Humanity versus Entropy: Problems with Keeping a Secret Eamon Johnson CWRU Math 408, Spring 2012 Project Presentation

Problem Statement Password: a secret used for authentication An ideal secret has a few qualities: – Hard to guess (high entropy) – Easy to remember – Easy to communicate – Easy to change Question: can entropy be increased without increasing difficulty of remembering, communicating, and changing the secret? 2

Background Real-time password complexity feedback increases entropy while making passwords harder to remember Other sources of personal entropy: – Things you know – Things you have – Things you are 3

Problems with Keeping a Secret Two underlying problems affect all practical sources of entropy: Limited Entropy – Misestimated entropy – Unchangeable secrets Single Point of Failure 4

Sources of Limited Entropy Imagination and Memory Personal Information – Personal Knowledge Questions – Shared History Biometrics – Information security versus authentication accuracy – Physical properties and behavioral properties 5

Delegation to a Single Point of Failure Secret Algorithms – Violations of Kerckhoffs's principle Off-line / Out-of-band Storage – Paper in your wallet External Technology – Physical Devices: Fobs, tokens, cards – Networked Services: single sign-on, OpenID 6

Combining Sources of Entropy All practical sources of entropy have well- known weaknesses, so they are often used in combination: multi-factor authentication Combination of schemes incurs a cost – Technology cost – Communication difficulty Question: how valuable is the secret? 7

Quantifying the Value of a Secret A secret has value by proxy when it is used to protect assets of value What is an asset worth? – Cost to return to a pre-compromise state – Time to return to a pre-compromise state – Asset value may fluctuate over time A secret-keeping mechanism has costs: – One time – Recurring 8

Proposal: Tiered Security 9

Example: Tiered Security 10 TierAsset ClassAsset ExamplePolicy 1Private informationMedical records, financial records Password in wallet, never cached 2Semi-private information access, Facebook access Password in wallet or device cache 3Useless / incorruptible information Rewards card login (only used to add points) Reused password Example tiers for personal information assets

Conclusion All practical sources of entropy are flawed: – Limited Entropy – Single Point of Failure Entropy must be bought Assuming acceptable risk is constant, the cost of applying the right security is the only manageable component 11

12 R. Munroe 2011,