Which attack creates a new alphabet from 2- to 3-character syllables derived from passwords to match against the password database?

Which attack creates a new alphabet from 2- to 3-character syllables derived from passwords to match against the password database?

• A. Fingerprint Attack
• B. Combinator Attack
• C. PRINCE Attack
• D. Markov-Chain Attack

Answer: (D)

Markov-chain password guessing models how characters tend to follow one another in real passwords. It analyzes a training set of passwords and builds a statistical model that treats 2- to 3-character chunks as usable units (syllables). This creates a new alphabet of those syllables and the transitions between them. When generating guesses, the attacker walks through this model in proportion to the learned probabilities, producing password candidates that look like real user choices rather than random strings. This approach is efficient because it concentrates effort on the most likely sequences, especially when the training data resembles the target population. Fingerprint attacks rely on biometric data, which aren’t about password construction. Combinator attacks splice together words from dictionaries but don’t model sequential character dependencies. The PRINCE approach uses rule-based mutations and combinations rather than building an n-gram–based model of short syllables.

Markov-chain password guessing models how characters tend to follow one another in real passwords. It analyzes a training set of passwords and builds a statistical model that treats 2- to 3-character chunks as usable units (syllables). This creates a new alphabet of those syllables and the transitions between them. When generating guesses, the attacker walks through this model in proportion to the learned probabilities, producing password candidates that look like real user choices rather than random strings. This approach is efficient because it concentrates effort on the most likely sequences, especially when the training data resembles the target population.

Fingerprint attacks rely on biometric data, which aren’t about password construction. Combinator attacks splice together words from dictionaries but don’t model sequential character dependencies. The PRINCE approach uses rule-based mutations and combinations rather than building an n-gram–based model of short syllables.