CSCE 201 Identification and Authentication Fall 2015

CSCE Farkas2 Required reading list: – An Introduction to Computer Security: The NIST Handbook, : Chapter 16, IDENTIFICATION AND AUTHENTICATION, pages Recommended: – Biometrics, from Wikipedia, the free encyclopedia, – John the Ripper password cracker – Brutus the remote password cracker

CSCE Farkas3

4 Identification Something you know Something you own Who you are What you are Where you are

CSCE Farkas5 Identification Allows an entity (a user or a system) to prove its identity to another entity Typically, the entity whose identity is verified reveals knowledge of some secret S to the verifier Strong authentication: the entity reveals knowledge of S to the verifier without revealing S to the verifier

CSCE Farkas6 Identification Information Must be securely maintained by the system.

CSCE Farkas7 Authentication Authentication mechanism: verifies the identification information Access control mechanism: grant privileges upon successful authentication Logging: record security relevant events in an audit trail

CSCE Farkas8 Authentication Requirements Network must ensure – Data exchange is established with addressed peer entity not with an entity that masquerades or replays previous messages Network must ensure data source is the one claimed

CSCE Farkas9 Passwords Commonly used method For each user, system stores (user name, F(password)), where F is some transformation (e.g., one-way hash) in a password file – F(password) is easy to compute – From F(password), password is difficult to compute – Password is not stored in the system When user enters the password, system computes F(password); match provides proof of identity

CSCE Farkas10 Vulnerabilities of Passwords Inherent vulnerabilities – Easy to guess or snoop – No control on sharing Practical vulnerabilities – Visible if unencrypted in distributed and network environment – Susceptible for replay attacks if encrypted naively Password advantage – Easy to modify compromised password.

CSCE Farkas11 Attacks on Password Guessing attack/dictionary attack Social Engineering Sniffing Trojan login Van Eck sniffing

CSCE Farkas12 Social Engineering Attacker asks for password by masquerading as somebody else (not necessarily an authenticated user) May be difficult to detect Protection against social engineering: strict security policy and users’ education

CSCE Farkas13 Password Management Policy Educate users to make better choices Define rules for good password selection and ask users to follow them Ask or force users to change their password periodically Actively attempt to break user’s passwords and force users to change broken ones Screen password choices

CSCE Farkas14 One-time Password Use the password exactly once!

CSCE Farkas15 Time Synchronized There is a hand-held authenticator – It contains an internal clock, a secret key, and a display – Display outputs a function of the current time and the key – It changes about once per minute User supplies the user id and the display value Host uses the secret key, the function and its clock to calculate the expected output Login is valid if the values match

CSCE Farkas16 Time Synchronized Secret key Time One Time Password Encryption

CSCE Farkas17 Challenge Response Work station Host Network Non-repeating challenges from the host is used The device requires a keypad User ID Challenge Response

CSCE Farkas18 Challenge Response Secret key Challenge One Time Password Encryption

CSCE Farkas19 Devices with Personal Identification Number (PIN) Devices are subject to theft, some devices require PIN (something the user knows) PIN is used by the device to authenticate the user Problems with challenge/response schemes – Key database is extremely sensitive – This can be avoided if public key algorithms are used

CSCE Farkas20 Smart Cards Portable devices with a CPU, I/O ports, and some nonvolatile memory Can carry out computation required by public key algorithms and transmit directly to the host Some use biometrics data about the user instead of the PIN

CSCE Farkas21 Biometrics Fingerprint Retina scan Voice pattern Signature Typing style

CSCE Farkas22 Problems with Biometrics Expensive – Retina scan (min. cost) about $ 2,200 – Voice (min. cost) about $ 1,500 – Signature (min. cost) about $ 1,000 False readings – Retina scan 1/10,000,000+ – Signature 1/50 – Fingerprint 1/500 Can’t be modified when compromised

CSCE Farkas23 Home Computer Security

CSCE Farkas24 Problem: You don’t remember your password Solutions: 1. Verify that you have typed the letters of your password in the correct case 2. Access a password hint on the Welcome screen 3. Use a password reset disk 4. Log on as administrator to assign a new password to your account

CSCE Farkas25 Password Case Sensitivity Check CAPS LOCK key Question: Why do you want to use combination of symbols for your password?

CSCE Farkas26 Using the Password Reset Disk Create a password reset disk for your user account at the earliest opportunity How to use the password reset disk – Microsoft Windows remembers if you have created a password reset disk. Just click use your password reset disk – Follow the instructions of the Password Reset Wizard Question: Why should you safeguard your password reset disk?

CSCE Farkas27 Use a Password Hint Create a password hint: – Log on to your computer – Click Start, and then click Control Panel – Double-click User Accounts – Click your user account, and then click Change my password – Enter your current password, enter a new password, and then enter the new password again to confirm it – Enter the password hint, and then click Change Password – The change will take effect the next time that you log on To display the hint, click the question mark (?) that is next to your user account

CSCE Farkas28 Create a Password Reset Disk Click Start, and then click Control Panel Double-click User Accounts Click your user account, and then click Prevent a forgotten password. The Forgotten Password Wizard starts Follow the instructions NOTE: A password reset disk is valid until you create a new one; even if you change your password

CSCE Farkas29 Next Class Cyber stalking, Fraud and Abuse