# Password Guessability as a Service (PGaaS)
## 4 Architecture Implementation
### Password Guessability Estimator Component
#### 4.2.2 Guessability Problem  
To measure how guessable a given password is, we first cast the guessability problem as a key-rank estimation problem as proposed in [9], and then use a key-rank estimation algorithm (ESrank) [64] to estimate the rank of the given password within a dictionary used on training by the estimator algorithm. The idea is basically to construct probability spaces as introduced in [9] and then estimate their probability distributions. Each probability space is defined from a dimension over the set of passwords. In particular, we use five probability spaces \(\mathcal{P}_{i},1\leq i\leq 5\) with their corresponding independent probability distribution \(\mathbf{P}_{i},1\leq i\leq 5\) from a given dictionary [9]. In particular, the following are the five dimensions defined over a given password: prefix, suffix, base word, change pattern, and 133t transformation. * A password prefix is a string that consists of all the digits and symbols preceding the first letter (can be both lowercase and uppercase) found in the password when reading it from left to right. For example, given the password 123@joseherediaxD, its prefix will be 123@ since the first letter from left to right is j. If the first character of a given password is a letter, its prefix is the empty string. For example, the prefix of josedavid2009 is the empty string. * A password suffix is a string that consists of all the digits and symbols to the right of the first letter (can be both lowercase and uppercase) found in the password when reading it from right to left. For example, given the password 123 bc456, its suffix will be 456 since the first letter found from right to left is c. If the last character of a given password is a letter, its suffix is the empty string. For example, the suffix of 23 josedavid is the empty string. * A password base word is the sub-string derived from removing both the password prefix and suffix. For example, if the password is hello12345, the base word is hello. Note that if a password only consists of a sequence of letters, its base word is the password itself. * A password change pattern is defined as a list of positive and negative indexes indicating the position of capital letters in the password base word. On the one hand, the algorithm counts positive indices from the beginning of the base word, with a zero for the position of the leftmost character. On the other hand, it counts the negative indices from the end of the base word, with the value of \(-1\) corresponding to the rightmost character position. Both negative and positive indexes do not exceed the median index (half of the length of the password base word) to avoid ambiguity. For example, if the password base word is RealMadriD123, its change pattern is \([0,4,-4]\). * As observed by [22], people tend to mutate passwords using the l33t transformation. A password l33t transformation replaces some characters for visually similar letters in the password base word based on the correspondence defined in Table 1. This transformation is represented as a list of integers in increasing order. More specifically, given the password base word, each occurrence of a character, as appears in Table 1, in the base word is replaced with the corresponding replacement, and so the corresponding integer is appended to the representation list. For example, given the password base word g00 dPa5w0 rD, it is transformed to goodPasworD, and its representation list is [1; 4]. The mutations shown in Table 1 were selected according to the previous work presented in [9]. In particular, its authors originally used these mutations to form the fifth dimension (together with the other dimensions) for PesRank and showed that PesRank performs and behaves accurately when compared with other password estimation methods (see Section 8 of [9]). Additionally, we note that two different base words may have the same representation list. Essentially, the password l33t transformation defines an equivalence relation in the set of base words.