1. Exercise: Password Auditing
2016 GenCyber JMU Bootcamp for High School Teachers

2. The IFF Problem Identify friend or foe (IFF) “Who is there?
F22 stealth bomber
“Who is there?
Identify yourself”
“I am your friend. Do not shoot me!”

3. Entity Authentication
Verification
F22 stealth bomber
Prove it!
“Who the heck are you?”

4. Authentication Factors
How to authenticate an entity?
Something that you know {proof by knowledge}: password, PIN code, combinations to locks
Something that you have {proof by possession} : physical key, membership card, cell phone Security Identity Module (SIM) card, smart card, hardware token: USB token, smart card
Something that you are {proof by property; physical characteristic recognition (PCR)}  biometric
Something that you do (behavioral characteristic recognition [BCR]): writing speed, writing pressure, typing speed/intervals between key strokes  biometric
The place that you are: IP address (on-line digital database: ACM, IEEE, Springer), location by Global Positioning System (GPS)
Easy to revoke
Sharable
Easy to revoke
Transferable
This slide lists five different levels of authentication.
Hard to revoke
Non-transferable

5. Password Authentication: Necessary Evil
PVD v w
Alice memorizes a password
Computer stores password verification data (PVD, password verifier)
Local authentication
Alice gives her password to the computer for authentication
In a password-based authentication system, a client memorizes a password and a server stores the related password verification data (PVD). Typically, the password verification data is the hash of the password, user ID and a random salt (a public value).

6. Remote Password Authentication
PVD v
Harder
v has to be calculated from w
Many ways
Microsoft Windows: LM, NTLM
Linux
Database
On the web
How does the one-time password scheme work?
After Alice picks a reusable password, p, the server picks an integer n and calculates the PVD as hn(p). Please pay attention to the definition of hn(p)
The server stores both n and PVD.

7. What will we do in this exercise?
PVD v
A bad guy steals v from (MS Windows, MySQL database)
Can the bad guy recover w?
How to make it harder for the bad guy?
How does the one-time password scheme work?
After Alice picks a reusable password, p, the server picks an integer n and calculates the PVD as hn(p). Please pay attention to the definition of hn(p)
The server stores both n and PVD.