PreAcher: Secure and Practical Password Pre-Authentication by Content Delivery Networks#
NSDI '25 digest Program Core pick 28–30 April 2025
- Authors / tier: Shihan Lin, Xiaowei Yang (Duke); Suting Chen, Aleksandar Kuzmanovic (Northwestern); Yunming Xiao (University of Michigan); Yanqi Gu (UC Irvine). Core.
- Why: Sits in the identity/authentication lane: it offloads password authentication to CDNs to absorb application-layer DoS against login interfaces, without ever revealing passwords to the CDN. A genuinely novel three-party auth architecture.
- What: A system that inserts a third-party CDN into the password-auth path to pre-authenticate users and filter ADoS traffic before it reaches the origin, while preserving password secrecy and usability.
- How: A three-party (client/CDN/server) protocol combining an Oblivious Pseudorandom Function (OPRF) with Locality-Sensitive Hashing (LSH). The client derives a secret key from the password via OPRF+LSH and interacts with the CDN rather than the server, so the CDN can validate login attempts without learning the password. Demonstrated against a commercial-CDN setup where login-interface ADoS slips past standard WAF/rate-limit protections.
- Where applicable: Web services fronted by CDNs that want login-layer DoS protection; deployable unilaterally by a server operator. General architecture, though it changes the login flow and assumes CDN cooperation.