabilities. Thus, by compromising one password, an attacker may gain access to other web-accounts where identical or similar passwords are used by the same user. In this paper, we propose drPass, a dynamic and reusable password generating protocol that generates high entropy passwords and thwarts various password stealing attacks. The proposed drPass scheme does not require any server-side change of existing websites for its implementation. It reduces the memory burden on users and also helps users to generate and maintain highly secure, distinct passwords for each site.