1. CSCE 522 Identification and Authentication

2. Reading Reading for this lecture: Required: Pfleeger: Ch. 2.1
An Introduction to Computer Security: The NIST Handbook, : Chapter 16, Identification and Authentication, pages
Interesting read:
Thanasis Petsas, Giorgos Tsirantonakis, Elias Athanasopoulos, and Sotiris Ioannidis Two-factor authentication: is the world ready?: quantifying 2FA adoption. In Proceedings of the Eighth European Workshop on System Security (EuroSec '15). ACM, New York, NY, USA, , Article 4 , 7 pages.,
Smart Card Alliance,
Entrust, authentication news
Certificate Authority GlobalSign Loses Critical Data to ComodoHacker, , Sept 8, 2011
Reading for next lecture:
Pfleeger: Ch. 2.2
CSCE Farkas

3. Identification
Establishes the identity of an individual/system/ap-plication/etc.
Proof of identity: password, driver’s license, Id card, etc.
CSCE Farkas

4. Authentication
Allows an entity (a user or a system) to prove its identity within a context, e.g., computer system
Typically, the entity whose identity is verified reveals knowledge of some secret S to the verifier
Strong authentication: the entity reveals knowledge of S to the verifier without revealing S to the verifier
CSCE Farkas

5. Authentication Information
Must be securely maintained by the
system.
CSCE Farkas

6. Elements of Authentication
Person/group/code/system: to be authenticated
Distinguishing characteristics: differentiates the entities to be authenticated
Proprietor/system owner/administrator: responsible for the system
Authentication mechanism: verify the distinguishing characteristics
Access control mechanism: grant privileges upon successful authentication
CSCE Farkas

7. Authentication Requirements
Network must ensure
Data exchange is established with addressed peer entity not with an entity that masquerades or replays previous messages
Network must ensure data source is the one claimed
Authentication generally follows identification
Establish validity of claimed identity
Provide protection against fraudulent transactions
CSCE Farkas

8. User Authentication What the user knows What the user possesses
Password, personal information
What the user possesses
Physical key, ticket, passport, token, smart card
What the user is (biometrics)
Fingerprints, voiceprint, signature dynamics
CSCE Farkas

9. Passwords Commonly used method
For each user, system stores (user name, F(password)), where F is some transformation (e.g., one-way hash) in a password file
F(password) is easy to compute
From F(password), password is difficult to compute
Password is not stored in the system
When user enters the password, system computes F(password); match provides proof of identity
CSCE Farkas

10. Vulnerabilities of Passwords
Inherent vulnerabilities
Easy to guess or snoop
No control on sharing
Practical vulnerabilities
Visible if unencrypted in distributed and network environment
Susceptible for replay attacks if encrypted naively
Password advantage
Easy to modify compromised password.
CSCE Farkas

11. Attacks on Password Guessing attack/dictionary attack
Social Engineering
Sniffing
Trojan login
Van Eck sniffing
CSCE Farkas

12. Guessing Attack
Exploits human nature to use easy to remember passwords
Trial-and-error attack
Easy to detect (failed logins) and block
Problem: if the attacker has access to the password file (even if it is encrypted)
Need audit mechanism
CSCE Farkas

13. Social Engineering
Attacker asks for password by masquerading as somebody else (not necessarily an authenticated user)
May be difficult to detect
Protection against social engineering: strict security policy and users’ education
CSCE Farkas

14. Dictionary Attacks on Passwords
Create dictionary of common words and names and their simple transformations
Use these to guess password
Attack 2:
Usually F is public and so is the password file (encrypted)
Compute F(word) for each word in dictionary
Find match
CSCE Farkas

15. Password Salt Used to make dictionary attack more difficult
Salt is a 12 bit number between 0 and 4095
It is derived from the system clock and the process identifier
Compute F(password+salt); both salt and F(password+salt) are stored in the password table
User: gives password, system finds salt and computes F(password+salt) and check for match
Better!: use a random number, user authenticates by sending F(password+random number) || random number
CSCE Farkas

16. Password Management Policy
Educate users to make better choices
Define rules for good password selection and ask users to follow them
Ask or force users to change their password periodically
Actively attempt to break user’s passwords and force users to change broken ones
Screen password choices
CSCE Farkas

17. Use the password exactly once!
One-time Password
Use the password exactly once!
The first use of the password would grant access; a second or subsequent use of the same password would not
CSCE Farkas

18. Lamport’s scheme Doesn’t require any special hardware
System computes one-way function F, such as F(x),F2(x),…, F1000(x)
System stores user’s name and F1000(x)
User supplies F999(x) the first time
If the login is correct, system replaces F1000(x) with F999(x)
Next login: user supplies F998(x) … and so on
User calculates Fn(x) using a hand-held calculator, a workstation, or other devices
CSCE Farkas

19. Time Synchronized There is a hand-held authenticator
It contains an internal clock, a secret key, and a display
Display outputs a function of the current time and the key
It changes about once per minute
User supplies the user id and the display value
Host uses the secret key, the function and its clock to calculate the expected output
Login is valid if the values match
CSCE Farkas

20. Time Synchronized Problem: Need time synchronization between
device and server
Secret key
Time
DES
One Time Password
CSCE Farkas

21. Challenge Response Network Work station Host
Non-repeating challenges from the host is used
The device requires a keypad
Network
Work
station
Host
User ID
Challenge
Response
CSCE Farkas

22. Challenge Response Secret key Challenge DES One Time Password
CSCE Farkas

23. Devices with Personal Identification Number (PIN)
Devices are subject to theft, some devices require PIN (something the user knows)
PIN is used by the device to authenticate the user
Problems with challenge/response schemes
Key database is extremely sensitive
This can be avoided if public key algorithms are used
CSCE Farkas

24. Smart Cards
Portable devices with a CPU, I/O ports, and some nonvolatile memory
Can carry out computation required by public key algorithms and transmit directly to the host
Some use biometrics data about the user instead of the PIN
CSCE Farkas

25. Biometrics Fingerprint Retina scan Voice pattern Signature
Typing style
CSCE Farkas

26. Problems with Biometrics
Expensive
Retina scan (min. cost) about $ 2,200
Voice (min. cost) about $ 1,500
Signature (min. cost) about $ 1,000
False readings
Retina scan 1/10,000,000+
Signature 1/50
Fingerprint 1/500
Can’t be modified when compromised
CSCE Farkas

27. Identity Management Distributed, heterogeneous domain User credentials
Performance
pswd
pswd
System 1
System 2
I am Ann. Here is my
Password1.
I am Ann. Here is my
Password2.
pswd
I am Ann. Here is my
Password3.
System 3
CSCE Farkas

28. Identity Management cont.
Need verifiable proof of identity – without being authenticated during every single interaction
Digital certificate: links identity and public key together
A user can prove his/her identity by signing the messages with his/her private key
CSCE Farkas

29. Digital Certificates Most common digital certificate: X.509
Initially issued in 1988
Rely on PKI and hierarchy of certificate authorities
Certificate Authority: issue and revoke digital certificates, accepts user notifications, publishes revocation list
CSCE Farkas

30. Digital Certificates Basic Content…
Issuer
Validity
Not Before
Not After
Subject
Subject Public Key Info
Public Key Algorithm
Subject Public Key
Certificate Signature Algorithm
Certificate Signature
CSCE Farkas

31. Problem with X.509 Large file
Long duration  needs validation of certificate for revocation
Why are digital certificates revoked?
Exposure of private key
Incorrect/unauthorized issuance
Termination of assignment
CSCE Farkas

32. Return to Multiple Authentication
Verify Certificate
System 1
System 2
I am Ann. Here is my
X.509
I am Ann. Here is my
X.509
I am Ann. Here is my
X.509
System 3
CSCE Farkas

33. Single Sign On Verify Certificate SAML token SAML token SAML token
I am Ann. Here is my
X Give me a locally
verifiable token.
System 1
System 2
I am Ann. Here is my
SAML token
SAML token
I am Ann. Here is my
SAML token
System 3
CSCE Farkas

34. Next Class
Access Control
CSCE Farkas