Lecture 5: User Authentication Methods
I. The Fundamental Principle of User Authentication
Authentication is the process of verifying a claimed identity. Before a system can
enforce any Access Control policy (determining what a user can do), it must first
confirm who the user is. This process is crucial because all security controls operate
based on the validated identity of the user.
Authentication methods are traditionally based on verifying one or more of three
fundamental factors:
1. Something the user knows (e.g., a password or PIN).
2. Something the user has (e.g., a smart card or security token).
3. Something the user is (e.g., a fingerprint or retina scan).
II. Authentication Models (The Three Factors)
A. Knowledge Factor (What You Know)
This is the most common and historically oldest form of authentication. The user
proves their identity by providing a secret piece of information known only to them.
Password-Based Authentication: The user provides a string of characters
(password) that is compared to a stored, secured version (a salted hash) of the user's
secret.
o Theoretical Weakness: Passwords are highly susceptible to social engineering,
phishing, and offline brute-force/dictionary attacks if the database of hashes is
compromised. The security relies entirely on the user choosing a sufficiently complex
secret and keeping it private.
o Solutions: Modern systems mandate strong password policies (length, complexity),
use salting and stretching (e.g., bcrypt) to slow down offline cracking, and enforce
mechanisms to detect and block online attacks (e.g., account lockout after failed
attempts).
B. Possession Factor (What You Have)
This method relies on the user possessing a physical or logical device that is difficult
to duplicate.
Token-Based Authentication: Requires a physical device (the token) to generate or
contain a secret used during the login process.
o Smart Cards (Contact/Contactless): A physical card containing an embedded
microchip that performs cryptographic functions (e.g., storing private keys, executing
challenge-response authentication). They are difficult to clone and can perform on-
board processing, reducing the risk of key exposure.
o One-Time Passwords (OTP): These tokens generate a unique, temporary code for
each login session.
Time-Based OTP (TOTP): The code changes every 30 or 60 seconds, based on a
shared secret key and the current time.
HMAC-Based OTP (HOTP): The code changes based on a shared secret key and a
moving counter (requires synchronization).
o Theoretical Strength: Token possession adds a layer of physical security, making it
difficult for an attacker to authenticate remotely without acquiring the physical
device.
C. Inherence Factor (What You Are)
Biometric Authentication verifies a user's identity based on inherent physical or
behavioral characteristics.
Physical Biometrics:
o Fingerprint Scanning: Capturing and matching the unique ridges and valleys of a
finger.
o Retinal/Iris Scanning: Measuring the unique patterns of the eye.
o Facial Recognition: Mapping unique facial features.
Behavioral Biometrics: Analyzing patterns unique to the user, such as typing
cadence, gait, or mouse movements.
Theoretical Strength: Biometrics are inherently linked to the user and are difficult to
forget or share.
Theoretical Weakness: Biometric data, unlike a password, cannot be changed if
compromised. This raises significant concerns regarding storage and template
security. The system must also account for False Acceptance Rate (FAR) and False
Rejection Rate (FRR).
III. Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) is a security approach that requires a user to
provide two or more distinct verification factors from different categories
(Knowledge, Possession, Inherence) to gain access.
Definition: MFA is the crucial defense-in-depth mechanism for user access, ensuring
that the compromise of one factor (e.g., a stolen password) is insufficient to grant
access.
Two-Factor Authentication (2FA): A subset of MFA requiring exactly two distinct
factors (e.g., Password + OTP).
Theoretical Strength: MFA provides resilience. A phishing attack might steal the
password (Knowledge), but it cannot simultaneously steal the user's physical phone
(Possession) or fingerprint (Inherence). This is the current best practice for securing
critical accounts.
IV. The Password Problem and Solutions
Despite the push for MFA, passwords remain the primary authentication factor. Their
inherent weaknesses drive much of the authentication security focus.
A. Theoretical Problems with Passwords
1. Human Factors: Users choose short, predictable, or reused passwords for
convenience.
2. Compromise via Guessing/Brute Force: Offline attacks can crack millions of
simple hashes per second.
3. Phishing/Social Engineering: Passwords can be tricked out of users.
B. Modern Solutions to Password Weakness
Password Hashing with Salt and Stretching:
o Salt: A unique, random value added to the plaintext password before hashing,
ensuring that identical passwords result in unique hashes, defeating Rainbow Table
attacks.
o Stretching: Using algorithms like Bcrypt, Scrypt, or Argon2 that are deliberately
resource-intensive (slow) to make offline brute-forcing prohibitively expensive for
attackers.
Passwordless Authentication: Emerging systems aim to eliminate passwords
entirely, relying instead on high-assurance possession and biometric factors, such as
FIDO (Fast IDentity Online) tokens, which use asymmetric cryptography for
authentication.