U4.2 Protocols for entity authentication

U4.2 Protocols for entity authentication

1. 2 Types of EA

   • Unilateral EA
     • EA that provides one entity with assurance of the others identity but not visa versa
     • Most e-commerce applications use Unilateral
   • mutual EA
     • EA that provides both entities with assurance of each others identily
       • IE: UMTS: mobile handsets

2. Weak EA

   • 1 entity provides its identity using a protocol but the secret is revealed during the protocol
     • IE: Password auth, password transmitted in clear. would need to hash for it to be stronger
       • Hashing is still vulnerable to dictionary attack so strong non dictionary passwords are needed

3. Strong EA

   • 1 entity proves its identity to another by demonstrating knowledge of a secret known to be associated with that entity
     • Must be done without revealing that secret during the protocol
       • Sometimes known as a challenge -response protocol
         • Encryption, MAC's, Signatures used to protect messages in the protocol

4. Zero-Knowledge Identification Protocols

   • Protocols where A proves to B that she knows the factorisation of a large number without B learning anything about that factorisation
   • Stronger than Challenge-Response

5. EA protocols must ensure the responses are Fresh

   • Freshness
     • Assurance that a message has not been used previously and had originated in an acceptable timeframe
       • Is a property of an individual message that has been generated after a request
     • Uses Clock based mechanisms, sequence numbers and Nonces
       • Nonces must be random and unpredictable, not incrementing
       • Time Stamps include the date and time to check for freshness, must be encrypted
       • Sequence numbers (logical time stamps) these incremented. Must be crypto protected
     • Freshness of a message together with authenticity of origin can assure liveness of the principal
       • Assurance that a principal is live is required for EA
   • Liveness
     • Assurance that a principal sent a particular message within an acceptably recent timeframe
       • Is a property of a principal
   • To prevent againt replay attacks

6. Purely about verifying the identity of another entity - who am i talking to

   • Entity Authentication is the corroboration that an entity is the one claimed at a particular point in time
     • Timing is important because an entity cant confirm if they are still authenticating with the same entity beyond that moment when authentication has taken place
       • On its own Entity is therefore limited