1. A New Two-Server Approach for Authentication with Short Secrets John Brainard, Ari Juels,Burt Kaliski and Michael Szydlo RSA Laboratories To appear in USENIX Security 2003/4/9

2. Outline Introduction Introduction Previous Work Previous Work New Work New Work

3. Passwords and PINs Short secrets are convenience. Short secrets are convenience. The secrets stored in a central The secrets stored in a central database. database.

4. Problem How is it possible to provide secure services to users who can authenticate using only short secrets or weak password? How is it possible to provide secure services to users who can authenticate using only short secrets or weak password?

5. Smartcards, similar key-storage Smartcards, similar key-storage Memorable PW – guessing attack Memorable PW – guessing attack

6. SPAKA protocols (Secure password authenticated key agreement) (Secure password authenticated key agreement) EKE:Share a password, mutual ensure to established a session key. EKE:Share a password, mutual ensure to established a session key.

8. Attack to SPAKA Client SERVER password celartext steal Off-line dictionary attacks Cleartext LOOK ALL ?

9. Outline Introduction Introduction Previous Work Previous Work New Work New Work

10. Previous work A mechanism called password hardening, by Ford and Kaliski. A mechanism called password hardening, by Ford and Kaliski. Client password … Server secret

11. … Learn no information Decrypt credentials Authenticate Others protocols …

12. Outline Introduction Introduction Previous Work Previous Work New Work New Work

13. Now new work Two-server solution. Two-server solution. Server Red SSL Server Blue p P ’ P = P ’ ?? Client SSL

14. Outline Introduction Introduction Previous Work Previous Work New Work New Work Equality-Testing Protocol Equality-Testing Protocol

15. Equality-Testing Protocol H is a large group(160-bit) H is a large group(160-bit) and + be the group operator and + be the group operator f is collision-free hash function f is collision-free hash function

16. Equality-Testing Protocol Registration: Registration:

17. Equality-Testing Protocol Authentication: Authentication: If P = P ’ 0

18. G is large group (hard to discrete log) G is large group (hard to discrete log) g : generator g : generator q : order in Zp (p=2q+1) q : order in Zp (p=2q+1) p (1024 bits) p (1024 bits) w: H -> G w: H -> G

22. Compare with SPAKA Mutually authenticated channel between Mutually authenticated channel between two servers. two servers. not derive a shared key. not derive a shared key. Client need perform no cryptographic computation, and operation in H. Client need perform no cryptographic computation, and operation in H.

23. Outline Introduction Introduction Previous Work Previous Work New Work New Work Equality-Testing Protocol Equality-Testing Protocol Architectural Motivation Architectural Motivation

24. Architectural Motivation Security in two servers. Security in two servers. * different OSs * different OSs * different organizations * different organizations (privacy outsourcing): (privacy outsourcing): service provider service provider privacy provider privacy provider

25. Architectural Motivation Universality Universality Pseudonymity Pseudonymity Engineering simplicity Engineering simplicity System isolation System isolation Mitigation of denial-of-service attacks Mitigation of denial-of-service attacks

26. Outline Introduction Introduction Previous Work Previous Work New Work New Work Equality-Testing Protocol Equality-Testing Protocol Architectural Motivation Architectural Motivation Avoiding Problems Avoiding Problems

27. Avoiding Problems False Pseudonym Problem False Pseudonym Problem Replay Attacks Problem Replay Attacks Problem