Download presentation
Presentation is loading. Please wait.
Published byAmelia Riley Modified over 10 years ago
1
Tuomas Aura T-110.4206 Information security technology User authentication Aalto University, autumn 2011
2
Outline 1.Passwords 2.Physical security tokens and two-method authentication 3.Biometrics Common mantra: User authentication can be based on – something you know – something you have – something you are 2
3
PASSWORDS 3
4
Username and password Passwords are used for entity authentication – Needed for access control and auditing: access control = authentication + authorization – Entity authentication vs. message authentication Password is a shared secret between the user and computer system – Limitations arise from the reliance on of human memory and input What attacks are there against passwords? 4
5
Sniffing and key loggers Password sniffing on the local network used to be a major problem; mostly solved by cryptographic authentication: – SSH, SSL, HTTP Digest Authentication, MS-CHAPv2 Key logger: software or hardware that stores all key strokes (including passwords) typed on a computer – Particular danger in public-access computers e.g. at libraries and cafes – Why do some bank web sites ask you to use the mouse to enter the PIN code? 5
6
Password recovery Humans are prone to forget things need a process for recovering from password loss What are the advantages and disadvantages of the following recovery mechanisms? – Security question or memorable secret, e.g. birth place, mother’s maiden name, pet’s name – Emailing password to another user account – Physical visit to helpdesk – Yellow sticker on the back of the keyboard – USB key or CD with a password recovery file 6
7
Password reuse How many different user accounts and passwords do you have? Ever used the same password on two accounts? Using the same or related passwords on multiple accounts means that one corrupt sysadmin or compromised account can lead to compromise of the other accounts Administrative countermeasures: – Passwords chosen by the service, not set by users – Exotic password format requirements Personal countermeasures: – Generating service-specific passwords from one master password – Password wallet (e.g. on phone) encrypted with a master password 7
8
Shoulder surfing Keyboards and screens are highly visible others may see what you are typing Password and PIN prompts usually do not show the characters – Does this make sense for all secrets? 8 *******
9
Password guessing Intelligent guessing vs. brute-force guessing – dictionary attack Countermeasures – Limit the number or rate of login attempts – Minimum password length and complexity, password quality check – Preventing reuse of old passwords – System-generated random passwords – Password aging i.e. mandatory periodic password changes (typically every three months) 9
10
Password entropy Entropy = the amount of information the attacker is missing about the password Entropy = - ∑ x ∈ passwords P(x) ⋅ log 2 P(x) ≤ log 2 (number of possible passwords) Examples: – Random 8-character 7-bit passwords have 56 bits of entropy – Random 8-character alphanumeric passwords have at most 8 × log 2 (26+26+10) ≈ 48 bits – 4-digit PIN codes have about 13 bits of entropy Human-chosen passwords have less entropy than random ones because some passwords are more common than others Do password quality checks increase entropy? Passwords rely on human memory entropy cannot grow over time any system that relies on high password entropy to beat brute-force attacks will eventually fail 10
11
Online and offline guessing attacks Offline attack: the attacker obtains a hash (or other function) of the password and tries to guess the password offline – Attacker who has the hash values from the password database – Older challenge-response network authentication, e.g. MS-CHAPv2 or HTTP digest authentication (without SSL) Online guessing: attacker tries to login with different passwords – Login prompt at the console; PIN code on a phone – Network login to an authenticated server over SSH or SSL – Firewall blocks client IP address after some failed login attempts In offline attack, the attacker can perform an exhaustive brute-force search; in online attack, target system can limit the number of guesses Big difference in the required password entropy: – Online guessing success probability ≈ number of allowed guesses / number of possible passwords – Offline attack requires cryptographic strength, e.g. 128-bit entropy 11
12
Password database storage Safer to assume that the database is public – Unix /etc/password is traditionally world readable – Attacks on web servers often manage to dump any file or database on the server; e.g. SQL injection How to store passwords in a public file? – Store a hash (i.e. one-way function) of the password – When user enters a password, hash and compare – Use a slow hash (many iterations of a hash function) to make brute-force cracking more difficult – Include random account-specific “salt”: slow_hash( password | salt) to prevent simultaneous brute-force cracking of many passwords, precomputation attacks and equality comparison between passwords 12
13
Password hashing Password-based key derivation function PBKDF2 [PKCS#5,RFC2898]** – Good practical guide; uses any standard hash function, at least 64-bit salt, any number of iterations Unix crypt(3) [Morris and Thompson 1978]** – Historical function for storing passwords in /etc/passwd aura:lW90gEpaf4wuk:19057:100:Tuomas Aura:/home/aura:/bin/zsh – Eight 7-bit characters = 56-bit DES key – Encrypt a zero block 25 times with modified DES – 12-bit salt used to modify DES key schedule – Stored value includes the salt and encryption result – Replaced by more modern hash functions and shadow passwords (stored in /etc/shadow, which is only readable to root) 13
14
DF2PBK PBKDF2 (P, S, c, dkLen) P = password S = salt c = iteration count dkLen = length of the result PRF = keyed pseudorandom function F (P, S, c, i) = U 1 xor U 2 xor... xor U c U 1 = PRF (P, S || i) U 2 = PRF (P, U 1 )... U c = PRF (P, U c-1 ) Repeat for i=1,2,3... until dkLen output bytes produced 14 Function for slow hashing of passwords Iterations to make the computation slower Used in WPA2- Personal for deriving keys from password Could also be used for storing password hashes Function for slow hashing of passwords Iterations to make the computation slower Used in WPA2- Personal for deriving keys from password Could also be used for storing password hashes
15
Botnets and online guessing 10 banks, each with 10 6 customer accounts – 4-digit PIN or one-time code required to log in – Client IP address blocked after 3 failed login attempts Attacker has a botnet of 10 5 computers – Each bot makes one login attempt to one account in each bank every day 10 6 login attempts in a day ~100 successful break-ins in a day Countermeasures: – Make user IDs hard to guess; long, different from account numbers, and not assigned sequentially – Ask a “salt” question, e.g. memorable word, in addition to user ID and PIN increased entropy reduces attacker success rate 15
16
One-time passwords Use each password only once to thwart password sniffers and key loggers Lamport hash chain: H 1 = hash (secret seed); H i+1 = hash (H i ) – Server stores initially H 100 and requires user to enter H 99. Next stores H 99 and requires H 98, and so on. Unix S/KEY or OTP [RFC1760/1938] 1: HOLM BONG VARY TIP JUT ROSY 2: LAIR MEMO BERG DARN ROWE RIG 3: FLEA BOP HAUL CLAD DARK ITS 4: MITT HUM FADE CREW SLOG HAST Hash-based one-time passwords HOTP [RFC4226] HOTP(K,C) = HMAC-SHA-1(K,C) mod 10 D – Produces a one-time PIN code of D decimal digits Time-based one-time passwords – E.g. RSA SecurID: one of many commercial products Which attacks are prevented by one-time passwords and which are not? 16
17
Spoofing attacks Attacker could spoof the login dialog; how do you know when it is safe to type in the password? 17
18
│
19
Trusted path Attacker could spoof the login dialog; how do you know when it is safe to type in the password? Trusted path is a mechanism that ensures direct and secure communication between the user and a specific part of the system – Crtl+Alt+Del in Windows takes to a security screen that cannot be spoofed – Web browser shows the URL in the address bar in a way that cannot be spoofed by the web server With malware and virtualization, it is increasingly hard to know what is real 19
20
Other threats No system is perfectly secure: system designers have a specific threat model in mind, but the attacker can break these rules – “The attacker does not agree with the threat model.” (Bruce Christianson) Other attacks against PINs and passwords: – Phishing and social engineering – Heat camera can detect recently pressed keys – Acoustic emanations from the keyboard 20
21
PHYSICAL SECURITY TOKENS AND TWO-METHOD AUTHENTICATION 21
22
Physical security tokens Smart card is a typical physical security token – Holds cryptographic keys to prove its identity – Tamperproof: secret keys will stay inside Used for door keys, computer login, ATM PIN entry is often also required two-method authentication – Attacker needs to both steal the card and learn the PIN clear qualitative increase in security Other security token implementations: smart button, USB stick, mobile phone 22
23
Issues with security tokens Physical tokes require distribution Computers (or doors etc.) must have readers It is not easy to integrate cryptographic tokens to all systems – E.g. applications that require a password cached on the client or on a proxy server Process needed for recovering from the loss of tokens Are smart card + PIN really two factors? One alternative is two-channel authentication: – Confirmation via telephone: callback – Sending a second secret to a known address: text message, email, post 23
24
BIOMETRICS 24
25
Biometric authentication Biometric authentication means verifying some physical feature of the user – Physiological characteristic: photo, signature, face geometry, fingerprint, iris scan, DNA – Behavioral characteristic: voice, typing, gait Biometrics are not 100% reliable: – False acceptance rate FAR – False rejection rate FRR – Equal error rate EER 25 FARFRR 50% EER
26
Issues with biometrics Biometrics require enrollment and readers Unsupervised vs. supervised readers have a big difference in security – E.g. fingerprints, face recognition Suitability for security architectures: – Are biometric characteristics secrets? – Can they be copied? – How to revoke biometrics? What if enrollment fails? – Some people have no fingerprints, or no fingers 26
27
Reading material Dieter Gollmann: Computer Security, 2nd ed., chapter 3 Matt Bishop: Introduction to computer security, chapter 11 Ross Anderson: Security Engineering, 2nd ed., chapters 2, 15 Edward Amoroso: Fundamentals of Computer Security Technology, chapters 18-19 27
28
Exercises Why do you need both the username and password? Would not just one secret identifier (password) be sufficient for logging in? What effect do strict guidelines for password format (e.g. 8 characters, at least 2 capitals, 2 digits, 1 special symbol) have on the password entropy? What is the probability of guessing the code for a phone that allows 3 attempts to guess a 4-digit PIN code, then 10 attempts to guess an 8-digit PUK code? In what respects is PBKDF2 better for password hashing than crypt(3)? Why may mandatory password changes increase security? What is the optimal interval? How to limit the number of login attempts without creating a DoS vulnerability? Learn about graphical passwords and compare their entropy to different length passwords and PIN codes. Learn about HTTP Digest Authentication [RFC2617] and MS-Chap-V2 [RFC2759]. Explain how to perform an offline password guessing attack after sniffing a login. In a social network, could authentication be based on who you know (or who knows you), or where you are? What advantages and disadvantages might a fingerprint reader have in a car lock? 28
Similar presentations
© 2025 SlidePlayer.com Inc.
All rights reserved.