1. Humanity versus Entropy: Problems with Keeping a Secret Eamon Johnson CWRU Math 408, Spring 2012 Project Presentation

2. Problem Statement Password: a secret used for authentication An ideal secret has a few qualities: – Hard to guess (high entropy) – Easy to remember – Easy to communicate – Easy to change Question: can entropy be increased without increasing difficulty of remembering, communicating, and changing the secret? 2

3. Background Real-time password complexity feedback increases entropy while making passwords harder to remember Other sources of personal entropy: – Things you know – Things you have – Things you are 3

4. Problems with Keeping a Secret Two underlying problems affect all practical sources of entropy: Limited Entropy – Misestimated entropy – Unchangeable secrets Single Point of Failure 4

5. Sources of Limited Entropy Imagination and Memory Personal Information – Personal Knowledge Questions – Shared History Biometrics – Information security versus authentication accuracy – Physical properties and behavioral properties 5

6. Delegation to a Single Point of Failure Secret Algorithms – Violations of Kerckhoffs's principle Off-line / Out-of-band Storage – Paper in your wallet External Technology – Physical Devices: Fobs, tokens, cards – Networked Services: single sign-on, OpenID 6

7. Combining Sources of Entropy All practical sources of entropy have well- known weaknesses, so they are often used in combination: multi-factor authentication Combination of schemes incurs a cost – Technology cost – Communication difficulty Question: how valuable is the secret? 7

8. Quantifying the Value of a Secret A secret has value by proxy when it is used to protect assets of value What is an asset worth? – Cost to return to a pre-compromise state – Time to return to a pre-compromise state – Asset value may fluctuate over time A secret-keeping mechanism has costs: – One time – Recurring 8

9. Proposal: Tiered Security 9

10. Example: Tiered Security 10 TierAsset ClassAsset ExamplePolicy 1Private informationMedical records, financial records Password in wallet, never cached 2Semi-private informationEmail access, Facebook access Password in wallet or device cache 3Useless / incorruptible information Rewards card login (only used to add points) Reused password Example tiers for personal information assets

11. Conclusion All practical sources of entropy are flawed: – Limited Entropy – Single Point of Failure Entropy must be bought Assuming acceptable risk is constant, the cost of applying the right security is the only manageable component 11

12. 12 R. Munroe 2011, http://xkcd.com/936