1 / 36

Authentication Protocols

Authentication Protocols. Rocky K. C. Chang, 18 March 2011. Outline. Authentication problems Network-based authentication Password-based authentication Cryptographic authentication protocols (challenge and response) Secret key based Public key based

judson
Télécharger la présentation

Authentication Protocols

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Authentication Protocols Rocky K. C. Chang, 18 March 2011

  2. Outline • Authentication problems • Network-based authentication • Password-based authentication • Cryptographic authentication protocols (challenge and response) • Secret key based • Public key based • Needham-Schroeder public-key authentication protocol

  3. The authentication problem • Authentication: • The process of determining whether someone or something is, in fact, who or what it is declared to be. • Binding of an identity to a subject. • Authentication protocols: • Key establishment protocols, e.g., authenticated Diffie-Hellman. • Entity authentication protocols, e.g., system login, which is the focus of this set of slides.

  4. Information for authentication • What the entity knows (such as passwords or secret information) • What the entity has (such as a badge or card) • What the entity is (such as fingerprints or other biometrics) • Where the entity is (such as in front of a particular terminal)

  5. The authentication process • The entire process consists of • Obtaining the required authentication information (e.g., a hashed password) • Analyzing the data (e.g., compare the received password with the stored password), and • Determining if it is associated with the principal (e.g., confirmed if they are the same).

  6. Classification of authentication problems • Authenticated subjects: humans vs machines • Authentication methods: address-based, password, or cryptographic. • Between two entities or with the help of at least a trusted third party • One-way vs mutual authentication

  7. Address-based authentication • Assume that the identity of the source can be inferred from the (IP or MAC) address of the packet. • IP source address spoofing • Receiving the response is generally tricky. • Randomized source address selection • MAC source address spoofing • Many people teach you how to do it. • Detecting them in wireless networks

  8. Password-basedauthentications

  9. Basic password protocols • Authentication based on what the entity knows. • U sends her password to S. • Vulnerability to eavesdropping, stolen password files, and easy-to-guess passwords • Protection of password files: • In UNIX, one of 4,096 hash functions is used to hash a password into an 11-character string. • A 2-character string identifying the hash function is prepended to the 11-character string.

  10. Attacks on the basic protocol • On-line attack • When the hash values are not available to an attacker. • Defense: maximize the time to guess the password, exponential backoff, disconnection, disabling, and jailing. • Off-line attack (dictionary attack) • Receive a copy of the hash value, and guess the password (at his leisure). • Run through a list of likely possibilities, often a list of words from a dictionary • Defense: append the password with a random string (salt) and hash the result. • E.g., • User ID Salt value password hash • Alice 13579 hash(13579,password-alice) • Bob 24680 hash(24680,password-Bob)

  11. Problems with passwords • One fundamental problem with passwords is that they are reusable. • Attacker can reply a captured password. • Force users to age their passwords? • An alternative is to authenticate in such a way that the transmitted password changes each time. • Let U and S agree on a secret function f. • S sends a nonce N (the challenge) to U. • U replies with f(N) (the response). • S validates f(N) by computing it separately. • A nonce (timestamp, random number, etc) is a “number used once”---non-repeating string freshly chosen by S.

  12. One-time passwords • A one-time password is a password that is invalidated as soon as it is used. • The challenge-response mechanism uses one-time passwords. • The response is essentially the “password.” • Every time the password is different (one-time password). • For example, • U chooses an initial seed k, and the key generator computes h(k) = k1, h(k1) = k2, …, h(kn-1) = kn, where h() is a one-way hash function. • The passwords, in the order they are used, are p1 = kn, p2 = kn-1, …, pn = k1.

  13. Two-factor authentication • Hardware support for challenge-response procedures: • A token that responds to a challenge. • A temporal based token: displays a different number, e.g., every 60 seconds. • Two-factor authentication • Authentication based on at least two authentication factors. • E.g., the token value (what the entity has) and a password (what the entity knows)

  14. Secret key based authentication

  15. Assume that S is authentic. The server and Alice share a secret key k, and N is a nonce. The nonce is to deduce that Alice is live. The inclusion of S’s identity ensures that Alice has the knowledge of S as her entity peer. A simple, one-way authentication

  16. A simple, mutual authentication protocol • Mutual authentication  2 x one-way authentication. • Alice and Bob share a secret key k.

  17. Reduced to a 3-way protocol • Besides the reduction in the number of messages, what else is different?

  18. A reflection attack by Eve • Assume that Eve can open multiple simultaneous sessions with Bob.

  19. The key problems and solutions • The same key is used by the initiator and responder. • Have them use different keys (maintain a pair of secret keys between two parties). • Improve the protocol resistance to attacks involving parallel sessions. • Have the initiator and responder draw from different sets of nonce. • Have the initiator to prove who she is before the responder’s.

  20. Will the original 5-way protocol be subject to the reflection attack?

  21. Will the original 5-way protocol be subject to the reflection attack?

  22. Another solution • The main problem is that the encrypted elements in the second and three messages are the same. • Have the responder influence on what she encrypts or hashes. • A possible solution:

  23. Public key based authentication

  24. Public-key authentication • It is very difficult to build a provably secure authentication protocol based on symmetric cryptographic primitives. • It is not feasible to use secret-key authentication without a trusted third party. • The secret key has to be placed in both parties.

  25. A simple, one-way authentication • Alice signs the challenge from S, and NS, NA are nonces picked by S and Alice, respectively. • It is important that Alice influences what she signs.

  26. A simple, mutual authentication • Each side authenticates the other side by requesting for a correct digital signature. • Another implementation can have the challenger to encrypt a nonce.

  27. A pitfall in this simple C-R protocol • Eve can impersonate Alice by having Alice’s help in signing Bob’s nonce.

  28. The main problem is • The challenged party (Alice) has no influence on what she will sign. • As a general principle, it is better if both parties have some influence over the quantity signed. • Otherwise, the challenger can abuse this protocol to get a signature on any quantity she chooses.

  29. An improved protocol • The signer includes her nonce into the message that she is going to sign.

  30. Needham-Schroeder public-key authentication protocol • Kerberos is based on the improved Needham-Schroeder public-key authentication protocol. • The original protocol had security flaws. • Assume that both A and B have a pair of public and private keys. • Denote A's public key by Ka and the private key by K-1a, and similarly for B. • We also write {m}K for message m encrypted with key K. Moreover Na and Nb are nonces generated by A and B, respectively. • We have a trusted key server S.

  31. The original protocol was • A  S: A, B • S  A: {Kb, B}K-1s • A  B: {Na, A}Kb • B  S: B, A • S  B: {Ka, A}K-1s • B  A: {Na, Nb}Ka • A  B: {Nb}Kb

  32. Eve can impersonate Alice by • (1) A  E: {Na, A}Ke (A establishes a normal session with E.) • (1’) E  B: {Na, A}Kb (E attempts to impersonate A when establishing a session with B.) • (2’) B  E: {Na, Nb}Ka (B's response to A intercepted by E.) • (2) E  A: {Na, Nb}Ka (E forwards B's response to A.) • (3) A  E: {Nb}Ke (A's response to E) • (3’) E  B: {Nb}Kb (E's response to B, therefore successfully impersonating A)

  33. A simple fix • Include B's identity in the response message. That is, the message (f) becomes • B  A: {B, Na, Nb}Ka. • Therefore, the message (iii) in the attack becomes • B  E: {B, Na, Nb}Ka. • In this case E cannot replay the message and send it to A, because A expects B's identity in the message.

  34. Conclusions • Designing a secure and efficient authentication protocol turned out to be more difficult than people thought. • We have discussed the basic protocols based on password, secret-key, and public-key. • We have not addressed the system with a trusted third party yet. • The result of authentication may also include an agreement of a secret key, i.e., authenticated key exchange (to be addressed later).

  35. Acknowledgments • The notes are prepared mostly based on • C. Kaufman, R. Perlman and M. Speciner, Network Security: Private Communication in a Public World, Second Edition, Prentice Hall PTR, 2002. • Various articles

More Related