Kandahar University
Computer Science
Faculty
Network department
Advanced Computer Network -
CS740
Lecture 3
User Authentication
TA. Shams Rashidy
[Link]@[Link]
Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Conttents
1 Learning Objectives
2 Introductoin
3 Password-Based Authentication
4 Token-Based Authentication
5 Security Issues for User Authentication
6 Practical Application: An Iris Biometric System
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Learning Objectives
• Discuss the four general means of authenticating a
users identity.
• Explain the mechanism by which hashed passwords are used
for user authentication.
• Understand the use of the Bloom filter in
password management.
• Present an overview of token-based user
authentication.
• Discuss the issues involved and the approaches for
remote user authentication.
• Summarize some of the key security issues for
user authentication.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Introduction
• In most computer security contexts, user authentication is the
fundamental build- ing block and the primary line of defense.
• User authentication is the basis for most types of
access control and for user accountability
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Two parts to access control
• Authentication: Are you who you say you are?
– Determine whether access is allowed
– Authenticate human to machine
– Or authenticate machine to machine
• Authorization: Are you allowed to do that?
– Once you have access, what can you do?
– Enforces limits on actions
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Are You Who You Say You Are?
• How to authenticate human a machine?
• Can be based on…
– Something you know
• For example, a password
– Something you have
• For example, a smartcard
– Something you are
• For example, your fingerprint
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
RFC 4949 Definition
• The process of verifying an identity claimed by or for a system entity.
• An authentication process consists of two steps:
● Identification step: Presenting an identifier to the security system. (Identifiers
should be assigned carefully, because authenticated identities are the basis for
other security services, such as access control service.)
● Verification step: Presenting or generating authentication information that
corroborates the binding between the entity and the identifier.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Electronic User Authentication Principles
E- Authentication
NIST SP 800-63-2 (Electronic Authentication Guideline,
August 2013) defines elec- tronic user authentication as the
process of establishing confidence in user iden- tities that are
presented electronically to an information system.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
A Model for Electronic User
Authentication
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Means of Authentication
• Something the individual knows: Examples includes a password, a personal identification
number (PIN), or answers to a prearranged set of questions.
• Something the individual possesses: Examples include electronic keycards, smart cards,
and physical keys. This type of authenticator is referred to as a token.
• Something the individual is (static biometrics): Examples include recognition by
fingerprint, retina, and face.
• Something the individual does (dynamic biometrics): Examples include recognition by
voice pattern, handwriting characteristics, and typing rhythm
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Something You Know
• Passwords
• Lots of things act as passwords!
– PIN
– Social security number
– Mother’s maiden name
– Date of birth
– Name of your pet, etc.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Trouble with Passwords
• “Passwords are one of the biggest practical problems facing
security engineers today.”
• “Humans are incapable of securely storing high-quality
cryptographic keys, and they have unacceptable speed and
accuracy when performing cryptographic operations. (They
are also large, expensive to maintain, difficult to manage, and
they pollute the environment. It is astonishing that these
devices continue to be manufactured and deployed.)”
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Why Passwords?
• Why is “something you know” more popular than “something
you have” and “something you are”?
• Cost: passwords are free
• Convenience: easier for admin to reset pwd than to issue a
new thumb
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Keys vs Passwords
• Crypto keys • Passwords
• Spse key is 64 bits • Spse passwords are 8 characters,
and 256 different characters
• Then 264 keys
• Then 2568 = 264 pwds
• Choose key at random… • Users do not select passwords at
• …then attacker must try random
about 263 keys • Attacker has far less than 263
pwds to try (dictionary attack)
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Password-Based Authentication
• A widely used line of defense against intruders is the
password system.
• The ID determines whether the user is authorized to gain
access to a system.
• The ID determines the privileges accorded to the user.
• The ID is used in what is referred to as discretionary access
control.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
The Vulnerability of Passwords
• Typically, a system that uses password-based
authentication maintains a password file indexed by user
ID
• Offline dictionary attack (methods and countermeasures)
• Specific account attack
• Popular password attack
• Password guessing against single user
• Workstation hijacking
• Exploiting user mistakes
• Exploiting multiple password use
• Electronic monitoring
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Password File?
• Bad idea to store passwords in a file
• But we need to verify passwords
• Cryptographic solution: hash the pwd
– Store y = h(password)
– Can verify entered password by hashing
– If Trudy obtains “password file,” she
does not obtain passwords
• But Trudy can try a forward search
– Guess x and check whether y = h(x)
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Dictionary Attack
• Trudy pre-computes h(x) for all x in a dictionary of common
passwords
• Suppose Trudy gets access to password file containing
hashed passwords
– She only needs to compare hashes to her pre-
computed dictionary
– After one-time work, actual attack is trivial
• Can we prevent this attack? Or at least make attacker’s
job more difficult?
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Password popularity
1 Techniques the utilize client-side hardware
2 Physical tokens, such as smart cards, are expensive or
inconvenient to carry around, especially if multiple tokens
are needed.
3 Schemes that rely on a single sign-on to multiple services
4 Automated password managers that relieve users of the
burden of knowing
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Good and Bad Passwords
• Bad passwords • Good Passwords?
– frank – jfIej,43j-EmmL+y
– Fido – 09864376537263
– password – P0kem0N
– 4444
– FSa7Yago
– Pikachu
– 0nceuP0nAt1m8
– 102560
– AustinStamp – PokeGCTall150
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Password Selection Strategies
• User education
• Most of the time it is ignored but we can use the first letter
of a phrase
• Computer-generated passwords
• Difficult to memorize but FIPS 181 password generator
generates well pronounced passwords.
• Reactive password checking
• Complex password policy
• complex password policy: A promising approach to improved
password security is a complex password policy, or proactive
password checker.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Possible approaches to proactive password
checking
• Rule Enforcement
• All passwords must be at least eight characters long.
• In the first eight characters, the passwords must include at
least one each of uppercase, lowercase, numeric digits, and
punctuation marks.
• Password Checker: Another possible procedure is simply
to compile a large dictionary of possible bad passwords.
• Space
• Time
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Passwords
• The bottom line…
• Password cracking is too easy
– One weak password may break security
– Users choose bad passwords
– Social engineering attacks, etc.
• Trudy has (almost) all of the advantages
• All of the math favors bad guys
• Passwords are a BIG security problem
– And will continue to be a big problem
– [Link] (Defcon)
– [Link]
(Bittorrent)
– [Link]
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Password Cracking Tools
• Popular password cracking tools
– Password Crackers
– Password Portal
– L0phtCrack and LC4 (Windows)
– John the Ripper (Unix)
• Admins should use these tools to test for weak passwords since
attackers will
• Good articles on password cracking
– Passwords - Conerstone of Computer Security
– Passwords revealed by sweet deal
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
More Password Cracking Tools
OrphCrack
[Link]
[Link]
[Link]
[Link]
Rainbow Tables
[Link]
[Link]
[Link]
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Token-Based Authentication
• Objects that a user possesses for the purpose of
user authentication are called tokens.
• Memory Cards
• Requires special reader
• Token loss
• User dissatisfaction
• Smart Cards
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Authentication card with
memory
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Smart Cards
• Physical characteristics: Smart tokens include an embedded
microprocessor.
• User interface: Manual interfaces include a keypad and display
for human token interaction.
• Electronic interface
• Contact
• Contactless:
• Authentication protocol: a protocol used with smart token
1 Static
2 Dynamic password generator
3 Challenge-response
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Authentication with smart card
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Electronic Identity Cards
• An application of increasing importance is the use of a
smart card as a national identity card for citizens.
• A national electronic identity (eID) card can serve the
same purposes as other national ID cards
• eID card is a smart card that has been verified by the national
government as valid and authentic.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Smart Card/Reader Exchange
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Popular eID Cards
• One of the most recent and most advanced eID
deployments is the German eID card neuer Personalausweis
• The card has human-readable data printed on its
surface, including the following:
• Personal data
• Document number
• Card access number (CAN)
• Machine readable zone (MRZ)
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
German eID Card
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
• ePass: This function is reserved for government use and
stores a digital representation of the cardholders
identity.
• eID: This function is for general-purpose use in a variety
of government and commercial applications.
• eSign: This optional function stores a private key and a
certificate verifying the key; it is used for generating a
digital signature.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
User Authentication with
eID
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Biometric Authentication
• A biometric authentication system attempts to
authenticate an individual based on his or her unique
physical characteristics.
• These include static characteristics:
• Fingerprints
• Hand geometry
• Facial characteristics
• Retinal and Iris patterns
• Signature
• Voice
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Operation of a Biometric Authentication
System
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Remote User Authentication
• The simplest form of user authentication is local authentication
• The more complex case is that of remote user authentication
• Remote user authentication raises additional security threats
• Token Protocol
• Static Biometric Protocol
• Dynamic Biometric Protocol
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Security Issues for User
Authentication
• As with any security service, user authentication, particularly
remote user authentication, is subject to a variety of
attacks.
• Client attack
• Host attack
• Eavesdropping, theft, and copying
• Replay
• Trojan horse
• Denial of service
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Practical Application: An Iris Biometric System
• As an example of a biometric user authentication system, we
look at an iris bio- metric system that was developed for use
by the United Arab Emirates (UAE)
• The UAE has a very substantial volume of incoming
visitors.
• On a typical day, more than 6,500 passengers enter the UAE
via seven international airports, three land ports, and seven
sea ports.
• Identify a single person from a large population of people
• Rely on a biometric feature that does not change over time
• Use biometric features that can be acquired quickly
• Be easy to use
• Respond in real-time for mass transit applications
• Be safe and non-invasive
• Scale into the billions of comparisons and maintain top
performance
NetSec
• Be affordable Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
General Iris Scan Site Architecture for UAE
System
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Recommended Reading
• Burr, W, et al. Electronic Authentication Guideline. Gaithersburg, MD:
National Institute of Standards and Technology, Special Publication 800632,
August 2013
• OGorman, L. Comparing Passwords, Tokens and Biometrics for User
Authentication. Proceedings of the IEEE, December 2003.
• Scarfone, K., and Souppaya, M. Guide to Enterprise Password Management
(Draft). NIST Special Publication SP 800-118 (Draft), April 2009.
NetSec Shams Rashidy | Network Security
Learning Objectives Introductoin Password-Based Authentication Token-Based Authentication Security Issues for User Authentica
Question?
NetSec Shams Rashidy | Network Security