Duress Detection for Authentication Attacks Against Multiple Administrators Emil Stefanov UC Berkeley Mikhail Atallah Purdue University

Remedies for Authentication Attacks Guessing passwords o Require strong passwords. Eavesdropping o Encrypt traffic (e.g., TSL/SSH). Man in the middle o Pre-shared secrets, certificate based authentication. Spyware o Intrusion detection systems / antivirus Phishing o TSL, web filters. Shoulder surfing o Common sense. Physical Coercion o Duress Detection

Physical Coercion Alice has an account on a server. To use the server she must log in with her password. One day, Oscar threatens Alice and demands to know her password.

Duress Signaling What should Alice do? o Provide the correct password? Oscar wins. o Refuse to cooperate? Oscar carries out his threat. o Provide an invalid password? Oscar tries the password and determines that Alice refused to cooperate. o Provide a duress password? The attacker logs in but unknowingly signals a silent alarm.

Duress Password What should it look like? o Let’s review a few possibilities.

Two-Password Schemes

N-Password Schemes

PIN Schemes Alice has: o A strong password (e.g., “VHz3xK*bL8”) This must be correct during normal and duress authentications. o A PIN (e.g., “8394”) Alice uses her PIN for a normal authentication. She gives Oscar any other PIN during duress. Advantages? o Less for Alice to remember. o Oscar’s probability of success is low. Problems? o Recall attack – Oscar can ask her to repeat the PIN later. Alice might forget the PIN she gave Oscar. o Typos – Easy to mistype a PIN and cause a false alarm.

Our Approach We split the authentication secret into two: o A strong password – just like usual. o A keyword from a dictionary. Carefully choose a keyword dictionary. o Specify requirements. o Give an example. Allows for Alice to be an administrator. o Has access to the password/keyword store. o Can intercept network traffic. Allows multiple users/administrators. o Alice, Bob, etc.

Login Screen

Single Administrator Scheme A single administrator (Alice) is being attacked. Server stores passwords and keywords (hashed & salted). Incorrect keyword  server notifies authorities.

Single Administrator Scheme Problem: o Oscar gains administrator access. o Oscar can verify the keyword. Solution: 1.The server notifies the authorities. 2.The server overwrites the correct keyword.

Single Administrator Scheme Not secure for multiple administrators! Attack: Alice and Bob are administrators. Oscar attacks both of them. Oscar authenticates as one of them and checks the keyword of the other one. o Solution? Our multiple administrator scheme.

Multiple Administrator Scheme Oscar attacks Alice. Alice provides a correct password and an incorrect keyword. The server receives the credentials.

Multiple Administrator Scheme Authentication server: o Has purposely “forgotten” the correct keyword. o Creates a privacy-preserving record. o Sends it to the monitoring server.

Multiple Administrator Scheme Monitoring server: o Checks the authentication record. o If duress  notifies monitoring personnel.

Multiple Administrator Scheme Monitoring personnel: o Notify the authorities. Similar to existing alarm system companies.

Key ideas: o The authentication server never knows the correct keyword. o The monitoring server can only decrypt duress authentication records. o Keywords are picked from a carefully selected dictionary (more on this later). Multiple Administrator Scheme

Keyword Dictionary Requirements Well defined o Implicitly defined by a topic. o Alice can randomly pick a keyword by only memorizing the topic. Hard to make a typo o Large edit distance between keywords.

Keyword Dictionary Example: U.S. States #KeywordClosest KeywordEdit Distance 1arkansaskansas2 2 arkansas2 3northcarolinasouthcarolina2 4northdakotasouthdakota2 5southcarolinanorthcarolina2 6southdakotanorthdakota2 7alabamaAlaska3 … 45rhodeislandlouisiana6 46washingtonmichigan6 47newhampshirenewmexico7 48connecticutkentucky8 49pennsylvaniaindiana8 50massachusettsarkansas9

Performance Authentication TimeMonitoring Time 1024-bit Keys ms0.125 ms 2048-bit Keys ms0.671 ms 3072-bit Keys ms2.075 ms 4096-bit Keys ms6.318 ms