Crypto U8 (part 3), entity authentication

Crypto U8 (part 3), entity authentication

1. assurance that an expected entity is involved and currently part of a communication session

   • need
     • identity assurance
     • freshness
   • 2 kinds
     • mututal
       • both entities provide each other with assurance
     • unilateral
       • authentication of one entitiy to another
         • ex. ATM
   • can only be provided at one moment in time

2. used in 2 types of situatios

   • access control
   • part of more complex crypto processes

3. one approach to entity authentication: zero knowledge mechanisms??

   • wikipedia's article very clear!! :)
     • http://en.wikipedia.org/wiki/Zero-knowledge_proof#Abstract_example
   • useful when parties don't trust each other
   • With other authentication methods, some information about a key is leaked every time a transaction takes place.
   • 2 entities
     • prover
     • verifier
   • expensive to use

4. information used to provide assurance of identity

   • what user has
     • dumb token
       • ex. card with mag stripe
     • smart token
       • sometimes have built in user interfaces
       • have memory, processor, better storage of crypto info
       • ex. smartcard
     • usually used in combination with some other form of identity assurance like a pin
     • needs some form of reader
   • something the user is
     • biometrics
       • static
         • measures fixed characteristic like fingerprints
       • dynamic
         • measures characteristics that change slightly like voice
       • measurements of biometric info are digitalized stored for use
   • something the user knows
     • passwords, pins, passphrases
       • most common
       • problems
         • length
         • low complexity
         • repeated across systems
         • social engineering
         • password database attacks
         • shoulder surfing
       • should be crypto protected at all times
       • example of Unix password DB
         • when user attempts login, system pulls user hash from DB & applies to special DES implementation
         • covert password to 56 bit DES key and encrypt plaintext of all 0s 25 times
         • check to see if resulting value equals value stored in DB for password
     • dynamic passwords
       • Crypto U8, example dynamic password scheme
       • one time password schemes
         • 2 parts
           • password function
             • implemented on a smart token
               • this results in 2 factor authentication
           • input
             • must be fresh (uses freshness mechanism)
         • analysis
           • every time new auth challenge issued
           • local use of pin
           • 2 factor authentication
       • advantages
         • limits exposure
         • not repeatable