We present in this paper an alternative method for understanding user-chosen passwords. In password research, much attention has been given to increasing the security and usability of individual passwords for common users. Few of them focus on the relationships between passwords; therefore we explore the relationships between passwords: modification-based, similarity-based, and probability-based. By regarding passwords as vertices, we shed light on how to transform a dataset of passwords into a password graph. Subsequently, we introduce some novel notions from graph theory and report on a number of inner properties of passwords from the perspective of graph. With the assistance of Python Graph-tool, we are able to visualize our password graph to deliver an intuitive grasp of user-chosen passwords. Five real-world password datasets are used in our experiments to fulfill our thorough experiments. We discover that (1) some passwords in a dataset are tightly connected with each other; (2) they have the tendency to gather together as a cluster like they are in a social network; (3) password graph has logarithmic distribution for its degrees. Top clusters in password graph could be exploited to obtain the effective mangling rules for cracking passwords. Also, password graph can be utilized for a new kind of password strength meter.

Face spoofing is a serious threat to the security of face recognition and face anti-spoofing (FAS) has become one of the popular research directions recently. The pipeline of modern face anti-spoofing methods is to train deep neural networks to distinguish live and spoof faces using various auxiliary information. Depth maps are the most commonly used auxiliary features due to their computational simplicity and ease of discrimination. However, existing methods do not generalize well in complex environments and against unknown attacks. In this paper, we propose a novel FAS method using generative adversarial network (GAN). We train a GAN for generating depth maps of faces. The network uses the architecture of Wasserstein GAN and adds an attention module to learn the contribution of different regions to the deep graph. The classifier is trained using a latent variable containing depth information in the network. Experiments demonstrate that our approach can better generalize complex external conditions such as illumination and background. Among all results, we gain the best result of 1.17% (EER) on CASIA-FASD and 21.57% (HTER) on cross testing between Replay-Attack and CASIA-FASD.

The shuffle model, which anonymizes data by randomly permuting user messages, has been widely adopted in both cryptography and differential privacy. In this work, we present the first systematic study of the Bayesian advantage in re-identifying a user's message under the shuffle model. We begin with a basic setting: one sample is drawn from a distribution $P$, and $n - 1$ samples are drawn from a distribution $Q$, after which all $n$ samples are randomly shuffled. We define $β_n(P, Q)$ as the success probability of a Bayes-optimal adversary in identifying the sample from $P$, and define the additive and multiplicative Bayesian advantages as $\mathsf{Adv}_n^{+}(P, Q) = β_n(P,Q) - \frac{1}{n}$ and $\mathsf{Adv}_n^{\times}(P, Q) = n \cdot β_n(P,Q)$, respectively. We derive exact analytical expressions and asymptotic characterizations of $β_n(P, Q)$, along with evaluations in several representative scenarios. Furthermore, we establish (nearly) tight mutual bounds between the additive Bayesian advantage and the total variation distance. Finally, we extend our analysis beyond the basic setting and present, for the first time, an upper bound on the success probability of Bayesian attacks in shuffle differential privacy. Specifically, when the outputs of $n$ users -- each processed through an $\varepsilon$-differentially private local randomizer -- are shuffled, the probability that an attacker successfully re-identifies any target user's message is at most $e^{\varepsilon}/n$.

Three-party authentication architectures are central to modern Internet identity systems such as single sign-on, federated login, and cross-domain authentication. In this setting, a three-party password-authenticated key exchange (3-PAKE) protocol must not only authenticate a user to a verifier using a low-entropy password, but also securely support coordinated authentication and session-key establishment between the verifier and a relying party. Existing schemes cover many application scenarios, yet they often rely on PKI, provide weak password protection, or lack a security treatment strong enough to justify safe reuse inside larger identity systems. Since 3-PAKE typically serves as a security-critical component together with assertion delivery, session management, and service authorization, it should remain secure under composition. We therefore study 3-PAKE for the digital identity model in the Universally Composable (UC) framework. We define an ideal functionality ${\mathcal{F}}_{3\text{-}\mathrm{PAKE}}$ that captures three-party authentication, session-key establishment, and attainable password-guessing resistance under different compromise assumptions. We then present a generic construction from authenticated key exchange (AKE) and strong asymmetric password-authenticated key exchange (SaPAKE), and prove that it UC-realizes ${\mathcal{F}}_{3\text{-}\mathrm{PAKE}}$. Instantiating the construction with OPAQUE and HMQV yields a practical PKI-free four-round protocol, 3-GenSaPAKE, together with a two-factor extension. AVISPA analysis and concrete performance evaluation show that the proposed scheme achieves strong composable security while remaining efficient and deployable.