1. Lecture 11: Strong Passwords
problem statement
Lamport’s hash
encrypted key exchange (EKE)
secure credentials download

2. Strong Password Protocols
Obtaining the benefits of cryptographic authentication with the user being able to remember passwords only
in particular:
no security information is kept at the user’s machine (the machine is trusted but not configured)
someone impersonating either party will not be able to obtain information for off-line password guessing (online password guessing is not preventable)

3. Lamport’s Hash
Bob stores <username, n, hn(password)>, n is a relatively large number, like 1000
Alice’s workstation sends hn-1(password)
if successful, n is decremented, hn-1 replaces hn in Bob’s database
Alice, password
Alice
Alice’s terminal n
Alice
Bob
hn-1(password)
why is sequence of hash transmissions reverse? because hash is one-way, if Trudy sees hn-1(password) she will not be able to find hn-2(password)
trusted
not trusted
why is sequence of hash transmissions reverse?
properties:
safe against eavesdropping, database reading
no authentication of Bob

4. Salting Lamport’s Hash
hn-1(pwd|salt) is used for authentication
salt is stored at Bob’s at setup time, Bob sends salt each time along with n
advantages:
Alice can use the same password with multiple servers, why?
what may happen if two servers pick the same salt?
to ensure that the salt is different, servers name is also hashed in
easy password reset (when reaches 1) – just change the salt
defense dictionary attacks
how would Trudy mount a dictionary attack without the salt?
Alice can use the same password with multiple servers, why? if servers use different salt the hashes look different
what may happen if two servers pick the same salt? Trudy can remember the hash, and when she predicts that the second server ask for the same N
she supplies the hash
how would Trudy mount a dictionary attack without the salt? compiles hashes of all the words in the dictionary starting from 1000

5. Lamport’s Hash: Other Properties
small n attack
when Alice tries to login Trudy impersonates Bob and sends n’ < n and Bob’s salt, when Trudy gets the reply she can impersonate Alice after n is decremented to n’
defense: Alice’s workstation presents submitted n to Alice to verify the “approximate” range (Alice has to remember it)
“human and paper” environment
in case Alice workstation is not trusted or too “dumb” to do hashing
Alice is given a list of all hashes starting from 1000, she uses each hash exactly once
automatically prevents small n attack
string size – 64 bits (~10 characters) is secure enough
implemented as S/Key and standardized as one-time password system

6. Encryption-with-Password Protocols
share weak secret W = f(pwd)
“Alice”
Alice
Bob
challenge C
W{C}
dictionary attack, how? from C & W{C}
problems:
dictionary attack, how?
server database disclosure

7. share weak secret W = f(pwd)
Enhanced with PKC:
(EA&DA: per-session public/private key pair)
Why not possible with secret key encryption?
What is the weakness in this protocol?
share weak secret W = f(pwd)
“Alice”, W{EA}
Alice
Bob
EA{C}
W{C}

8. Encrypted Key Exchange (EKE)
key establishment as well as authentication
EA&DA: per-session public/private key pair
KAB – symmetric session key
one of the W{.} may possibly be removed.
In that case, the non-encrypting side should not issue the first challenge, why?
“Alice”, W{EA}
W{EA{KAB}}
KAB{CA}
In that case, the non-encrypting side should not issue the first challenge, why? reflection attack
Alice
Bob
KAB{CA, CB}
KAB{CB}

9. Encrypted Key Exchange (EKE)
what’s encrypted by weak key is ga, gb (which looks like a random number) – straightforward dictionary attack is impossible
“Alice”, W{ga mod p}
W{gb mod p, CA}
can compute KAB = gab mod p
Alice
Bob
KAB{CA, CB}
KAB{CA}

10. Augmented EKE
EKE vulnerable to database disclosure since Bob stores W in clear
what’s the possible attack?
defense: Augmented EKE – Alice knows the password, Bob knows a one-way hash of it
Bob stores: gW mod p
Alice
Bob
“Alice”, ga mod p
gb mod p, H(gab mod p, gbW mod p)
H’(gab mod p, gbW mod p)
what’s the possible attack? if Trudy steals Alice’s password from Bob, Trudy can impersonate Alice

11. Secure Credentials Download
credential: Y – quantity used for authorization (to prove one’s identity) – something like a private key
problem: download Alice’s credential to Alice’s workstation when Alice only knows her password
“Alice”, W{ga mod p}
what’s the possible attack? if Trudy steals Alice’s password from Bob, Trudy can impersonate Alice
Alice
Bob
stores “Alice”, W, Y
gb mod p, (gab mod p){Y}