Verifiable Compromised Credential Checking
Summary
Compromised credential checking (C3) services like HaveIBeenPwned let users check if their passwords were exposed in data breaches, but existing services don't verify that the server is telling the truth, meaning a malicious C3 server could falsely claim a breached password is safe. This paper proposes VerC3, a new system that adds verification to C3 services by using two servers instead of one, signing breached password records with the data owner's digital signature, and defining protocols so clients can confirm the server responded honestly.
Solution / Mitigation
The paper proposes building VerC3 in a two-server setting where breached password records are signed by the data owner and stored by the online server. The authors provide a specific implementation called Have I Really Been Pwned (HIRBP) that meets 11 security properties. According to their prototype, 'It takes the client 136.91 ms to finish a query on a common PC, with a total bandwidth of 86 KB.'
Classification
Original source: http://ieeexplore.ieee.org/document/11614580
First tracked: August 23, 2026 at 02:01 AM
Classified by LLM (prompt v3) · confidence: 95%