March R. Smith - University of St Thomas - Minnesota QMCS Class Today Authentication ReduxAuthentication Redux Some more biometrics slidesSome more biometrics slides Challenge Response authenticationChallenge Response authentication Token based authenticationToken based authentication

March R. Smith - University of St Thomas - Minnesota Elements/Actors PrincipalPrincipal CharacteristicCharacteristic ProprietorProprietor Authentication mechanismAuthentication mechanism Access control mechanismAccess control mechanism –Examples 40 thieves40 thieves PasswordsPasswords ATMATM Web serverWeb server

March R. Smith - University of St Thomas - Minnesota Strategies Standards of due careStandards of due care Risk analysisRisk analysis Exceed industry practicesExceed industry practices

March R. Smith - University of St Thomas - Minnesota Average Attack Space If the attack “tries” X times, thenIf the attack “tries” X times, then There is a 50% chance of success.There is a 50% chance of success. Usually tied to the size of a base secretUsually tied to the size of a base secret

March R. Smith - University of St Thomas - Minnesota Biometrics: Recap Measure physical trait: finger, hand, eye, face, … From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Some Based on Behavior Measure something the person does, instead of measuring a physical traitMeasure something the person does, instead of measuring a physical trait Examples: voice, keystrokes, written signatureExamples: voice, keystrokes, written signature From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Biometric Matching Compares user’s signature to previously established pattern built from that traitCompares user’s signature to previously established pattern built from that trait Pattern and signature contents vary according to the biometric and the implementationPattern and signature contents vary according to the biometric and the implementation From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Pattern Matching We compare how closely a signature matches one user’s pattern versus another’s patternWe compare how closely a signature matches one user’s pattern versus another’s pattern From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Matching in Practice You should often match yourself and rarely match others From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Matching Self vs. Others It’s possible that an imposter will sneak through From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Biometric Strength

March R. Smith - University of St Thomas - Minnesota More about Passwords …

March R. Smith - University of St Thomas - Minnesota Password Ping-Pong AttacksDefenses PasswordsSteal the Password File Password HashingGuessing Guess DetectionSocial Engineering Help Desk RestrictionsKeystroke Sniffing Memory ProtectionPassword Sharing Password TokensNetwork Sniffing One-Time Passwords ??

March R. Smith - University of St Thomas - Minnesota Guessable Passwords

March R. Smith - University of St Thomas - Minnesota Strength in Practice

March R. Smith - University of St Thomas - Minnesota Sniffing Trumps Strength From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Interactive Challenge Requires a calculator (hardware or software)Requires a calculator (hardware or software) Base secret is embedded in the calculatorBase secret is embedded in the calculator Authenticates the owner of the base secretAuthenticates the owner of the base secret From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Embedded Challenge Login client handles challenge automatically (DEC, Novell)Login client handles challenge automatically (DEC, Novell) The password is the base secretThe password is the base secret From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Tokens for Authentication Something you have that’s hard to copySomething you have that’s hard to copy –Attacker needs to steal it to log on –I can’t tell if someone has sniffed my password, but I can tell immediately if someone has stolen my token From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Hardware Tokens Resist copying and other attacks by storing the base secret in a tamper-resistant package.Resist copying and other attacks by storing the base secret in a tamper-resistant package. From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota One-Time Password Tokens Attacker can’t reuse the sniffed password From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Combination Product Fingerprint used locally to “unlock” the token From Authentication © Used by permission

March R. Smith - University of St Thomas - Minnesota Average Attack Space for Tokens For “Off Line”For “Off Line” –This is to clone someone’s token –Figure out the size of the base secret –Use that as the number of trials –Applies to all tokens For “On Line”For “On Line” –This is to crack into the server without cracking the token –Figure out the size of the one time password –Use that as the number of trials –Applies to all tokens/users/attacks

March R. Smith - University of St Thomas - Minnesota Creative Commons License This work is licensed under the Creative Commons Attribution-Share Alike 3.0 United States License. To view a copy of this license, visit or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA.