Error-Tolerant Password Recovery Niklas Frykholm and Ari Juels RSA Laboratories.

Slides:

Advertisements

Similar presentations

Handball: Simple Security Tools for Handheld Devices Niklas Frykholm, Markus Jakobsson, Ari Juels LABORATORIES.

Advertisements

Ari Juels RSA Laboratories Marty Wattenberg 328 W. 19th Street, NYC A Fuzzy Commitment Scheme.

Chapter 10 Encryption: A Matter of Trust. Awad –Electronic Commerce 1/e © 2002 Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic Algorithm.

Revisiting the efficiency of malicious two party computation David Woodruff MIT.

Point3r$. Password Introduction Passwords are a key part of any security system : –Work or Personal Strong passwords make your personal and work.

Cryptography encryption authentication digital signatures

1 Key Exchange Solutions Diffie-Hellman Protocol Needham Schroeder Protocol X.509 Certification.

1 Pretty Good Privacy (PGP) Security for Electronic .

1 Identification Who are you? How do I know you are who you say you are?

Public Key Cryptosystem

Trusted Data Sharing over Untrusted Cloud Storage Provider Gansen Zhao, Chunming Rong, Jin Li, Feng Zhang, and Yong Tang Cloud Computing Technology and.

1 Linked List Demo Node third = new Node(); third.item = "Carol"; third.next = null; Node second = new Node(); second.item = "Bob"; second.next = third;

Chapter 10 Real world security protocols

By Md Emran Mazumder Ottawa University Student no:

Click on the Schedule 1 tab.

Lecture 5: Cryptographic Hashes

RPC Mixing: Making Mix-Nets Robust for Electronic Voting Ron Rivest MIT Markus Jakobsson Ari Juels RSA Laboratories.

Computer Security Set of slides 5 Dr Alexei Vernitski.

Fuzzy Vaults: Toward Secure Client-Side Matching Ari Juels RSA Laboratories 10th CACR Information Security Workshop 8 May 2002 LABORATORIES.

Securing Fingerprint Template - Fuzzy Vault with Helper Data

Fuzzy Stuff Lecture 24, Outline Motivation: Biometric Architectures Motivation: Biometric Architectures New Tool (for us): Error Correcting.

1 Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell.

BY : Darshana Chaturvedi.  INTRODUCTION  RSA ALGORITHM  EXAMPLES  RSA IS EFFECTIVE  FERMAT’S LITTLE THEOREM  EUCLID’S ALGORITHM  REFERENCES.

Introduction to PKI Seminar What is PKI? Robert Brentrup July 13, 2004.

Cryptography 101 How is data actually secured. RSA Public Key Encryption RSA – names after the inventors –Rivest, Shamir, and Adleman Basic Idea: Your.

CMSC 414 Computer and Network Security Lecture 6 Jonathan Katz.

HW6 due tomorrow Teams T will get to pick their presentation day in the order Teams T will get to pick their presentation day in the orderQuestions? Review.

CMSC 414 Computer and Network Security Lecture 21 Jonathan Katz.

1 Lecture #10 Public Key Algorithms HAIT Summer 2005 Shimrit Tzur-David.

1 CPSC156: The Internet Co-Evolution of Technology and Society Lectures 19,20, and 21: April 5, 10, and 12, 2007 Cryptographic Primitives.

CMSC 414 Computer and Network Security Lecture 6 Jonathan Katz.

Public Key Cryptography RSA Diffie Hellman Key Management Based on slides by Dr. Lawrie Brown of the Australian Defence Force Academy, University College,

Codes, Ciphers, and Cryptography-RSA Encryption

Introduction to Public Key Cryptography

Asymmetric encryption. Asymmetric encryption, often called "public key" encryption, allows Alice to send Bob an encrypted message without a shared secret.

Practical Techniques for Searches on Encrypted Data Yongdae Kim Written by Song, Wagner, Perrig.

CS5204 – Fall Cryptographic Security Presenter: Hamid Al-Hamadi October 13, 2009.

Page 1 Secure Communication Paul Krzyzanowski Distributed Systems Except as otherwise noted, the content of this presentation.

RSA Implementation. What is Encryption ? Encryption is the transformation of data into a form that is as close to impossible as possible to read without.

HW6 due tomorrow Teams T will get to pick their presentation day in the order Teams T will get to pick their presentation day in the order Teams mostly.

Authentication and Authorization Authentication is the process of verifying a principal’s identity (but how to define “identity”?) –Who the person is –Or,

Cryptography Dec 29. This Lecture In this last lecture for number theory, we will see probably the most important application of number theory in computer.

Public Key Encryption and the RSA Public Key Algorithm CSCI 5857: Encoding and Encryption.

Network Security Lecture 17 Presented by: Dr. Munam Ali Shah.

Public-Key Cryptography CS110 Fall Conventional Encryption.

Honey Encryption: Security Beyond the Brute-Force Bound

Kerberos Named after a mythological three-headed dog that guards the underworld of Hades, Kerberos is a network authentication protocol that was designed.

Software Security Seminar - 1 Chapter 5. Advanced Protocols 조미성 Applied Cryptography.

Public Key Encryption with keyword Search Author: Dan Boneh Rafail Ostroversity Giovanni Di Crescenzo Giuseppe Persiano Presenter: 陳昱圻.

Key Exchange Methods Diffie-Hellman and RSA CPE 701 Research Case Study Derek Eiler | April 2012.

Attacks Overview Nguyen Cao Dat 1. BK TP.HCM Outline  Cryptographic Attacks ▫ Frequency analysis ▫ Brute force attack ▫ Meet-in-the-middle attack ▫ Birthday.

Lecture 2: Introduction to Cryptography

Authentication Issues and Solutions CSCI 5857: Encoding and Encryption.

31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

A A E E D D C C B B # Symmetric Keys = n*(n-1)/2 F F

Digital Signatures and Digital Certificates Monil Adhikari.

Software Security Seminar - 1 Chapter 4. Intermediate Protocols 발표자 : 이장원 Applied Cryptography.

A Brief Introduction to Mix Networks Ari Juels RSA Laboratories © 2001, RSA Security Inc.

MM Clements Cryptography. Last Week Firewalls A firewall cannot protect against poor server, client or network configuration A firewall cannot.

April 20023CSG11 Electronic Commerce Encryption John Wordsworth Department of Computer Science The University of Reading Room.

1 Cryptography Troy Latchman Byungchil Kim. 2 Fundamentals We know that the medium we use to transmit data is insecure, e.g. can be sniffed. We know that.

EE 122: Lecture 24 (Security) Ion Stoica December 4, 2001.

9.2 SECURE CHANNELS JEJI RAMCHAND VEDULLAPALLI. Content Introduction Authentication Message Integrity and Confidentiality Secure Group Communications.

CMSC 414 Computer and Network Security Lecture 2 Jonathan Katz.

Attacks on Public Key Encryption Algorithms

Encryption. Encryption Basics • Plaintext - the original message ABCDEFG • Ciphertext - the coded message DFDFSDFSD • Cipher - algorithm for.

Presentation transcript:

Error-Tolerant Password Recovery Niklas Frykholm and Ari Juels RSA Laboratories

Password recovery: The problem

Users classifiable into two types 1. Those who don t forget or lose passwords, e.g., 2. Those who forget or lose passwords Ron Rivest Elephant

Current method of password recovery: use of private information u SSN –Not terribly private anymore u Amount of last deposited cheque –All Americans deposited $300 or $600 from IRS Mother s maiden name –For those of, e.g., Chinese origin, a handful of surnames cover much of population

u Date of birth Special Report: October 5th is America's October 5th is America's most popular birthday. Worst of all, private information must be stored on a server or available to customer service representatives

Aim #1:Use truly private questions u Examples: Fabio – What was the name of your first pet? Uma – What was the name of the first girl/boy you kissed? u Answers are never revealed in explicit form to server or customer service representative, etc.

Answers open vault for user, enabling recovery on client

How this might work HH H H answer 1answer 2answer 3answer 15...H(a 2 )H(a 3 )H(a 15 )H(a 1 )

How this might work...H(a 2 )H(a 3 )H(a 15 )H(a 1 ) X = EX[EX[ ] =

Aim #2: Tolerate user errors Question: What was the name of the first girl/boy you kissed? Hugh Grant Liz ? Bridget ? Dolly? Peter?

Now, during recovery......H(a 2 )H(a 3 )H(a 15 )H(a 1 ) Original key X = User tries X =...H(a 3 )H(a 1 ) Thus, we need to be able to open the vault if X X

Fuzzy commitment (JW 99) u Produce ciphertext = C X [K] of secret K under key X We can decrypt K using any X such that X X u We learn only a little information about X u Idea: Use error-correcting code -- in unorthodox way –Throw away the message space!

Error-correcting code c1c1 c2c2 c3c3 c5c5 c6c6 c7c7 c9c9 c 10 c 11 c4c4 c8c8 c 12 f X f(X) = c 6

Error-correcting code c1c1 c2c2 c3c3 c5c5 c6c6 c7c7 c9c9 c 10 c 11 c4c4 c8c8 c 12 X f(X) = ?????

Fuzzy commitment c1c1 c2c2 c3c3 c5c5 c6c6 c7c7 c9c9 c 10 c 11 c4c4 c8c8 c 12 K X = C X (K)

Given and X X... Fuzzy commitment c1c1 c2c2 c3c3 c6c6 c7c7 c9c9 c 10 c 11 c4c4 c8c8 c 12 X f(X - ) = K X f K

Given alone... Why is this secure? c1c1 c2c2 c3c3 c6c6 c7c7 c9c9 c 10 c 11 c4c4 c8c8 c 12 X c5c5 K

Given alone... Why is this secure? c1c1 c2c2 c3c3 c6c6 c7c7 c9c9 c 10 c 11 c4c4 c8c8 c 12 X c5c5 K

Given alone... Why is this secure? c1c1 c2c2 c3c3 c6c6 c7c7 c9c9 c 10 c 11 c4c4 c8c8 c 12 X c5c5 K

Why is this secure? c1c1 c2c2 c3c3 c6c6 c7c7 c9c9 c 10 c 11 c4c4 c8c8 c 12 X Given alone... I.e., says nothing about which codeword c5c5 K

Fuzzy commitment u Cryptographically-strong (info. theoretic) security if code is large enough, i.e, if there are enough codewords u Very efficient encryption/decryption u Tradeoff between leakage of X and error- tolerance

Our password recovery scheme u X = H(a 1 ) | H(a 2 ) | … | H(a 15 ) u Select random codeword K u Compute = C X [K] = X - K u Store vault = ( = C X [K]); E K [passwords] Given enough right answers, I.e., X X, we can recover passwords u Typical (secure) parameterization: v 15 questions v Any 11 will open vault

u User answers questions, creates vault = C X [K] Alice Bob Charlie -- (fuzzy comm. to K A ) -- (fuzzy comm. to K B ) -- (fuzzy comm. to K C ) ; (E K A [SK A ],PK A ) ; (E K B [SK B ],PK B ) ; (E K C [SK C ],PK C ) u User generates public/private key pair (SK, PK) PK A

u Alice (or admin) can add to vault without opening it Alice Bob Charlie -- (fuzzy comm. to K A ) -- (fuzzy comm. to K B ) -- (fuzzy comm. to K C ) ; (E K A [SK A ],PK A ) ; (E K B [SK B ],PK B ) ; (E K C [SK C ],PK C ) PK A $$ Pass- words

u By answering, e.g., 11 out of 15 questions, Alice can, e.g., recover SK A, and thus passwords securely using any Web-enabled device Alice Bob Charlie -- (fuzzy comm. to K A ) -- (fuzzy comm. to K B ) -- (fuzzy comm. to K C ) ; (E K A [SK A ],PK A ) ; (E K B [SK B ],PK B ) (E K C [SK C ],PK C ) PK A $$ Pass words

Can be a universal service: E.g., Amazon, Citibank, etc. can all store keys in Alice s vault Alice Bob Charlie -- (fuzzy comm. to K A ) -- (fuzzy comm. to K B ) -- (fuzzy comm. to K C ) ;(E K A [SK A ],PK A ) ;(E K B [SK B ],PK B ) ;(E K C [SK C ],PK C ) PK A $$ Pass words With external hardening server, can use fewer than 15 questions

Proving Security This is the hardest part... –Random (or cryptographic) hash H does not yield good results v E.g., UOWHFs do not help (as hash is published) –We must customize hash as best we can to distribution over individual answers –I.e., we craft H 1,H 2,…,H 15 based on what form answers are likely to take

Refining the user experience (prototype) u For recovery only u What questions should we ask? u In what form do we pose the questions? How can we best normalize answers? How can we best jog the user s memory? u How many questions can we ask? –Can use, e.g., 3 out of 5, with hardening server

What is the name of your doctor? What did you give your mother for her 50th birthday? What is your favorite piece of music? What is the name of your father s best friend? What was the profession of your maternal grandfather? Where did you celebrate the millenium? Questions?