There is no theoretic
security model available yet. All existing models on Captcha Security are the
only approximate process. All the modern Captcha schemes depend on segmentation
of object which is computationally- expensive, combinatorically-hard problem.
The complexity of object
segmentation 30, C, is
exponentially dependent of the number M
of objects contained in a challenge, and polynomial dependent of the
size N of the Captcha alphabet:
C=?MP(N), where ? >1isaparameter, and P () is a polynomial function. A Captcha challenge typically
contains 6 to 10 characters, whereas a CaRP image typically contains 30 or more
characters. The complexity to break a Click- Text image is about ?30 P(N)/(?10 P(N)) = ?20 times the complexity to break a
Captcha challenge generated by its underlying Captcha scheme.
ClickText is much harder to break than its underlying Captcha scheme. CaRP
characters are 2D, if user changes to one more dimension, increase its
segmentation difficulty. By this for improved usability, the user can decrease
the distortions in ClickText images. Whereas ClickAnimal depends on both
multiple-label classification and object segmentation.
does not depend on specific captcha if one captcha fails a new and more robust
Captcha scheme may appear and be used to construct a new CaRP scheme.
Automatic Online Guessing Attacks
In automatic online
guessing attacks, dictionaries are constructed manually and trial and error
method is automatic. CaRP has some CPA- secure Captcha if the user ignores some
probabilities. It has following properties:
1. Internal object-points
on one CaRP image are computationally-independent of internal object-points on
another CaRP image. Particularly, clickable points on one image are
computationally-independent of clickable points on another image.
2. Eq. (3) holds, i.e.,
trials in guessing attacks are mutually independent.
The first property can be
proved by contradiction. Assume that the property does not hold, i.e., there
exists an internal object-point ? on one image A that is non-negligibly
dependent of an internal object-point ? on another image B. An adversary can
exploit this dependency to launch the following chosen-pixel attack. In the learning
phase, image A is used to learn the object that contains point ?. In the
testing phase, point ? on image B is used to query the oracle. Since point ? is
non-negligibly dependent of point ?, this CPA-experiment would result in a
success probability non- negligibly higher than a random guess, which
contradicts the CPA-secure assumption. User concludes that the first property
The second property is a
consequence of the first property since user-clicked internal object-points in
one trial are computationally-independent of user-clicked internal
object-points in another trial due to the first property. The user has ignored
background and boundary object-points since clicking any of them would lead to
From Eq. (3) a user can say
that only way to guess a password in automatic online guessing attacks is by
probabilistically regardless of how many trails and errors. Even if you know
the correct password which is to be tested trail has very less chance to pass
because bots do not have the capability to identify the objects in CaRP image.
Here the number of trails are also limited. In brute-force or dictionary
attack, if you know the correct password, this would succeed in compromising
existing graphical passwords.