Virtual Password Authentication Scheme in Hashed Domain

This paper proposes a virtual password authentication scheme which is able to work in the hashed domain. Many research in the area of virtual password have been proposed to overcome keylogger attacks. Unfortunately, current methods are still lack of complexities and have a short cracking time. Several research have partially overcome these problems. However, the proposed methods work only in the plain text domain which is vulnerable to the privacy and security attacks. To overcome this problem, we proposed a virtual password scheme that generates dynamic length of a random password consisting of both uppercase and lowercase alphabets, numbers, and symbols. Importantly, our method is also able to compare user's password despite it is hashed. With an efficient algorithm that help this method's computation time somewhat similar with regular login, the cracking time and complexity of this method are superior which scores 174 on password complexity and calculated to be cracked after 10,000+ and 9 centuries by brute force attack using a personal computer and conficker botnets respectively.