Authentication System

Bob can not “see” Alice, so Trudy simply declares Introduction Authentication is the process of reliably verifying the identity of someone (or something). in a network, Bob can not “see” Alice, so Trudy simply declares herself to be Alice “I am Alice”

Kinds of Authentication Password-Based Authentication Symmetric key Based Authentication Public-Key Based Authentication

Password-Based Authentication Attaining the benefits of cryptographic authentication with the user being able to remember passwords only Problems of password protocols: Eavesdropping Password guessing attack On-line password guessing Off-line password guessing

Encrypted Key Exchange (EKE) Key establishment as well as authentication One of the W{.} may possibly be removed. In that case, the non-encrypting side should not issue the first challenge. (Why not?) Alice Bob “Alice”, W{EA} W{EA{KAB}} KAB{CA} KAB{CA, CB} KAB{CB}

EKE with Diffie-Hellman Why are ga, gb encrypted? (authentication) Alice Bob “Alice”, W{ga mod p} (KAB = gab mod p) KAB{CA, CB} KAB{CA} W{gb mod p}, CB

Augmented EKE EKE vulnerable to database disclosure (since server has to store W) Augmented EKE: defense against this threat Client has to know the password. Server stores a one-way derivation of it.

Augmented EKE with Diffie-Hellman Server stores gW mod p How does this protocol protect against database disclosure? Why is this protocol not secure? Alice Bob “ Alice”, ga mod p gb mod p, H(gab mod p, gbW mod p) H’(gab mod p, gbW mod p)

Secure Remote Password (SRP) Secure Remote Password Protocol Thomas Wu Notation

Protocol To establish a password P with Steve, Carol picks a random salt s, and computes . Carol Steve

Off- vs. On-Line Password Guessing On-line password guessing attack: Type passwords at the system that is going to verify the password. The system can make it impossible to guess too many passwords in this manner. Ex: ATM. The system can be designed to be slow, so as not to allow very many guesses per unit time.

Off-line password guessing attack: Dictionary attack An attacker guesses a password and verifies his guess off-line. If his guess fails the attacker tries again with another password, until he finds the proper one.

Symmetric key based Authentication Both Entity using a secret key k, |k|>64 Not need CA. Compare with PASSWORD BASE user need not to input password More faster Must store KEY More security in theory In 1994, Bellare, Rogaway present Entity Authencation and Key Distribution The MAP1, and AKEP1 are more important. MAP1 has Matural Authentcation AKEP1 add the part of Key Exchange

MAP1 Suppose the entities Alice and Bob share a secret key . Alice RA [B, A, RA, RB] [A, RB] 

AKEP1

we assume the entities A and B share secret keys  and .  is the session agreed after the protocol. Alice Bob RA [B, A, RA, RB, {} ] [A, RB] 