A New Two-Server Approach for Authentication with Short Secrets John Brainard, Ari Juels,Burt Kaliski and Michael Szydlo RSA Laboratories To appear in USENIX Security 2003/4/9

Outline Introduction Introduction Previous Work Previous Work New Work New Work

Passwords and PINs Short secrets are convenience. Short secrets are convenience. The secrets stored in a central The secrets stored in a central database. database.

Problem How is it possible to provide secure services to users who can authenticate using only short secrets or weak password? How is it possible to provide secure services to users who can authenticate using only short secrets or weak password?

Smartcards, similar key-storage Smartcards, similar key-storage Memorable PW – guessing attack Memorable PW – guessing attack

SPAKA protocols (Secure password authenticated key agreement) (Secure password authenticated key agreement) EKE:Share a password, mutual ensure to established a session key. EKE:Share a password, mutual ensure to established a session key.

Attack to SPAKA Client SERVER password celartext steal Off-line dictionary attacks Cleartext LOOK ALL ?

Outline Introduction Introduction Previous Work Previous Work New Work New Work

Previous work A mechanism called password hardening, by Ford and Kaliski. A mechanism called password hardening, by Ford and Kaliski. Client password … Server secret

… Learn no information Decrypt credentials Authenticate Others protocols …

Outline Introduction Introduction Previous Work Previous Work New Work New Work

Now new work Two-server solution. Two-server solution. Server Red SSL Server Blue p P ’ P = P ’ ?? Client SSL

Outline Introduction Introduction Previous Work Previous Work New Work New Work Equality-Testing Protocol Equality-Testing Protocol

Equality-Testing Protocol H is a large group(160-bit) H is a large group(160-bit) and + be the group operator and + be the group operator f is collision-free hash function f is collision-free hash function

Equality-Testing Protocol Registration: Registration:

Equality-Testing Protocol Authentication: Authentication: If P = P ’ 0

G is large group (hard to discrete log) G is large group (hard to discrete log) g : generator g : generator q : order in Zp (p=2q+1) q : order in Zp (p=2q+1) p (1024 bits) p (1024 bits) w: H -> G w: H -> G

Compare with SPAKA Mutually authenticated channel between Mutually authenticated channel between two servers. two servers. not derive a shared key. not derive a shared key. Client need perform no cryptographic computation, and operation in H. Client need perform no cryptographic computation, and operation in H.

Outline Introduction Introduction Previous Work Previous Work New Work New Work Equality-Testing Protocol Equality-Testing Protocol Architectural Motivation Architectural Motivation

Architectural Motivation Security in two servers. Security in two servers. * different OSs * different OSs * different organizations * different organizations (privacy outsourcing): (privacy outsourcing): service provider service provider privacy provider privacy provider

Architectural Motivation Universality Universality Pseudonymity Pseudonymity Engineering simplicity Engineering simplicity System isolation System isolation Mitigation of denial-of-service attacks Mitigation of denial-of-service attacks

Outline Introduction Introduction Previous Work Previous Work New Work New Work Equality-Testing Protocol Equality-Testing Protocol Architectural Motivation Architectural Motivation Avoiding Problems Avoiding Problems

Avoiding Problems False Pseudonym Problem False Pseudonym Problem Replay Attacks Problem Replay Attacks Problem