1. 1 Authentication Celia Li Computer Science and Engineering York University

2. 2 Authentication The process of determining whether someone or something is, in fact, who or what it is declared to be Overview of authentication Symmetric key authentication protocols (Kerberos) Public key authentication protocols (SSL)

3. 3 Overview of Authentication Run before some other protocol a reliable data transfer protocol a routing information exchange protocol Principals: parties who cooperate by exchanging messages over networks.

4. 4 Notation A protocol consists of a sequence of messages between principals and will be described using different notations. E(K : M) denotes encrypting message plaintext M with key K. Principals are generally denoted by capitals such as A, B and S (for a server) (1) A  B : M1 (2) B  S : M2 (3) S  B : M3

5. 5 Notation Na: A number generated by a principal A. Used only once for the purposes of the current run of the protocol and is generally termed as a nonce. A nonce could be a timestamp, a sequence numbers or a pseudo-random number. A  B : A, E(Kab : Na)

6. 6 Notation Timeliness in Authentication Protocols An authentication protocol is required to guarantee that the parties involved in the authentication process are present during the execution of the protocol. Timestamps, sequence numbers, and other types of nonces are generally used to assess freshness of messages.

7. 7 Attacks on Authentication Protocol Reply attack: The attacker records the data of a successful authentication and replays this information to attempt to falsely authenticate to the verifier. Counter measures: using of sequence numbers, timestamps, or pseudo-random numbers.

8. 8 Symmetric Key Authentication Without Trusted Third Party Symmetric key one-pass unilateral authentication protocol Ta: Timestampts, Na: Sequence number, Ra, Rb: Random numbers. B authenticates A: Symmetric key two-pass unilateral authentication protocol Symmetric key three-pass mutual authentication If Ta (timestamp) has a recent value, B can prove A’s identity. B authenticates A: A authenticates B:

9. 9 Symmetric Key Authentication With Trusted Third Party S: Trusted Third Party A B A gets a shared key Kab generated by S A & B trust S, Kas is a shared key of A & S, Kbs is a shared key of B & S B gets shared key Kab A authenticates B B authenticates A (1) (2) (3), (5) (4)

10. 10 Kerberos Authentication V5 In traditional systems, we use password-based authentication. Passwords sent across the network can be intercepted and subsequently used by eavesdroppers to impersonate the user. Password based authentication is inconvenient; users do not want to enter a password each time they access a network service.

11. 11 Kerberos Authentication V5 Kerberos Ticket A certificate issued by an authentication server, encrypted using the authentication server key. The ticket contains the key that will be used for authentication of the principal to the verifier the name of the principal to whom the key was issued an expiration time Because the ticket is encrypted in the server key, known only by the authentication server and intended verifier, it is not possible for the client to modify the ticket without detection.

12. 12 Kerberos authentication A & G are third parties, client C and sever S need to authenticate each other In (1) & (2), C obtains a ticket Tcg from A in order to contacts G In (3) & (4), C obtains a ticket Tcs from G in order to contacts S In (5), S authenticates C In (6), C authenticates S Support single sign-on Tcg is issued once Each Tcs is issued for each server C gets shared key Kcg C forwards ticket Tcg to G C gets shared key Kcs In (5), C forwards ticket Tcs to S, S gets shared key Kcs, S authenticates C C authenticates S

13. 13 Public Key Certificate Kerberos supports single sign on Kerberos eliminates the problem of having passwords for each of many different services by introducing a new service, called the ticket granting server (G). After receiving the ticket grant ticket, any time that the user wishes to contact a service, the user's password is not needed. As long as you have a Ticket Grant Ticket, you can use any Kerberized service without the need to enter your password again.

14. 14 Public Key Certificate An electronic document which uses a digital signature to bind together a public key with an identity — information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual. An electronic "credit card" that establishes your credentials when doing business or other transactions on the Web. Issued by a CA (certification authority), such as VeriSign, etc.

15. 15 Public Key Certificate Public key certificates include the following information: Public key of the subject Distinguished Name of the subject Validity period of the certificate Distinguished Name of the certificate issuer Digital signature of the certificate issuer

16. 16 Public Key Authentication without Trusted Third Party Public key one-pass unilateral authentication protocol Public key two-pass unilateral authentication protocol Public key three-Pass mutual authentication protocol CertA: public key certificate of A, Ka -1 : private key of A, Kb -1 : private key of b B authenticates A: A authenticates B:

17. 17 Public Key Authentication with Trusted Third Party Needham-Schroeder Public Key Authentication Protocol S: Trusted Third Party A B B authenticates A by verifying Nb A authenticates B by verifying Na S sends B’s public key Kb to A S sends A’s public key Ka to B B asks A’s public key from S B gets A’s identity A asks B’s public key from S (1) (2) (3) (4) (5) (6) (7)

18. 18 Secure Soket Layer Protocol (SSL) l Universally accepted on the Web for authenticated and encrypted communication between clients and servers. l Protect sensitive information such as Social Security Number (SSN), Credit Card Number, etc. Web ServerClient

19. 19 SSL Server Certificate The SSL protocol requires a server certificate so that client can authenticate the server. Client Certificate You can optionally configure your server to request a client certificate so that server can authenticate the client. Web Server Client Trust based on certificate

20. 20 SSL 1.Client  server: Hello message 2.Server  client: server’s public key certificate, including server’s public key, digital signature signed by certificate authority (CA) 3.Client uses CA’s public key to verify digital signature signed by CA, thus verifies server’s certificate. 4.Client  server: a random number in order to prove server’s identity. 5. Server encrypts random number with its private key. 6. Server  client: the encrypted message 7.Clients decrypts the message using server’s public key to verify identity of the server. Client authenticates server based on certificate issued by certificate authority (CA)

21. 21 Compare SSL and Kerberos SSLKerberos Uses public key encryptionUses symmetric key encryption Certificate based (asynchronous) Relies on a trusted third party (synchronous) Ideal for secure communications with a large, variable user base that is not known in advance, such as the WWW. Ideal for networked environments where all services and users are known in advance.

22. 22 Authentication Protocols in WLAN WPA (Wi-Fi Protected Access) Certification program created by the Wi-Fi Alliance to secure wireless computer networks.Wi-Fi Alliance Provides stronger data encryption and user authentication Implements the majority of the IEEE 802.11i standard.IEEE 802.11i The three entities are the client, the Authentication Server (AS), and the AP. Supports EAP (extensible authentication protocol)

23. 23 Extensible Authentication Protocol (EAP) EAP is a universal authentication framework used in WLANs. EAP can embed other authentication protocols, such as LEAP, TLS ClientsAccess Point Authentication Server Common Messages Apply to different protocols

24. 24 Authentication Protocols in WLAN Symmetric key approach: EAP-LEAP Public key approach: EAP-TLS Symmetric Key Approaches Efficient and require little computational power. Especially important in wireless networks because many wireless devices, such as PDAs and mobile VoIP phones, have little computational power. Drawbacks: most protocols derive the shared secret from the user's password and some passwords are not strong, it is easy for the attacker to extract the secret key from them.

25. 25 Lightweight Extensible Authentication Protocol (LEAP) Authentication server is integrated with access point in LEAP

26. 26 Authentication Protocols in WLAN Public key Approaches: Provides strong security. Does not provide a way to authenticate clients who do not have a certificate that are signed by the CAs that the authentication server (AS) trusts. Example: EAP-TLS

27. 27 EAP-Transport Layer Security (EAP-TLS) AS verifies client’s digital signature using client’s public key got from client’s certificate Cert client Get random number p by decrypting with its private key Client calculates H(c,s,p), compares it with the value sent by As