4. Password & Authentication Schemes

Identification vs. Verification

Identification → Confirms who someone is from a group of identities.

Verification → Confirms if someone is who they claim to be.

What is the definition of Authentication?

The process of verifying an identity claimed by or for a system entity.

What are the 4 means of User Authentication

Based on something the individual:

• knows → password

• posses → token

• Naturally has → static biometrics

• does → dynamic biometrics

What type of attack can be used against hashed passwords?

Dictionary attacks

What are ways to prevent Dictionary Attacks on passwords?

• Salts → Add random salt to password before hashing.

• Memory-bound hash functions → designed to be slow and requires lots of memory.

• Password File Access Control → OS allows only root / authentication checks to read file with hashed passwords.

What is Lamports Hash?

• One-time password scheme.

• Secure against breach of server database.

Scheme:

• Server stores an integer n and hashⁿ(password) for each user.

• n decrements after each use.

• User calculates large number of password hashes in advance.

What is the problem with Lamports Hash?

The small n attack:

• Scheme has no mutual authentication (server can be impersonated).

• Attacker sends small n to User - which is smaller than the actual current n → receives hashⁿ(password).

• Attacker can use hashⁿ(password) to construct hashes until the actual current n (of the server) reaches n.

What is the definition of Strong Password Protocols?

Eavesdropping or impersonation will not yield enough information to do offline verification of password guesses.

What is the problem of Encrypted Key Exchange (EKE) and Simple Password Exponential Key Exchange (SPEKE)?

The server has to store the weak password w.

What are Augmented Strong Password Protocolls?

• Strong Password Protocols, where the server does not need to store the password.

What is Discretionary Acces Control (DAC)?

Matrix that defines the access rights of all subjets for all objects.

• Subject → entity that can access objects.

• Object → Access controlled resource.