TY - GEN
T1 - On the guessability of resident registration numbers in South Korea
AU - Song, Youngbae
AU - Kim, Hyoungshick
AU - Huh, Jun Ho
N1 - Publisher Copyright:
© Springer International Publishing Switzerland 2016.
PY - 2016
Y1 - 2016
N2 - This paper studies a potential risk of using real name verification systems that are prevalently used in Korean websites. Upon joining a website, users are required to enter their Resident Registration Number (RRN) to identify themselves. We adapt guessing theory techniques to measure RRN security against a trawling attacker attempting to guess victim’s RRN using some personal information (such as name, sex, and location) that are publicly available (e.g., on Facebook). We evaluate the feasibility of performing statistical-guessing attacks using a real-world dataset consisting of 2,326 valid name and RRN pairs collected from several Chinese websites such as Baidu. Our results show that about 4,892.5 trials are needed on average to correctly guess a RRN. Compared to the brute-force attack, our statistical-guessing attack, on average, runs about 6.74 times faster.
AB - This paper studies a potential risk of using real name verification systems that are prevalently used in Korean websites. Upon joining a website, users are required to enter their Resident Registration Number (RRN) to identify themselves. We adapt guessing theory techniques to measure RRN security against a trawling attacker attempting to guess victim’s RRN using some personal information (such as name, sex, and location) that are publicly available (e.g., on Facebook). We evaluate the feasibility of performing statistical-guessing attacks using a real-world dataset consisting of 2,326 valid name and RRN pairs collected from several Chinese websites such as Baidu. Our results show that about 4,892.5 trials are needed on average to correctly guess a RRN. Compared to the brute-force attack, our statistical-guessing attack, on average, runs about 6.74 times faster.
KW - Brute-force attack
KW - Korean identification system
KW - Resident registration number
KW - Statistical-guessing attack
UR - https://www.scopus.com/pages/publications/84978230492
U2 - 10.1007/978-3-319-40253-6_8
DO - 10.1007/978-3-319-40253-6_8
M3 - Conference contribution
AN - SCOPUS:84978230492
SN - 9783319402529
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 128
EP - 138
BT - Information Security and Privacy - 21st Australasian Conference, ACISP 2016, Proceedings
A2 - Liu, Joseph K.
A2 - Steinfeld, Ron
PB - Springer Verlag
T2 - 21st Australasian Conference on Information Security and Privacy, ACISP 2016
Y2 - 4 July 2016 through 6 July 2016
ER -