Honey Encryption: Security Beyond the Brute-Force Bound

We introduce honey encryption (HE), a simple, general approach to encrypting messages using low min-entropykeys such as passwords. HE is designed to produce a ciphertext which, when decrypted with any of a number ofincorrect keys, yields plausible-looking but bogus plaintexts called honey messages. A key benefit of HE is that itprovides security in cases where too little entropy is available to withstand brute-force attacks that try every key;in this sense, HE provides security beyond conventional brute-force bounds. HE can also provide a hedge againstpartial disclosure of high min-entropy keys.HE significantly improves security in a number of practical settings. To showcase this improvement, we buildconcrete HE schemes for password-based encryption of RSA secret keys and credit card numbers. The key chal-lenges are development of appropriate instances of a new type of randomized message encoding scheme called adistribution-transforming encoder (DTE), and analyses of the expected maximum loading of bins in various kindsof balls-and-bins games.