Authentication
• Who is who?
• Identifies a user or a resource
• Establishes trust before communication can
take place
Authentication Mechanisms
• Passwords
• Message digests of passwords
• Authentication Tokens
• Certificate-based Authentication
• Biometrics
Password Authentication - 1
Login Screen
User id : _________
Password : _________
Ok Cancel
Fig 7.1
Password Authentication - 2
Server
Login request
Id = atul
Password = april
Fig 7.2
Password Authentication - 3
Id Password
Server Jyoti tiger
User authenticator program Amar n ewroad
Atul april
……
Id = atul
Password = april
Fig 7.3
Password Authentication - 4
Id Password
Server Jyoti tiger
User authenticator program Amar newroad
Atul april
……
Success
Fig 7.4
Password Authentication - 5
Server
Login successful
Application Menu
1. View Balance
2. Transfer money
….
Fig 7.5
Message Digests of Passwords
• Original clear text password is never
stored/transmitted
• Message digest of password is stored in the
database, and the same is used for
authentication
• Can lead to replay attacks
Message Digests of Passwords
Step 1: Calculate the message digests of the passwords on the server-side.
tiger G%6$1
newroad Vt^80+1
april +{:>9mn
…
Passwords Message digests of
Message digest
passwords
algorithm
Step 2: Store the user ids and message digests of the passwords in the user database.
Server User creation program Id Password
Jyoti G%6$1
Amar Vt^80+1
Atul +{:>9mn
User database
Fig 7.7
Authentication Tokens
• Token and server are synchronized initially
• Token generates fresh passwords
periodically
• Same passwords are generated at the server
Authentication Token Concept
Id = atul
Seed = 615019191
Server Id Seed
User record creation Jyoti 159010191
Amar 415901617
Atul 615019191
Seed = 615019191
User database
Seed
Authentication token
Fig 7.16
Authentication Token Types
Authentication Tokens
Challenge/Response Time-based Tokens
Tokens
Fig 7.19
Authentication Token Login
Login Screen
User Id Atul
Random Challenge 8102811291012
Your response
Fig 7.22
Certificate-based Authentication
• User’s certificate details need to be stored
on the server-side
• CA distributes the certificates to the users
also
• Validation between the two takes place at
the time of authentication
Digital Certificate Storage
Certificate
Certificate Server
Certification Authority
(CA) User database
Certificate Certificate Id Public Key Validity…
Jyoti1 59010191 June 2003
Amar 415901617 May 2002
Atul 615019191 July 2003
To respective users
Fig 7.29
Certificate-based Authentication
Step 1: User’s computer encrypts the random challenge with the user’s private key to
produce the digital signature.
Server
8102811291012 Original random
challenge
Encrypt Private key
file
90184112124832 User’s digital signature
Step 2: User’s computer sends the digital signature to the server as a part of the login
request.
Login request Server
Id = atul
Sign = 90184112124832
Fig 7.33
Smart Card Issues and Solutions
Problem/Issue Emerging solution
Smart card readers are not yet a part of a The new versions of computers and mobile devices
desktop computer, unlike a hard disk are expected to come with smart card readers out
drive or a floppy disk drive of the box.
Non-availability of smart card reader Microsoft has made the PC/SC smart card
driver software framework an integral part of the Windows 2000
operating system. Most smart card reader
manufacturers ship the PC/SC compliant reader
drivers, making the process of adding a reader
hardware to the computer a plug-and-play
operation.
Non availability of smart card aware Smart-card aware software such as Microsoft
cryptographic services software Crypto API (MS-CAPI) comes free with Internet
Explorer.
Cost of smart cards and card readers is This is reducing now. Smart cards are available for
high about $5, and the card readers for about $20.
Fig 7.36
Kerberos
• Protocol used for Single Sign On (SSO)
• Every user needs only one user id for
multiple applications/resources
• Kerberos takes care of access to multiple
resources, once the user logs on
Kerberos – Part 1
Alice AS
Login
Id = Alice
Fig 7.37
Kerberos – Part 2
Alice Output*
AS
Session key
Alice (KS)
Symmetric key shared with the Ticket
Granting Server (TGS) Encrypt
Session key (KS)
AS computes the output as shown below and TGT
sends it to Alice in response to her login
request.
KS+TGT
Symmetric key derived from
Alice’s password (KA) Encrypt
Output*
Fig 7.37
Kerberos – Part 3
Alice
Request for a SGT TGS
Output*
Timestamp
Encrypt Session key (KS)
AS computes the output as shown below and
sends it to the TGS.
Encrypted
Timestamp TGT Bob
(ET)
Output*
Fig 7.39
Kerberos – Part 4
Alice Output*
TGS
Alice KAB
B’s secret key Encrypt
Bob KAB
Session Key (KS) Encrypt
Output*
Fig 7.40
Kerberos – Part 5
Alice
Sending KAB Bob
Output*
Timestamp
Alice had received this from
Secret key to be shared
Encrypt the TGS in the previous step
by Alice and Bob
(KAB)
Encrypted
Timestamp (Alice + KAB) encrypted with Bob’s
(ET) secret key
Output*
Fig 7.41
Kerberos – Part 6
Alice
Bob
Encrypted Timestamp (ET)*
Timestamp sent by Alice. First
add 1 to it.
Secret key shared by
Encrypt Alice and Bob (KAB)
Encrypted
Timestamp
(ET)*
Fig 7.42
Single Sign On (SSO)
Approaches
Single Sign On (SSO)
Approaches
Script-based Approach Agent-based Approach
Fig 7.43