DOC PREVIEW
Purdue CS 42600 - Lecture notes

This preview shows page 1-2-3 out of 10 pages.

Save
View full document
View full document
Premium Document
Do you want full access? Go Premium and unlock all 10 pages.
Access to all documents
Download any document
Ad free experience
View full document
Premium Document
Do you want full access? Go Premium and unlock all 10 pages.
Access to all documents
Download any document
Ad free experience
View full document
Premium Document
Do you want full access? Go Premium and unlock all 10 pages.
Access to all documents
Download any document
Ad free experience
Premium Document
Do you want full access? Go Premium and unlock all 10 pages.
Access to all documents
Download any document
Ad free experience

Unformatted text preview:

1Computer SecurityCS 426Lecture 6Entity AuthenticationElisa BertinoPurdue UniversityIN, [email protected]• Entity Authentication• Password-based authentication• Challenge-response authentication• Digital certificateSecurity mechanisms -Authentication• Authenticating an object (data/message) means confirming its provenance, whereas authenticating an individual/an entity consists of verifying his/her/its identity• Entity authentication: in computer security, entity authentication is the process of attempting to verify the digital identity of another party. • An entity can be a person, a process/program, a machine:– For example, SSL authenticates the client (program) to the server application (and possibly viceversa). ) SSL does not authenticate the client’s user to the application running on the server.Security mechanismsIdentificationAuthenticationAuthorizationAllow the requesting entity to perform the requested action against the requested resource.Please demonstrate me that: -- you are you who you claim to be OR- what you are claiming is trueWho are you?Where are you from? (IP packets)2Authentication• The entity whose identity needs to be proved is called the claimant• The party that tries to prove the identity of the claimant is called the verifier• Entity authentication can be:– Unidirectional– Bidirectional (for example SSL when it authenticates the client (program) to the server application and viceversa).ExampleBankWeb siteUserPCUser name (Logon)Password?The claimantThe verifierData-origin vs. Entity Authentication• Message (data origin) authentication might not happen in real time, entity authentication does:– When BOB authenticates a message (for example an e-mail) from Alice, Alice might not be connected to her e-mail system. – When Alice tries to access the Bank web site, or she gets cash from an ATM, the Bank web site/ATM must perform Alices’authentication before allowing any other message to be exchanged. • Goal of authentication:– Message (data origin) authentication must be repeated for each message– Entity authentication authenticates the claimant for the entire duration of a sessionAuthenticationThe entity authentication process can be based on:• Something known (to the claimant and to the verifier): a password, a PIN, a secret key• Something possessed by the claimant: one-time password token, a mobile phone, a smart-card/USB token• Something inherent to the claimant: fingerprints, voice, facial characteristics, retinal pattern, vein pattern (biometrics)The above authentication factors can be combined to achieve multi-factor authentication39Authentication mechanismsEntity authentication mechanisms:• Username/password– Fixed password– One-Time password• Challenge Response– Using symmetric key– Using asymmetric keys10Fixed password• A password is associated with each user which remains valid for a certain period of time(usually defined by the organizations’ policy):– The password is not generated on a per-access request• The verifier must store the user name and his/her associated password (information at rest)• The password is stored as plaintext at the verifier site• To perform the authentication, the claimant transmits the password over the network (information in transit)ExampleBankWeb siteUserPCUser name (Logon)Password?The claimantThe verifierFixed passwordpossible attacks and vulnerabilities• Attack1 - Eavesdropping:– Case 1: At the user PC (Eve can watch Alice when she types the password)– Case 2: Over the network (sniffing)• Vulnerabilities leading to attack 1:– Case 1: Eve trusts Alice– Case 2: the password is sent as plaintext (unencrypted) over the network• Countermeasures:– Case 1: Alice should not trust Eve– Case 2: encrypt the password when sending it over the network4• Attack 2 – Password guessing:– Eve can log into the system (example: the Bank web site) and try to guess Alice’s password by trying different combinations of characters• Vulnerabilities leading to attack 2:– Alice chose a short password (and the application did not require a longer password) and– the verifier did not implement a maximum retry policy (i.e. if awrong password is submitted for 3 times, then block the user name account)• Countermeasures:– the verifier should enforce a password of a minimum length, composed by a mix of numerical and special characters; the verifier should enforce a maximum retry policyFixed passwordpossible attacks and vulnerabilities• Attack 3 – The attacker can access the password file • Vulnerabilities leading to attack 3:– The password file is not read/write protected• Countermeasures:– Protect the password fileFixed passwordpossible attacks and vulnerabilitiesFixed password storing password hash• When the password is created, the verifier stores the hash of the password instead of the plaintext password. The hash values are known to the verifier only.• When the user sends his user name (ID) and the password, the verifier creates a hash of the password and the compares it with the stored password hash. If there is a match the user is authenticated successfully.• If an attacker tries to obtain the password of a specific user,and he succeeds in accessing the password repository, it is difficult for him to guess the password from the hash value• However, a brute force attack against the password repository is still possible.Brute force attack• Brute force attacks can be made less effective by obfuscating the data (as it is more difficult to determine when one has succeeded in breaking the code) • In cryptography, obfuscation refers to encoding the input data before it is sent to a hash function (or other encryption scheme). This technique helps making brute force attacks unfeasible, as it is difficult to determine the correct cleartext.5Dictionary attack• A dictionary attack is a technique for defeating a cipheror authentication mechanism by trying to determine its decryption key or passphrase by searching a large number of possibilities. • In contrast with a brute force attack, where all possibilities are searched through exhaustively, a dictionary attack only tries possibilities which are most likely to succeed, typically derived from a list of words in a dictionary. – Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short (7 characters or fewer),


View Full Document

Purdue CS 42600 - Lecture notes

Download Lecture notes
Our administrator received your request to download this document. We will send you the file to your email shortly.
Loading Unlocking...
Login

Join to view Lecture notes and access 3M+ class-specific study document.

or
We will never post anything without your permission.
Don't have an account?
Sign Up

Join to view Lecture notes 2 2 and access 3M+ class-specific study document.

or

By creating an account you agree to our Privacy Policy and Terms Of Use

Already a member?