Password authentication Basic idea –User has a secret password –System checks password to authenticate user Issues –How is password stored? –How does system.

Slides:

Advertisements

Similar presentations

Lecture 5: Cryptographic Hashes

Advertisements

Lee Jae-song 1.  How to cryptanalysis DES?  C = E K (P)  E is DES encryption funtion  K is a key, 56-bit.  P is a plaintext, C is a ciphertext, both.

Operating Systems Security 1. The Boot Sequence The action of loading an operating system into memory from a powered-off state is known as booting or.

CSUF Chapter CSUF Operating Systems Security 2.

CS 6262 Spring 02 - Lecture #7 (Tuesday, 1/29/2002) Introduction to Cryptography.

Networks. User access and levels Most network security involves users having different levels of user access to the network. The network manager will.

1 Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell.

CSC 474 Information Systems Security

CMSC 414 Computer and Network Security Lecture 12 Jonathan Katz.

Section 3.2: Operating Systems Security

CS 483 – SD SECTION BY DR. DANIYAL ALGHAZZAWI (7) AUTHENTICATION.

Outline User authentication –Password authentication, salt –Challenge-response authentication protocols –Biometrics –Token-based authentication Authentication.

1 Chapter 11: Authentication Basics Passwords. 2 Establishing Identity Authentication: binding of identity to subject One or more of the following –What.

Sanjay Goel University at Albany, School of Business NYS Center for Information Forensics and Assurance 1 Password Protection.

Sanjay Goel, School of Business/NYS Center for Information Forensics and Assurance University at Albany Proprietary Information 1 Unit Outline Information.

First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown and edited by Archana Chidanandan Cryptographic Tools.

Chapter 5 Cryptography Protecting principals communication in systems.

Authentication John C. Mitchell Stanford University CS 99j.

CSE331: Introduction to Networks and Security Lecture 23 Fall 2002.

BY MUKTADIUR RAHMAN MAY 06, 2010 INTERODUCTION TO CRYPTOGRAPHY.

CMSC 414 Computer and Network Security Lecture 21 Jonathan Katz.

1 Authentication CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 11, 2004.

Outline User authentication

Outline User authentication –Password authentication, salt –Challenge-response authentication protocols –Biometrics –Token-based authentication Authentication.

Outline User authentication –Password authentication, salt –Challenge-response authentication protocols –Biometrics –Token-based authentication Authentication.

CS1001 Lecture 24. Overview Encryption Encryption Artificial Intelligence Artificial Intelligence Homework 4 Homework 4.

Hashes and Message Digest Hash is also called message digest One-way function: d=h(m) but no h’(d)=m –Cannot find the message given a digest Cannot find.

Outline User authentication

Chapter 13: Electronic Commerce and Information Security Invitation to Computer Science, C++ Version, Fourth Edition SP09: Contains security section (13.4)

Password Authentication J. Mitchell CS 259. Password fileUser exrygbzyf kgnosfix ggjoklbsz … kiwifruit hash function.

Chapter 8.  Cryptography is the science of keeping information secure in terms of confidentiality and integrity.  Cryptography is also referred to as.

Cryptography and Network Security Chapter 11 Fifth Edition by William Stallings Lecture slides by Lawrie Brown.

Lecture 3: Cryptographic Tools modified from slides of Lawrie Brown.

Tonga Institute of Higher Education Design and Analysis of Algorithms IT 254 Lecture 9: Cryptography.

Hash Functions A hash function H accepts a variable-length block of data M as input and produces a fixed-size hash value h = H(M) Principal object is.

Slides by Kent Seamons and Tim van der Horst Last Updated: Nov 30, 2011.

CIS 450 – Network Security Chapter 8 – Password Security.

File Protection Mechanisms  All-None Protection Lack of trustLack of trust All or nothingAll or nothing Timesharing issuesTimesharing issues ComplexityComplexity.

David Evans CS200: Computer Science University of Virginia Computer Science Class 35: Cookie Monsters and Semi-Secure.

David Evans CS200: Computer Science University of Virginia Computer Science Class 35: Cookie Monsters and Semi-Secure.

David Evans CS150: Computer Science University of Virginia Computer Science Class 31: Cookie Monsters and Semi-Secure.

Passwords. Outline Objective Authentication How/Where Passwords are Used Why Password Development is Important Guidelines for Developing Passwords Summary.

Brute Force Password Cracking and its Role in Penetration Testing Andrew Keener and Uche Iheadindu.

Introduction to Cryptography Techniques How secure is that banking network traffic?

1 Chapter 11: Authentication Basics Passwords. 2 Establishing Identity Authentication: binding of identity to subject One or more of the following –What.

 Access Control 1 Access Control  Access Control 2 Access Control Two parts to access control Authentication: Are you who you say you are? – Determine.

Dr. Reuven Aviv, Nov 2008 Conventional Encryption 1 Conventional Encryption & Message Confidentiality Acknowledgements for slides Henric Johnson Blekinge.

Slides by Kent Seamons and Tim van der Horst Last Updated: Nov 30, 2011.

Operating Systems Security 1. The Boot Sequence The action of loading an operating system into memory from a powered-off state is known as booting or.

Privacy versus Authentication Confidentiality (Privacy) –Interceptors cannot read messages Authentication: proving the sender’s identity –The Problem of.

Lecture 2: Introduction to Cryptography

24-Nov-15Security Cryptography Cryptography is the science and art of transforming messages to make them secure and immune to attacks. It involves plaintext,

CNIT 124: Advanced Ethical Hacking Ch 9: Password Attacks.

Identification Authentication. 2 Authentication Allows an entity (a user or a system) to prove its identity to another entity Typically, the entity whose.

Lecture 5 User Authentication modified from slides of Lawrie Brown.

King Mongkut’s University of Technology Network Security 8. Password Authentication Methods Prof. Reuven Aviv, Jan Password Authentication1.

DES: Data Encryption Standard

Chapter 12: Authentication Basics Passwords Challenge-Response Biometrics Location Multiple Methods Computer Security: Art and Science © Matt.

Approaches to Intrusion Detection statistical anomaly detection – threshold – profile based rule-based detection – anomaly – penetration identification.

Encryption Encryption: Transforms Message so that Interceptor Cannot Read it –Plaintext (original message) Not necessarily text; Can be graphics, etc.

Operating Systems Security 1. The Boot Sequence The action of loading an operating system into memory from a powered-off state is known as booting or.

Message Authentication Codes CSCI 5857: Encoding and Encryption.

 Encryption provides confidentiality  Information is unreadable to anyone without knowledge of the key  Hashing provides integrity  Verify the integrity.

Chapter Six: Authentication 2013 Term 2 Access Control Two parts to access control Authentication: Are you who you say you are?  Determine whether access.

Department of Computer Science Chapter 5 Introduction to Cryptography Semester 1.

Cryptographic Hash Function. A hash function H accepts a variable-length block of data as input and produces a fixed-size hash value h = H(M). The principal.

Password Authentication

Exercise: Hashing, Password security, And File Integrity

Presentation transcript:

Password authentication Basic idea –User has a secret password –System checks password to authenticate user Issues –How is password stored? –How does system check password? –How easy is it to guess a password? Difficult to keep password file secret, so best if it is hard to guess password even if you have the password file

Basic password scheme Password fileUser exrygbzyf kgnosfix ggjoklbsz … kiwifruit hash function

Basic password scheme Hash function h : strings  strings –Given h(password), hard to find password –No known algorithm better than trial and error User password stored as h(password) When user enters password –System computes h(password) –Compares with entry in password file No passwords stored on disk

Unix password system Hash function is 25xDES –25 rounds of DES-variant encryptions Any user can try “dictionary attack” R.H. Morris and K. Thompson, Password security: a case history, Communications of the ACM, November 1979

UNIX Password System Password line walt:fURfuu4.4hY0U:129:129:Belgers:/home/walt:/bin/csh 25x DES Input Salt Key Constant, A 64-bit block of 0 Plaintext Ciphertext Compare

Advantages of salt Without salt –Same hash functions on all machines Compute hash of all common strings once Compare hash file with all known password files With salt –One password hashed 2 12 different ways Precompute hash file? –Need much larger file to cover all common strings Dictionary attack on known password file –For each salt found in file, try all common strings

Dictionary Attack – some numbers Typical password dictionary – 1,000,000 entries of common passwords people's names, common pet names, and ordinary words. –Suppose you generate and analyze 10 guesses per second This may be reasonable for a web site; offline is much faster –Dictionary attack in at most 100,000 seconds = 28 hours, or 14 hours on average If passwords were random –Assume six-character password Upper- and lowercase letters, digits, 32 punctuation characters 689,869,781,056 password combinations. Exhaustive search requires 1,093 years on average

Backup Slides