NIST SP 800-171: Identification and Authentication

• NIST SP 800-63-3 defines digital user authentication as establishing confidence in user identities presented electronically to an information system.

Identification and Authentication (NIST SP 800-171)

• Basic security requirements include identifying users, processes, or devices.
• Authentication verifies the identities of users, processes, or devices before granting access.
• Derived security requirements include using multifactor authentication for local and network access.
• Replay-resistant authentication mechanisms should be used for network access.
• Prevent reuse of identifiers for a defined period.
• Disable identifiers after a defined period of inactivity.
• Enforce password complexity and character changes when new passwords are created.
• Password reuse should be prohibited for a number of generations.
• Use temporary passwords for system logons with immediate change to permanent passwords.
• Store and transmit only cryptographically protected passwords.
• Obscure feedback of authentication information.

NIST SP 800-63-3 E-Authentication Architectural Model

• The model includes registration, credential issuance, and maintenance.
• Key components are the Registration Authority (RA), Subscriber/Claimant, and Relying Party (RP).
• The Credential Service Provider (CSP) issues tokens/credentials.
• The process involves identity proofing, user registration, token/credential registration, and validation.

Means of Authenticating User Identity

• Something the individual knows, like passwords, PINs, or answers to questions.
• Something the individual possesses, such as a smartcard, electronic keycard, or physical key.
• Something the individual is (static biometrics), like fingerprint, retina, or face.
• Something the individual does (dynamic biometrics), like voice pattern, handwriting, or typing rhythm.

Multifactor Authentication

• Multifactor authentication utilizes multiple authentication factors for increased security.
• The client must pass authentication using multiple factors.

Risk Assessment for User Authentication

• Assurance Level refers to the degree of certainty that a user has presented a credential that refers to their identity.
• Potential Impact relates to the level of impact on organizations or individuals should a breach of security occur.
• Areas of Risk need to be assessed and considered.

Assurance Level Details

• Assurance Level describes the degree of certainty regarding a user's presented credential.
• It reflects confidence in the vetting process for credential issuance, and confidence that the user of the credential is the correct individual.
• There are four assurance levels: Level 1 (little to no confidence), Level 2 (some confidence), Level 3 (high confidence), and Level 4 (very high confidence).

Potential Impact

• FIPS 199 defines three levels of potential impact on organizations/individuals if a security breach occurs.
• Low impact means the authentication error has a limited adverse effect on organizational operations.
• Moderate impact means the authentication error has a serious adverse effect.
• High impact means the authentication error has a severe or catastrophic adverse effect.

Maximum Potential Impacts for Each Assurance Level

• Inconvenience, distress, or damage to standing/reputation ranges from low to high across assurance levels.
• Financial loss increases from low to high across assurance levels.
• Harm to organization programs/interests ranges from none to high across assurance levels.
• Unauthorized data release ranges from none to high across assurance levels.
• Personal safety increases none to mod/high across assurance levels.
• Civil/criminal violations range from none to high across assurance levels.

Password-Based Authentication

• It's a widely used defense line against intruders.
• The user provides name/login and password.
• The system compares the password to the one stored for the specified login.
• The User ID determines authorization and previleges in the system

Password Vulnerabilities

• Offline dictionary attack
• Specific account attack
• Popular password attack
• Password guessing against single user
• Workstation hijacking.
• Exploiting user mistakes
• Exploiting multiple password use
• Electronic monitoring

UNIX Password Scheme

• The scheme involves loading a new password and verifying a password.
• It uses a password file with User ID, Salt, and Hash code.
• A slow hash function is applied.

UNIX Implementation

• The original scheme used up to eight printable characters.
• It employed a 12-bit salt to modify DES encryption into a one-way hash function.
• Zero value was repeatedly encrypted 25 times.
• Output was translated to an 11 character sequence.
• This implementation is now regarded as inadequate.
• However, it's still required for compatibility with existing account management software.

Improved Implementations

• Stronger hash/salt schemes are available for Unix.
• The recommended hash function is based on MD5.
• Salt can be up to 48-bits, and password length is unlimited.
• It produces a 128-bit hash.
• Uses an inner loop with 1000 iterations for slowdown.
• OpenBSD uses a Blowfish block cipher based hash algorithm called Bcrypt (most secure version).
• Uses a 128-bit salt to create a 192-bit hash value.

Password Cracking

• Employing dictionary attacks (using dictionary of possible passwords).
• Rainbow table attacks use precomputed hash tables for salts.
• Password crackers exploit easily guessable passwords.
• Shorter passwords lengths are easier to crack.
• John the Ripper is an open-source password cracker (developed in 1996).
• John the Ripper uses brute-force and dictionary techniques.

Modern Approaches

• Complex password policy to force strong passwords.
• Improved password-cracking techniques.
• Increased processing capacity for password cracking.
• Use of sophisticated algorithms to generate potential passwords.
• Studying examples and structures of actual passwords in use.

Password File Access Control

• It can block offline guessing attacks via denying access to encrypted passwords.
• Make available only to privileged users (shadow password file).
• Vulnerabilities include weakness in the OS, accident with permissions, users with same password on other systems, access from backup media, and sniffing passwords.

Password Selection Strategies

• User education regarding the importance of strong passwords.
• Computer generated passwords (users often have trouble remembering them).
• Reactive password checking (periodic system check).
• Complex password policy (user selects password, system checks it, goal is memorability).

Proactive Password Checking

• Rule enforcement (specific rules passwords must adhere to).
• Password checker (compiles dictionary of passwords not to use).
• Bloom filter is used to build a table based on hash values.
• The desired password is checked against the table.

Types of Cards Used as Tokens

• Embossed cards have raised characters only, such as old credit cards.
• Magnetic stripe cards have a magnetic bar on the back, such as bank cards.
• Memory cards have electronic memory inside, like prepaid phone cards.
• Smart cards have electronic memory and a processor inside, like Biometric ID cards.
• Contactless cards have electrical contacts exposed on the surface or a radio antenna embedded inside.

Memory Cards

• Memory cards can store data but not process it.
• The most common example is the magnetic stripe card.
• They can include an internal electronic memory.
• Usable alone for physical access (hotel room, ATM).
• Provides significantly greater security when combined with a password/PIN.
• Drawbacks include the requirement for a special reader, loss of token, and user dissatisfaction.

Smart Tokens

• Physical characteristics include an embedded microprocessor.
• A smart token can resemble a bank card, calculator, keys, or small portable object.
• Manual interfaces include a keypad and display for human/token interaction.
• Electronic interfaces require a compatible reader/writer.
• Authentication protocol: Static, dynamic password generator, challenge-response.

Smart Cards

• They are the most important category of smart token.
• Appearance of credit card
• Contains and Entire Microprocessor
• Has an electronic interface.
• Contains a Processor
• Has a memory
• Has I/O ports.
• May use any of the smart token protocols.

Smart Cards Memory

• Contains Read-only memory (ROM).
• Stores data that does not change during the card's life.
• Electrically erasable programmable ROM (EEPROM).
• Holds application data and programs.
• Random access memory (RAM).
• Holds temporary data generated when applications are executed.

Electronic Identity Cards (eID)

• Smart card as a national identity card for citizens.
• Serves the same purposes as national ID cards, driver's licenses, for access to government and commercial services.
• Provides stronger proof of identity and can be used in a wider variety of applications.
• A smart card verified by the national government as valid and authentic.

Electronic Functions and Data for eID Cards

• Most advanced deployment is the German card neuer Personalausweis.
• Data printed on its surface includes personal data, document number, card access number (CAN), and machine readable zone (MRZ).
• ePass authorizes offline inspection systems read the data.
• elD allows online applications read the data or access functions as authorized.
• eSign allows a certification authority installs the signature certificate online.
• Citizens make signature creation of electronic signature with eSign PIN.

Password Authenticated Connection Establishment (PACE)

• It ensures the contactless RF chip is not read without explicit access control.
• Established by the user entering the 6-digit PIN.
• For offline applications, either the MRZ printed on the card or the six-digit card access number (CAN) printed on the front is used.

Biometric Authentication

• Attempts to authenticate an individual based on unique physical characteristics.
• Based on pattern recognition.
• Technically complex and expensive compared to passwords/tokens.
• Physical characteristics include facial characteristics, fingerprints, hand geometry, retinal pattern, iris, signature, and voice.

Generic Biometric System Enrollment

• Enrollment creates an association between a user and the user's biometric characteristics.
• User authentication can be done by verifying a user or finding an unknown user

Profiles of a Biometric Characteristic

• Comparison between presented feature and a reference feature is reduced to a single numeric value.
• If the input value (s) is greater than a preassigned threshold (t), a match is declared.

Remote User Authentication

• Authentication is more complex over a network/Internet.
• Additional security threats include eavesdropping, capturing passwords, and replaying authentication sequences.
• Typically relies on a challenge-response protocol to counter threats.

Potential Attacks, Susceptible Authenticators, and Typical Defenses

• Client attacks (guessing, Brute force) and Host attacks.
• Replay with password or token.
• Trojan Horse installation.
• Denial of Service flood attack.

Authentication Security Issues

• Eavesdropping: Adversary attempts to learn the password via physical proximity
• Host Attacks: Directed at the user file at the host where passwords are stored
• Replay: Adversary repeats a previously captured user response
• Client Attacks: Adversary attempts to achieve user authentication without direct access to the remote host.
• Trojan Horse: masquerades to capture credentials
• Denial-of-Service: Attempts to disable authentication service by flooding it with requests.

Key summary points

• Digital user authentication principles
• A model for digital user authentication
• Means of authentication
• Risk assessment for user authentication
• Password-based authentication
• The vulnerability of passwords
• The use of hashed passwords
• Password cracking of user-chosen passwords
• Password file access control
• Password selection strategies
• Token-based authentication
• Memory cards
• Smart cards
• Electronic identity cards
• Biometric authentication
• Physical characteristics used in biometric applications
• Operation of a biometric authentication system
• Biometric accuracy
• Remote user authentication
• Password protocol
• Token protocol
• Static biometric protocol
• Dynamic biometric protocol
• Security issues for user authentication