SlideShare a Scribd company logo
1 of 26
Information System SecurityInformation System Security
Lecture 5Lecture 5
User Authentication andUser Authentication and
Cryptographic Key InfrastructureCryptographic Key Infrastructure
22
OutlineOutline
 Entity AuthenticationEntity Authentication
 Entity Authentication FunctionsEntity Authentication Functions
– Something you haveSomething you have
– Something you areSomething you are
– Something you knowSomething you know
 PasswordsPasswords
 OTPOTP
 Challenge-ResponseChallenge-Response
 Cryptographic Key InfrastructureCryptographic Key Infrastructure
33
1. Entity Authentication1. Entity Authentication
 The aim of this lecture is to present some techniques that allowsThe aim of this lecture is to present some techniques that allows
one party (theone party (the verifierverifier) to gain assurances that the identity of) to gain assurances that the identity of
another (theanother (the claimantclaimant) is as declared, thereby preventing) is as declared, thereby preventing
impersonation.impersonation.
 These techniques are referred to asThese techniques are referred to as identificationidentification,, entityentity
authenticationauthentication, and, and identity verificationidentity verification..
 Entity authentication is the process whereby one party is assuredEntity authentication is the process whereby one party is assured
of the identity of a second party involved in a protocol, and thatof the identity of a second party involved in a protocol, and that
the second has actually participated.the second has actually participated.
44
Entity authentication: UsesEntity authentication: Uses
1.1. Access controlAccess control
– An entity, often human user, must provide assurance of their identity inAn entity, often human user, must provide assurance of their identity in
real time in order to have access to either physical or virtual resources.real time in order to have access to either physical or virtual resources.
1.1. As part of a more complex cryptographic process:As part of a more complex cryptographic process:
– Typically established at the start of a connection: an entity must provideTypically established at the start of a connection: an entity must provide
assurance of their identity in real time in order for the extended processassurance of their identity in real time in order for the extended process
to complete satisfactorily.to complete satisfactorily.
– For example, the process of establishing a symmetric key that two usersFor example, the process of establishing a symmetric key that two users
can use to immediately communicate with one another commonlycan use to immediately communicate with one another commonly
involves mutual entity authentication in order to provide the two usersinvolves mutual entity authentication in order to provide the two users
with sufficient assurance that they have agreed a key with the “correct”with sufficient assurance that they have agreed a key with the “correct”
person.person.
55
Entity authentication: TypesEntity authentication: Types
 Types of entity authentication:Types of entity authentication:
– Unilateral entity authentication is assurance of the identity of one entity
to another (and not vice-versa).
 Examples:
– Online shopping
– File downloading
– Mutual entity authentication occurs if both communicating entities
provide each other with assurance of their identity.
 Examples:Examples:
– Online BankingOnline Banking
– E-learningE-learning
66
2. Entity Authentication Functions2. Entity Authentication Functions
 The most common ways of providing entity authentication are
by using (a combination of) the following:
– Something that you have
– Something that you are
– Something that you know
77
Something you haveSomething you have
 Dumb tokens:Dumb tokens:
– Any physical device without a memory that can be used as a type ofAny physical device without a memory that can be used as a type of
electronic key.electronic key.
– Dumb tokens typically operate with a reader that extracts someDumb tokens typically operate with a reader that extracts some
information from the token and then indicates whether the informationinformation from the token and then indicates whether the information
authenticates the entity or not.authenticates the entity or not.
– A good example of a dumb token is a plastic card with a magnetic stripe.A good example of a dumb token is a plastic card with a magnetic stripe.
The security of the card is based entirely on the difficulty of extractingThe security of the card is based entirely on the difficulty of extracting
the information from the magnetic stripe.the information from the magnetic stripe.
– It is common to combine the use of a dumb token with another entityIt is common to combine the use of a dumb token with another entity
authentication technique, such as one based on something you know.authentication technique, such as one based on something you know.
88
Something you haveSomething you have
 Smart cards:Smart cards:
– A plastic card that contains a chip, which gives the card a limited amountA plastic card that contains a chip, which gives the card a limited amount
of memory and processing power.of memory and processing power.
– A smart card can store secret data more securely, and can also engage inA smart card can store secret data more securely, and can also engage in
cryptographic processes that require some computations to be performedcryptographic processes that require some computations to be performed
(e.g. challenge/response).(e.g. challenge/response).
– Smart cards have limited memory and processing power, thus restrictingSmart cards have limited memory and processing power, thus restricting
the types of operation that they can comfortably perform.the types of operation that they can comfortably perform.
– Smart cards are widely used in most countries for banking operations,Smart cards are widely used in most countries for banking operations,
electronic ticketing applications, etc.electronic ticketing applications, etc.
99
Something you areSomething you are
 BiometricsBiometrics
– Techniques for human user authentication that are based on physicalTechniques for human user authentication that are based on physical
characteristics of the human body.characteristics of the human body.
– A biometric control typically converts a physical characteristic into aA biometric control typically converts a physical characteristic into a
digital template that is stored on a database. When the user physicallydigital template that is stored on a database. When the user physically
presents themselves for entity authentication, the physical characteristic ispresents themselves for entity authentication, the physical characteristic is
measured by a reader, digitally encoded, and then compared with themeasured by a reader, digitally encoded, and then compared with the
template.template.
1010
Something you areSomething you are
 Biometric system modelBiometric system model
Raw data
Extracted
features Template
Authentication decision
Data
collection Signal
processing
Matching Storage
Match
score
DecisionApplication
1111
Something you areSomething you are
 BiometricsBiometrics
– StaticStatic (unchanging) measurements include fingerprints, hand geometry,(unchanging) measurements include fingerprints, hand geometry,
face recognition, retina scan.face recognition, retina scan.
– DynamicDynamic (changing) measurements include handwriting measurements(changing) measurements include handwriting measurements
and voice recognition.and voice recognition.
– There are many implementation issues and as yet entity authentication isThere are many implementation issues and as yet entity authentication is
not widely provided using these techniques.not widely provided using these techniques.
1212
Something you areSomething you are
Optical fingerprint sensor
[Fingerprint Identification Unit
FIU-001/500 by Sony]
Fingerprints
1313
Something you knowSomething you know
 Passwords:
– Passwords are probably the most popular technique for providing entity
authentication, despite concerns about how secure they actually are.
 A password may be a sequence of charactersA password may be a sequence of characters
– Examples: 10 digits, a string of letters,Examples: 10 digits, a string of letters, etcetc..
– Generated randomly, by user, by computer with user inputGenerated randomly, by user, by computer with user input
 A password may be a sequence of wordsA password may be a sequence of words
– Examples: pass-phrasesExamples: pass-phrases
– AA pass-phrasepass-phrase is a sequence of characters that it is too long to be ais a sequence of characters that it is too long to be a
password and it is thus turned into a shorter virtual password by thepassword and it is thus turned into a shorter virtual password by the
password systempassword system
 AlgorithmsAlgorithms
– Examples: one-time passwords, challenge-response.Examples: one-time passwords, challenge-response.
1414
Password storagePassword storage
 Passwords stored in plaintext filesPasswords stored in plaintext files
– If password file compromised, all passwords are revealedIf password file compromised, all passwords are revealed
– Usually password files are read- and write- protectedUsually password files are read- and write- protected
 Passwords stored in encrypted filePasswords stored in encrypted file
– Encrypted/hashed versions of passwords are stored in a password fileEncrypted/hashed versions of passwords are stored in a password file
 Examples:Examples:
– A Windows password is stored as a MD4 hash value.A Windows password is stored as a MD4 hash value.
– A Unix password is stored as a Unix DES Encryption.A Unix password is stored as a Unix DES Encryption.
1515
Unix PasswordUnix Password
 Example: Original UnixExample: Original Unix
– A password is up to eight charactersA password is up to eight characters
– The password is truncated to its first 8 ASCII characters, forming theThe password is truncated to its first 8 ASCII characters, forming the
Unix DES keyUnix DES key
– The key is used to encrypt the 64-bit constant 0.The key is used to encrypt the 64-bit constant 0.
– The Unix DES is a variation of the standard DES.The Unix DES is a variation of the standard DES.
 A 12-bitA 12-bit saltsalt is used to modify the expansion function in DES,is used to modify the expansion function in DES,
 Then DES is iterated 25 timesThen DES is iterated 25 times
– Thus the UNIX password is referred to asThus the UNIX password is referred to as salted passwordsalted password
– Unix passwords are stored in fileUnix passwords are stored in file /etc/passwd/etc/passwd
1616
Attack on passwordsAttack on passwords
 Replay of passwordsReplay of passwords
– Specially when passwords are transmitted in cleartextSpecially when passwords are transmitted in cleartext
 Exhaustive password searchExhaustive password search
– Trying all possible passwordsTrying all possible passwords
 Dictionary attackDictionary attack
– Most users select passwords from a small subset of the password spaceMost users select passwords from a small subset of the password space
(e.g., short passwords, dictionary words, proper names)(e.g., short passwords, dictionary words, proper names)
– Dictionary attack: the attacker tries all possible words, found in anDictionary attack: the attacker tries all possible words, found in an
available or on-line listavailable or on-line list
1717
Password selectionPassword selection
 Problem: people pick easy to guess passwordsProblem: people pick easy to guess passwords
– Based on account names, user names, computer names, place namesBased on account names, user names, computer names, place names
– Too short, digits only, letters onlyToo short, digits only, letters only
– License plates, acronyms, social security numbersLicense plates, acronyms, social security numbers
– Personal characteristics (nicknames, job characteristics,Personal characteristics (nicknames, job characteristics, etcetc.).)
 Good passwords can be constructed in several waysGood passwords can be constructed in several ways
– Example: A password containing at least one digit, one letter, oneExample: A password containing at least one digit, one letter, one
punctuation symbol, and one control character is usually a strongpunctuation symbol, and one control character is usually a strong
passwordpassword
1818
One-Time PasswordsOne-Time Passwords
 Problem with fixed passwords:Problem with fixed passwords:
– If an attacker sees a password, he/she can laterIf an attacker sees a password, he/she can later replayreplay the passwordthe password
 A partial solution: one-time passwordsA partial solution: one-time passwords
– Password that can be used exactlyPassword that can be used exactly onceonce
– After use, it is immediately invalidatedAfter use, it is immediately invalidated
 ProblemsProblems
– Synchronization of user and systemSynchronization of user and system
– Generation of good random passwordsGeneration of good random passwords
– Password distribution problemPassword distribution problem
1919
Challenge-ResponseChallenge-Response
(Strong authentication)(Strong authentication)
 Another alternative is to authenticate in such a way that theAnother alternative is to authenticate in such a way that the
transmitted password changes each timetransmitted password changes each time
 Let a userLet a user uu wishing to authenticate himself to a systemwishing to authenticate himself to a system SS. Let. Let uu
andand SS have an agreed-on secret functionhave an agreed-on secret function ff. A. A challenge-responsechallenge-response
authentication system is one in whichauthentication system is one in which SS sends a random messagesends a random message
mm (the(the challengechallenge) to) to uu, and, and uu replies with the transformationreplies with the transformation rr ==
ff((mm) (the) (the responseresponse).). SS then validatesthen validates rr by computing itby computing it
separately.separately.
 TheThe challengechallenge may be a nonce, timestamp, sequence number, ormay be a nonce, timestamp, sequence number, or
any combination.any combination.
2020
Challenge-ResponseChallenge-Response
((by symmetric-key techniques)
 The user and system share a secret function f (in practice, f can
be a known function with unknown parameters, such as a
cryptographic key).
 This called challenge-response by symmetric-key techniques.
user system
request to authenticate
user system
random message r
(the challenge)
user system
f(r)
(the response)
2121
Challenge-ResponseChallenge-Response
(by public-key techniques)(by public-key techniques)
 AA identifiesidentifies BB by checking whetherby checking whether BB holds the secret (private)holds the secret (private)
keykey KRKRBB that matches the public keythat matches the public key KUKUBB
 AA chooses a random challenge (nonce)chooses a random challenge (nonce) rrAA.. BB uses its randomuses its random
noncenonce rrBB.. BB applies its public-key system for authenticationapplies its public-key system for authentication
 Message sequence:Message sequence:
1.1. A → BA → B:: rrAA..
2.2. B → AB → A:: rrBB,, EEKRKRBB
(( rrAA,r,rBB))
2222
Cryptographic KeyCryptographic Key
InfrastructureInfrastructure
2323
Cryptographic Key InfrastructureCryptographic Key Infrastructure
 Goal: bind identity to keyGoal: bind identity to key
 Symmetric Cryptography:Symmetric Cryptography:
– Not possible as all keys are sharedNot possible as all keys are shared
 Public key Cryptography:Public key Cryptography:
– Bind identity to public keyBind identity to public key
– Crucial as people will use key to communicate with principal whoseCrucial as people will use key to communicate with principal whose
identity is bound to keyidentity is bound to key
– Erroneous binding means no secrecy between principalsErroneous binding means no secrecy between principals
– Assume principal identified by an acceptable nameAssume principal identified by an acceptable name
2424
CertificatesCertificates
 A certificate is a token (message) containingA certificate is a token (message) containing
– Identity of principal (e.g., Alice)Identity of principal (e.g., Alice)
– Corresponding public keyCorresponding public key
– Timestamp (when issued)Timestamp (when issued)
– Other information (perhaps identity of signer)Other information (perhaps identity of signer)
– Signature of a trusted authority (e.g., Cathy)Signature of a trusted authority (e.g., Cathy)
CCAA == DDkvkv((KKpp || Alice |||| Alice || TT ))
DDkvkv is Cathy’s private keyis Cathy’s private key
CCAA is A’s certificateis A’s certificate
2525
Certificate UseCertificate Use
 Bob gets Alice’s certificateBob gets Alice’s certificate
– If he knows Cathy’s public key, he can validate the certificateIf he knows Cathy’s public key, he can validate the certificate
 When was certificate issued?When was certificate issued?
 Is the principal Alice?Is the principal Alice?
– Now Bob has Alice’s public keyNow Bob has Alice’s public key
 Problem:Problem:
– Bob needs Cathy’s public key to validateBob needs Cathy’s public key to validate AliceAlice’s certificate’s certificate
– Many solutions:Many solutions:
 Public Key Infrastructure (PKI),Public Key Infrastructure (PKI),
 Trust-based certificatesTrust-based certificates
2626
X.509 certificateX.509 certificate
 Key certificate fields in X.509v3:Key certificate fields in X.509v3:
– VersionVersion
– Serial number (unique)Serial number (unique)
– Signature algorithm identifier: hash algorithmSignature algorithm identifier: hash algorithm
– Issuer’s name; uniquely identifies issuerIssuer’s name; uniquely identifies issuer
– Interval of validityInterval of validity
– Subject’s name; uniquely identifies subjectSubject’s name; uniquely identifies subject
– Subject’s public keySubject’s public key
– Signature:Signature:
 Identifies algorithm used to sign the certificateIdentifies algorithm used to sign the certificate
 Signature (enciphered hash)Signature (enciphered hash)
 Issuer is called Certificate Authority (CA)Issuer is called Certificate Authority (CA)

More Related Content

What's hot

Secret key cryptography
Secret key cryptographySecret key cryptography
Secret key cryptographyPrabhat Goel
 
Introduction to Cryptography
Introduction to CryptographyIntroduction to Cryptography
Introduction to CryptographySeema Goel
 
Digital signature
Digital signatureDigital signature
Digital signaturePraseela R
 
Principles of public key cryptography and its Uses
Principles of  public key cryptography and its UsesPrinciples of  public key cryptography and its Uses
Principles of public key cryptography and its UsesMohsin Ali
 
Symmetric & Asymmetric Cryptography
Symmetric & Asymmetric CryptographySymmetric & Asymmetric Cryptography
Symmetric & Asymmetric Cryptographychauhankapil
 
Network security - OSI Security Architecture
Network security - OSI Security ArchitectureNetwork security - OSI Security Architecture
Network security - OSI Security ArchitectureBharathiKrishna6
 
Security Mechanisms
Security MechanismsSecurity Mechanisms
Security Mechanismspriya_trehan
 
Data Encryption and Decryption using Hill Cipher
Data Encryption and Decryption using Hill CipherData Encryption and Decryption using Hill Cipher
Data Encryption and Decryption using Hill CipherAashirwad Kashyap
 

What's hot (20)

RSA ALGORITHM
RSA ALGORITHMRSA ALGORITHM
RSA ALGORITHM
 
Secret key cryptography
Secret key cryptographySecret key cryptography
Secret key cryptography
 
Cryptography ppt
Cryptography pptCryptography ppt
Cryptography ppt
 
Introduction to Cryptography
Introduction to CryptographyIntroduction to Cryptography
Introduction to Cryptography
 
Image Security
Image SecurityImage Security
Image Security
 
RSA ALGORITHM
RSA ALGORITHMRSA ALGORITHM
RSA ALGORITHM
 
Symmetric and asymmetric key
Symmetric and asymmetric keySymmetric and asymmetric key
Symmetric and asymmetric key
 
Digital signature
Digital signatureDigital signature
Digital signature
 
Principles of public key cryptography and its Uses
Principles of  public key cryptography and its UsesPrinciples of  public key cryptography and its Uses
Principles of public key cryptography and its Uses
 
Cryptography
CryptographyCryptography
Cryptography
 
RSA Algorithm
RSA AlgorithmRSA Algorithm
RSA Algorithm
 
Email security
Email securityEmail security
Email security
 
Symmetric & Asymmetric Cryptography
Symmetric & Asymmetric CryptographySymmetric & Asymmetric Cryptography
Symmetric & Asymmetric Cryptography
 
Network security - OSI Security Architecture
Network security - OSI Security ArchitectureNetwork security - OSI Security Architecture
Network security - OSI Security Architecture
 
Cryptography
CryptographyCryptography
Cryptography
 
Data encryption
Data encryptionData encryption
Data encryption
 
Key management
Key managementKey management
Key management
 
Security Mechanisms
Security MechanismsSecurity Mechanisms
Security Mechanisms
 
Elgamal digital signature
Elgamal digital signatureElgamal digital signature
Elgamal digital signature
 
Data Encryption and Decryption using Hill Cipher
Data Encryption and Decryption using Hill CipherData Encryption and Decryption using Hill Cipher
Data Encryption and Decryption using Hill Cipher
 

Viewers also liked

Block cipher modes of operation
Block cipher modes of operation Block cipher modes of operation
Block cipher modes of operation harshit chavda
 
Block Ciphers Modes of Operation
Block Ciphers Modes of OperationBlock Ciphers Modes of Operation
Block Ciphers Modes of OperationRoman Oliynykov
 
Network security and protocols
Network security and protocolsNetwork security and protocols
Network security and protocolsOnline
 
Data Encryption Standard (DES)
Data Encryption Standard (DES)Data Encryption Standard (DES)
Data Encryption Standard (DES)Haris Ahmed
 
Classical Encryption Techniques in Network Security
Classical Encryption Techniques in Network SecurityClassical Encryption Techniques in Network Security
Classical Encryption Techniques in Network Securitybabak danyal
 
Authentication(pswrd,token,certificate,biometric)
Authentication(pswrd,token,certificate,biometric)Authentication(pswrd,token,certificate,biometric)
Authentication(pswrd,token,certificate,biometric)Ali Raw
 

Viewers also liked (10)

Iss lecture 1
Iss lecture 1Iss lecture 1
Iss lecture 1
 
Block cipher modes of operation
Block cipher modes of operation Block cipher modes of operation
Block cipher modes of operation
 
Block Ciphers Modes of Operation
Block Ciphers Modes of OperationBlock Ciphers Modes of Operation
Block Ciphers Modes of Operation
 
Block Ciphers Modes of Operation
Block Ciphers Modes of OperationBlock Ciphers Modes of Operation
Block Ciphers Modes of Operation
 
Network security and protocols
Network security and protocolsNetwork security and protocols
Network security and protocols
 
Data Encryption Standard (DES)
Data Encryption Standard (DES)Data Encryption Standard (DES)
Data Encryption Standard (DES)
 
DES
DESDES
DES
 
Classical Encryption Techniques in Network Security
Classical Encryption Techniques in Network SecurityClassical Encryption Techniques in Network Security
Classical Encryption Techniques in Network Security
 
Authentication(pswrd,token,certificate,biometric)
Authentication(pswrd,token,certificate,biometric)Authentication(pswrd,token,certificate,biometric)
Authentication(pswrd,token,certificate,biometric)
 
Cryptography.ppt
Cryptography.pptCryptography.ppt
Cryptography.ppt
 

Similar to Iss lecture 5

Two-factor authentication- A sample writing _Zaman
Two-factor authentication- A sample writing _ZamanTwo-factor authentication- A sample writing _Zaman
Two-factor authentication- A sample writing _ZamanAsad Zaman
 
Eds user authenticationuser authentication methods
Eds user authenticationuser authentication methodsEds user authenticationuser authentication methods
Eds user authenticationuser authentication methodslapao2014
 
Network security
Network securityNetwork security
Network securityAli Kamil
 
MOBILE & WIRELESS SECURITY And MOBILE & WIRELESS SECURITY
MOBILE & WIRELESS SECURITY And MOBILE & WIRELESS SECURITYMOBILE & WIRELESS SECURITY And MOBILE & WIRELESS SECURITY
MOBILE & WIRELESS SECURITY And MOBILE & WIRELESS SECURITYDEEPAK948083
 
Basic Security Chapter 1
Basic Security Chapter 1Basic Security Chapter 1
Basic Security Chapter 1AfiqEfendy Zaen
 
Basic security concepts_chapter_1
Basic security concepts_chapter_1Basic security concepts_chapter_1
Basic security concepts_chapter_1abdifatah said
 
Network Security
Network SecurityNetwork Security
Network SecurityBeth Hall
 
Biometric Authentication Technology - Report
Biometric Authentication Technology - ReportBiometric Authentication Technology - Report
Biometric Authentication Technology - ReportNavin Kumar
 
CHAPTER 7 Authentication and Authorization On
CHAPTER  7 Authentication and Authorization OnCHAPTER  7 Authentication and Authorization On
CHAPTER 7 Authentication and Authorization OnMaximaSheffield592
 
Cryptograpy Exam
Cryptograpy ExamCryptograpy Exam
Cryptograpy ExamLisa Olive
 
4.2.1 Network Issues and Communication.pptx
4.2.1 Network Issues and Communication.pptx4.2.1 Network Issues and Communication.pptx
4.2.1 Network Issues and Communication.pptxTeenaSharma73
 
4.2.1 Network Issues and Communication [Autosaved].pptx
4.2.1 Network Issues and Communication [Autosaved].pptx4.2.1 Network Issues and Communication [Autosaved].pptx
4.2.1 Network Issues and Communication [Autosaved].pptxTeenaSharma73
 
You may be compliant...
You may be compliant...You may be compliant...
You may be compliant...Greg Swedosh
 
You may be compliant, but are you really secure?
You may be compliant, but are you really secure?You may be compliant, but are you really secure?
You may be compliant, but are you really secure?Thomas Burg
 
Securing corporate assets_with_2_fa
Securing corporate assets_with_2_faSecuring corporate assets_with_2_fa
Securing corporate assets_with_2_faHai Nguyen
 

Similar to Iss lecture 5 (20)

Two-factor authentication- A sample writing _Zaman
Two-factor authentication- A sample writing _ZamanTwo-factor authentication- A sample writing _Zaman
Two-factor authentication- A sample writing _Zaman
 
Eds user authenticationuser authentication methods
Eds user authenticationuser authentication methodsEds user authenticationuser authentication methods
Eds user authenticationuser authentication methods
 
Network security
Network securityNetwork security
Network security
 
MOBILE & WIRELESS SECURITY And MOBILE & WIRELESS SECURITY
MOBILE & WIRELESS SECURITY And MOBILE & WIRELESS SECURITYMOBILE & WIRELESS SECURITY And MOBILE & WIRELESS SECURITY
MOBILE & WIRELESS SECURITY And MOBILE & WIRELESS SECURITY
 
Basic Security Chapter 1
Basic Security Chapter 1Basic Security Chapter 1
Basic Security Chapter 1
 
Basic security concepts_chapter_1
Basic security concepts_chapter_1Basic security concepts_chapter_1
Basic security concepts_chapter_1
 
Network Security
Network SecurityNetwork Security
Network Security
 
Biometric Authentication Technology - Report
Biometric Authentication Technology - ReportBiometric Authentication Technology - Report
Biometric Authentication Technology - Report
 
CHAPTER 7 Authentication and Authorization On
CHAPTER  7 Authentication and Authorization OnCHAPTER  7 Authentication and Authorization On
CHAPTER 7 Authentication and Authorization On
 
Cryptograpy Exam
Cryptograpy ExamCryptograpy Exam
Cryptograpy Exam
 
120 i143
120 i143120 i143
120 i143
 
Cybersecurity
CybersecurityCybersecurity
Cybersecurity
 
4.2.1 Network Issues and Communication.pptx
4.2.1 Network Issues and Communication.pptx4.2.1 Network Issues and Communication.pptx
4.2.1 Network Issues and Communication.pptx
 
4.2.1 Network Issues and Communication [Autosaved].pptx
4.2.1 Network Issues and Communication [Autosaved].pptx4.2.1 Network Issues and Communication [Autosaved].pptx
4.2.1 Network Issues and Communication [Autosaved].pptx
 
You may be compliant...
You may be compliant...You may be compliant...
You may be compliant...
 
You may be compliant, but are you really secure?
You may be compliant, but are you really secure?You may be compliant, but are you really secure?
You may be compliant, but are you really secure?
 
IS - User Authentication
IS - User AuthenticationIS - User Authentication
IS - User Authentication
 
What Is "Secure"?
What Is "Secure"?What Is "Secure"?
What Is "Secure"?
 
Securing corporate assets_with_2_fa
Securing corporate assets_with_2_faSecuring corporate assets_with_2_fa
Securing corporate assets_with_2_fa
 
C02
C02C02
C02
 

More from Ali Habeeb

Anonymous Connections And Onion Routing
Anonymous Connections And Onion RoutingAnonymous Connections And Onion Routing
Anonymous Connections And Onion RoutingAli Habeeb
 
Opinion Mining
Opinion MiningOpinion Mining
Opinion MiningAli Habeeb
 
Cloud Security
Cloud SecurityCloud Security
Cloud SecurityAli Habeeb
 
Data-Centric Routing Protocols in Wireless Sensor Network: A survey
Data-Centric Routing Protocols in Wireless Sensor Network: A surveyData-Centric Routing Protocols in Wireless Sensor Network: A survey
Data-Centric Routing Protocols in Wireless Sensor Network: A surveyAli Habeeb
 
Secure erasure code based distributed storage system with secure data forwarding
Secure erasure code based distributed storage system with secure data forwardingSecure erasure code based distributed storage system with secure data forwarding
Secure erasure code based distributed storage system with secure data forwardingAli Habeeb
 
Organizing User Search Histories
Organizing User Search HistoriesOrganizing User Search Histories
Organizing User Search HistoriesAli Habeeb
 
Detecting and Resolving Firewall Policy Anomalies
Detecting and Resolving Firewall Policy AnomaliesDetecting and Resolving Firewall Policy Anomalies
Detecting and Resolving Firewall Policy AnomaliesAli Habeeb
 
Bit Torrent Protocol
Bit Torrent ProtocolBit Torrent Protocol
Bit Torrent ProtocolAli Habeeb
 
A study of Data Quality and Analytics
A study of Data Quality and AnalyticsA study of Data Quality and Analytics
A study of Data Quality and AnalyticsAli Habeeb
 
Adhoc and Sensor Networks - Chapter 10
Adhoc and Sensor Networks - Chapter 10Adhoc and Sensor Networks - Chapter 10
Adhoc and Sensor Networks - Chapter 10Ali Habeeb
 
Adhoc and Sensor Networks - Chapter 09
Adhoc and Sensor Networks - Chapter 09Adhoc and Sensor Networks - Chapter 09
Adhoc and Sensor Networks - Chapter 09Ali Habeeb
 
Adhoc and Sensor Networks - Chapter 08
Adhoc and Sensor Networks - Chapter 08Adhoc and Sensor Networks - Chapter 08
Adhoc and Sensor Networks - Chapter 08Ali Habeeb
 
Adhoc and Sensor Networks - Chapter 07
Adhoc and Sensor Networks - Chapter 07Adhoc and Sensor Networks - Chapter 07
Adhoc and Sensor Networks - Chapter 07Ali Habeeb
 
Adhoc and Sensor Networks - Chapter 06
Adhoc and Sensor Networks - Chapter 06Adhoc and Sensor Networks - Chapter 06
Adhoc and Sensor Networks - Chapter 06Ali Habeeb
 
Adhoc and Sensor Networks - Chapter 05
Adhoc and Sensor Networks - Chapter 05Adhoc and Sensor Networks - Chapter 05
Adhoc and Sensor Networks - Chapter 05Ali Habeeb
 
Adhoc and Sensor Networks - Chapter 04
Adhoc and Sensor Networks - Chapter 04Adhoc and Sensor Networks - Chapter 04
Adhoc and Sensor Networks - Chapter 04Ali Habeeb
 

More from Ali Habeeb (20)

Anonymous Connections And Onion Routing
Anonymous Connections And Onion RoutingAnonymous Connections And Onion Routing
Anonymous Connections And Onion Routing
 
Opinion Mining
Opinion MiningOpinion Mining
Opinion Mining
 
WAP
WAPWAP
WAP
 
USB 3.0
USB 3.0USB 3.0
USB 3.0
 
Blue Eyes
Blue EyesBlue Eyes
Blue Eyes
 
Cloud Security
Cloud SecurityCloud Security
Cloud Security
 
Data-Centric Routing Protocols in Wireless Sensor Network: A survey
Data-Centric Routing Protocols in Wireless Sensor Network: A surveyData-Centric Routing Protocols in Wireless Sensor Network: A survey
Data-Centric Routing Protocols in Wireless Sensor Network: A survey
 
Web Security
Web SecurityWeb Security
Web Security
 
Secure erasure code based distributed storage system with secure data forwarding
Secure erasure code based distributed storage system with secure data forwardingSecure erasure code based distributed storage system with secure data forwarding
Secure erasure code based distributed storage system with secure data forwarding
 
Organizing User Search Histories
Organizing User Search HistoriesOrganizing User Search Histories
Organizing User Search Histories
 
Detecting and Resolving Firewall Policy Anomalies
Detecting and Resolving Firewall Policy AnomaliesDetecting and Resolving Firewall Policy Anomalies
Detecting and Resolving Firewall Policy Anomalies
 
Bit Torrent Protocol
Bit Torrent ProtocolBit Torrent Protocol
Bit Torrent Protocol
 
A study of Data Quality and Analytics
A study of Data Quality and AnalyticsA study of Data Quality and Analytics
A study of Data Quality and Analytics
 
Adhoc and Sensor Networks - Chapter 10
Adhoc and Sensor Networks - Chapter 10Adhoc and Sensor Networks - Chapter 10
Adhoc and Sensor Networks - Chapter 10
 
Adhoc and Sensor Networks - Chapter 09
Adhoc and Sensor Networks - Chapter 09Adhoc and Sensor Networks - Chapter 09
Adhoc and Sensor Networks - Chapter 09
 
Adhoc and Sensor Networks - Chapter 08
Adhoc and Sensor Networks - Chapter 08Adhoc and Sensor Networks - Chapter 08
Adhoc and Sensor Networks - Chapter 08
 
Adhoc and Sensor Networks - Chapter 07
Adhoc and Sensor Networks - Chapter 07Adhoc and Sensor Networks - Chapter 07
Adhoc and Sensor Networks - Chapter 07
 
Adhoc and Sensor Networks - Chapter 06
Adhoc and Sensor Networks - Chapter 06Adhoc and Sensor Networks - Chapter 06
Adhoc and Sensor Networks - Chapter 06
 
Adhoc and Sensor Networks - Chapter 05
Adhoc and Sensor Networks - Chapter 05Adhoc and Sensor Networks - Chapter 05
Adhoc and Sensor Networks - Chapter 05
 
Adhoc and Sensor Networks - Chapter 04
Adhoc and Sensor Networks - Chapter 04Adhoc and Sensor Networks - Chapter 04
Adhoc and Sensor Networks - Chapter 04
 

Recently uploaded

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsRoshan Dwivedi
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CVKhem
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century educationjfdjdjcjdnsjd
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsJoaquim Jorge
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businesspanagenda
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024The Digital Insurer
 

Recently uploaded (20)

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024
 

Iss lecture 5

  • 1. Information System SecurityInformation System Security Lecture 5Lecture 5 User Authentication andUser Authentication and Cryptographic Key InfrastructureCryptographic Key Infrastructure
  • 2. 22 OutlineOutline  Entity AuthenticationEntity Authentication  Entity Authentication FunctionsEntity Authentication Functions – Something you haveSomething you have – Something you areSomething you are – Something you knowSomething you know  PasswordsPasswords  OTPOTP  Challenge-ResponseChallenge-Response  Cryptographic Key InfrastructureCryptographic Key Infrastructure
  • 3. 33 1. Entity Authentication1. Entity Authentication  The aim of this lecture is to present some techniques that allowsThe aim of this lecture is to present some techniques that allows one party (theone party (the verifierverifier) to gain assurances that the identity of) to gain assurances that the identity of another (theanother (the claimantclaimant) is as declared, thereby preventing) is as declared, thereby preventing impersonation.impersonation.  These techniques are referred to asThese techniques are referred to as identificationidentification,, entityentity authenticationauthentication, and, and identity verificationidentity verification..  Entity authentication is the process whereby one party is assuredEntity authentication is the process whereby one party is assured of the identity of a second party involved in a protocol, and thatof the identity of a second party involved in a protocol, and that the second has actually participated.the second has actually participated.
  • 4. 44 Entity authentication: UsesEntity authentication: Uses 1.1. Access controlAccess control – An entity, often human user, must provide assurance of their identity inAn entity, often human user, must provide assurance of their identity in real time in order to have access to either physical or virtual resources.real time in order to have access to either physical or virtual resources. 1.1. As part of a more complex cryptographic process:As part of a more complex cryptographic process: – Typically established at the start of a connection: an entity must provideTypically established at the start of a connection: an entity must provide assurance of their identity in real time in order for the extended processassurance of their identity in real time in order for the extended process to complete satisfactorily.to complete satisfactorily. – For example, the process of establishing a symmetric key that two usersFor example, the process of establishing a symmetric key that two users can use to immediately communicate with one another commonlycan use to immediately communicate with one another commonly involves mutual entity authentication in order to provide the two usersinvolves mutual entity authentication in order to provide the two users with sufficient assurance that they have agreed a key with the “correct”with sufficient assurance that they have agreed a key with the “correct” person.person.
  • 5. 55 Entity authentication: TypesEntity authentication: Types  Types of entity authentication:Types of entity authentication: – Unilateral entity authentication is assurance of the identity of one entity to another (and not vice-versa).  Examples: – Online shopping – File downloading – Mutual entity authentication occurs if both communicating entities provide each other with assurance of their identity.  Examples:Examples: – Online BankingOnline Banking – E-learningE-learning
  • 6. 66 2. Entity Authentication Functions2. Entity Authentication Functions  The most common ways of providing entity authentication are by using (a combination of) the following: – Something that you have – Something that you are – Something that you know
  • 7. 77 Something you haveSomething you have  Dumb tokens:Dumb tokens: – Any physical device without a memory that can be used as a type ofAny physical device without a memory that can be used as a type of electronic key.electronic key. – Dumb tokens typically operate with a reader that extracts someDumb tokens typically operate with a reader that extracts some information from the token and then indicates whether the informationinformation from the token and then indicates whether the information authenticates the entity or not.authenticates the entity or not. – A good example of a dumb token is a plastic card with a magnetic stripe.A good example of a dumb token is a plastic card with a magnetic stripe. The security of the card is based entirely on the difficulty of extractingThe security of the card is based entirely on the difficulty of extracting the information from the magnetic stripe.the information from the magnetic stripe. – It is common to combine the use of a dumb token with another entityIt is common to combine the use of a dumb token with another entity authentication technique, such as one based on something you know.authentication technique, such as one based on something you know.
  • 8. 88 Something you haveSomething you have  Smart cards:Smart cards: – A plastic card that contains a chip, which gives the card a limited amountA plastic card that contains a chip, which gives the card a limited amount of memory and processing power.of memory and processing power. – A smart card can store secret data more securely, and can also engage inA smart card can store secret data more securely, and can also engage in cryptographic processes that require some computations to be performedcryptographic processes that require some computations to be performed (e.g. challenge/response).(e.g. challenge/response). – Smart cards have limited memory and processing power, thus restrictingSmart cards have limited memory and processing power, thus restricting the types of operation that they can comfortably perform.the types of operation that they can comfortably perform. – Smart cards are widely used in most countries for banking operations,Smart cards are widely used in most countries for banking operations, electronic ticketing applications, etc.electronic ticketing applications, etc.
  • 9. 99 Something you areSomething you are  BiometricsBiometrics – Techniques for human user authentication that are based on physicalTechniques for human user authentication that are based on physical characteristics of the human body.characteristics of the human body. – A biometric control typically converts a physical characteristic into aA biometric control typically converts a physical characteristic into a digital template that is stored on a database. When the user physicallydigital template that is stored on a database. When the user physically presents themselves for entity authentication, the physical characteristic ispresents themselves for entity authentication, the physical characteristic is measured by a reader, digitally encoded, and then compared with themeasured by a reader, digitally encoded, and then compared with the template.template.
  • 10. 1010 Something you areSomething you are  Biometric system modelBiometric system model Raw data Extracted features Template Authentication decision Data collection Signal processing Matching Storage Match score DecisionApplication
  • 11. 1111 Something you areSomething you are  BiometricsBiometrics – StaticStatic (unchanging) measurements include fingerprints, hand geometry,(unchanging) measurements include fingerprints, hand geometry, face recognition, retina scan.face recognition, retina scan. – DynamicDynamic (changing) measurements include handwriting measurements(changing) measurements include handwriting measurements and voice recognition.and voice recognition. – There are many implementation issues and as yet entity authentication isThere are many implementation issues and as yet entity authentication is not widely provided using these techniques.not widely provided using these techniques.
  • 12. 1212 Something you areSomething you are Optical fingerprint sensor [Fingerprint Identification Unit FIU-001/500 by Sony] Fingerprints
  • 13. 1313 Something you knowSomething you know  Passwords: – Passwords are probably the most popular technique for providing entity authentication, despite concerns about how secure they actually are.  A password may be a sequence of charactersA password may be a sequence of characters – Examples: 10 digits, a string of letters,Examples: 10 digits, a string of letters, etcetc.. – Generated randomly, by user, by computer with user inputGenerated randomly, by user, by computer with user input  A password may be a sequence of wordsA password may be a sequence of words – Examples: pass-phrasesExamples: pass-phrases – AA pass-phrasepass-phrase is a sequence of characters that it is too long to be ais a sequence of characters that it is too long to be a password and it is thus turned into a shorter virtual password by thepassword and it is thus turned into a shorter virtual password by the password systempassword system  AlgorithmsAlgorithms – Examples: one-time passwords, challenge-response.Examples: one-time passwords, challenge-response.
  • 14. 1414 Password storagePassword storage  Passwords stored in plaintext filesPasswords stored in plaintext files – If password file compromised, all passwords are revealedIf password file compromised, all passwords are revealed – Usually password files are read- and write- protectedUsually password files are read- and write- protected  Passwords stored in encrypted filePasswords stored in encrypted file – Encrypted/hashed versions of passwords are stored in a password fileEncrypted/hashed versions of passwords are stored in a password file  Examples:Examples: – A Windows password is stored as a MD4 hash value.A Windows password is stored as a MD4 hash value. – A Unix password is stored as a Unix DES Encryption.A Unix password is stored as a Unix DES Encryption.
  • 15. 1515 Unix PasswordUnix Password  Example: Original UnixExample: Original Unix – A password is up to eight charactersA password is up to eight characters – The password is truncated to its first 8 ASCII characters, forming theThe password is truncated to its first 8 ASCII characters, forming the Unix DES keyUnix DES key – The key is used to encrypt the 64-bit constant 0.The key is used to encrypt the 64-bit constant 0. – The Unix DES is a variation of the standard DES.The Unix DES is a variation of the standard DES.  A 12-bitA 12-bit saltsalt is used to modify the expansion function in DES,is used to modify the expansion function in DES,  Then DES is iterated 25 timesThen DES is iterated 25 times – Thus the UNIX password is referred to asThus the UNIX password is referred to as salted passwordsalted password – Unix passwords are stored in fileUnix passwords are stored in file /etc/passwd/etc/passwd
  • 16. 1616 Attack on passwordsAttack on passwords  Replay of passwordsReplay of passwords – Specially when passwords are transmitted in cleartextSpecially when passwords are transmitted in cleartext  Exhaustive password searchExhaustive password search – Trying all possible passwordsTrying all possible passwords  Dictionary attackDictionary attack – Most users select passwords from a small subset of the password spaceMost users select passwords from a small subset of the password space (e.g., short passwords, dictionary words, proper names)(e.g., short passwords, dictionary words, proper names) – Dictionary attack: the attacker tries all possible words, found in anDictionary attack: the attacker tries all possible words, found in an available or on-line listavailable or on-line list
  • 17. 1717 Password selectionPassword selection  Problem: people pick easy to guess passwordsProblem: people pick easy to guess passwords – Based on account names, user names, computer names, place namesBased on account names, user names, computer names, place names – Too short, digits only, letters onlyToo short, digits only, letters only – License plates, acronyms, social security numbersLicense plates, acronyms, social security numbers – Personal characteristics (nicknames, job characteristics,Personal characteristics (nicknames, job characteristics, etcetc.).)  Good passwords can be constructed in several waysGood passwords can be constructed in several ways – Example: A password containing at least one digit, one letter, oneExample: A password containing at least one digit, one letter, one punctuation symbol, and one control character is usually a strongpunctuation symbol, and one control character is usually a strong passwordpassword
  • 18. 1818 One-Time PasswordsOne-Time Passwords  Problem with fixed passwords:Problem with fixed passwords: – If an attacker sees a password, he/she can laterIf an attacker sees a password, he/she can later replayreplay the passwordthe password  A partial solution: one-time passwordsA partial solution: one-time passwords – Password that can be used exactlyPassword that can be used exactly onceonce – After use, it is immediately invalidatedAfter use, it is immediately invalidated  ProblemsProblems – Synchronization of user and systemSynchronization of user and system – Generation of good random passwordsGeneration of good random passwords – Password distribution problemPassword distribution problem
  • 19. 1919 Challenge-ResponseChallenge-Response (Strong authentication)(Strong authentication)  Another alternative is to authenticate in such a way that theAnother alternative is to authenticate in such a way that the transmitted password changes each timetransmitted password changes each time  Let a userLet a user uu wishing to authenticate himself to a systemwishing to authenticate himself to a system SS. Let. Let uu andand SS have an agreed-on secret functionhave an agreed-on secret function ff. A. A challenge-responsechallenge-response authentication system is one in whichauthentication system is one in which SS sends a random messagesends a random message mm (the(the challengechallenge) to) to uu, and, and uu replies with the transformationreplies with the transformation rr == ff((mm) (the) (the responseresponse).). SS then validatesthen validates rr by computing itby computing it separately.separately.  TheThe challengechallenge may be a nonce, timestamp, sequence number, ormay be a nonce, timestamp, sequence number, or any combination.any combination.
  • 20. 2020 Challenge-ResponseChallenge-Response ((by symmetric-key techniques)  The user and system share a secret function f (in practice, f can be a known function with unknown parameters, such as a cryptographic key).  This called challenge-response by symmetric-key techniques. user system request to authenticate user system random message r (the challenge) user system f(r) (the response)
  • 21. 2121 Challenge-ResponseChallenge-Response (by public-key techniques)(by public-key techniques)  AA identifiesidentifies BB by checking whetherby checking whether BB holds the secret (private)holds the secret (private) keykey KRKRBB that matches the public keythat matches the public key KUKUBB  AA chooses a random challenge (nonce)chooses a random challenge (nonce) rrAA.. BB uses its randomuses its random noncenonce rrBB.. BB applies its public-key system for authenticationapplies its public-key system for authentication  Message sequence:Message sequence: 1.1. A → BA → B:: rrAA.. 2.2. B → AB → A:: rrBB,, EEKRKRBB (( rrAA,r,rBB))
  • 23. 2323 Cryptographic Key InfrastructureCryptographic Key Infrastructure  Goal: bind identity to keyGoal: bind identity to key  Symmetric Cryptography:Symmetric Cryptography: – Not possible as all keys are sharedNot possible as all keys are shared  Public key Cryptography:Public key Cryptography: – Bind identity to public keyBind identity to public key – Crucial as people will use key to communicate with principal whoseCrucial as people will use key to communicate with principal whose identity is bound to keyidentity is bound to key – Erroneous binding means no secrecy between principalsErroneous binding means no secrecy between principals – Assume principal identified by an acceptable nameAssume principal identified by an acceptable name
  • 24. 2424 CertificatesCertificates  A certificate is a token (message) containingA certificate is a token (message) containing – Identity of principal (e.g., Alice)Identity of principal (e.g., Alice) – Corresponding public keyCorresponding public key – Timestamp (when issued)Timestamp (when issued) – Other information (perhaps identity of signer)Other information (perhaps identity of signer) – Signature of a trusted authority (e.g., Cathy)Signature of a trusted authority (e.g., Cathy) CCAA == DDkvkv((KKpp || Alice |||| Alice || TT )) DDkvkv is Cathy’s private keyis Cathy’s private key CCAA is A’s certificateis A’s certificate
  • 25. 2525 Certificate UseCertificate Use  Bob gets Alice’s certificateBob gets Alice’s certificate – If he knows Cathy’s public key, he can validate the certificateIf he knows Cathy’s public key, he can validate the certificate  When was certificate issued?When was certificate issued?  Is the principal Alice?Is the principal Alice? – Now Bob has Alice’s public keyNow Bob has Alice’s public key  Problem:Problem: – Bob needs Cathy’s public key to validateBob needs Cathy’s public key to validate AliceAlice’s certificate’s certificate – Many solutions:Many solutions:  Public Key Infrastructure (PKI),Public Key Infrastructure (PKI),  Trust-based certificatesTrust-based certificates
  • 26. 2626 X.509 certificateX.509 certificate  Key certificate fields in X.509v3:Key certificate fields in X.509v3: – VersionVersion – Serial number (unique)Serial number (unique) – Signature algorithm identifier: hash algorithmSignature algorithm identifier: hash algorithm – Issuer’s name; uniquely identifies issuerIssuer’s name; uniquely identifies issuer – Interval of validityInterval of validity – Subject’s name; uniquely identifies subjectSubject’s name; uniquely identifies subject – Subject’s public keySubject’s public key – Signature:Signature:  Identifies algorithm used to sign the certificateIdentifies algorithm used to sign the certificate  Signature (enciphered hash)Signature (enciphered hash)  Issuer is called Certificate Authority (CA)Issuer is called Certificate Authority (CA)