PassDiff: A New Approach for Password Guessing Using Diffusion Model

Password guessing models can be broadly divided into three classes: dictionary-based password guessing model, password guessing model based on probability statistics and password guessing model based on deep learning. Recurrent neural networks and generative adversarial networks are the main deep learning techniques used for password guessing in the past. In this paper, we propose a novel PassDiff method for password guessing using denoising diffusion probabilistic models (DDPMs). Considering the similarity between the password space and the text space, we incorporate a byte-level tokenizer in the input phase and optimize the sampling process by modifying the source code. We encode a special character, and it makes PassDiff can handle input of variable length and obtain variable output without manual truncation. The experimental results show that PassDiff produces high-quality passwords even with minimal denoising steps. We recommend setting the denoising steps to 5–50, which can increase the sampling speed by tens of times. Compared with PassGAN, the training process of PassDiff is more stable and the cracking rate is also significantly improved. Specifically, when the denoising steps is set to 10 and 108 passwords are generated, PassDiff increases the cracking rate by 3.17%, 6.33% and 13.22% on 12306, CSDN and RockYou datasets, respectively.