Untitled

• Chapter 3 discusses User Authentication for computer security, lecture 2, course 23164404-3, at Umm Al-Qura University.
• RFC 4949 defines user authentication as verifying an identity claimed by or for a system entity.

Authentication Process

• Authentication is a fundamental building block and primary line of defense in computer security.
• Authentication forms the basis for access control and user accountability.
• The identification step involves presenting an identifier to the security system.
• The verification step involves presenting or generating authentication information to corroborate the binding between the entity and the identifier.
• E-Authentication uses a token and credential for authentication architecture.

Authentication Methods

• Authenticating the identity of a user can be based on three means:
• Something the user knows, like a password, personal identification number, or answers to prearranged questions.
• Something the user has, like tokens, smartcards, electronic keycards, or physical keys.
• Something the user is, defined as static biometrics, such as a fingerprint, retina, or face.
• Dynamic biometrics, which could be classified as something a user does, such as voice pattern, handwriting, or typing rhythm.

Risk Assessment

• Risk Assessment for User Authentication uses a risk assessment that has three separate concepts:
• Assurance Level.
• Potential Impact.
• Areas of Risk.

Assurance Level

• Assurance levels describe an organization's degree of certainty that a user has presented credentials that refer to their identity.
• It's defined specifically by:
• The degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued.
• The degree of confidence that the individual using the credential is the individual to whom the credential was issued.
• The Four Levels of Assurance:
• Level 1 has little or no confidence in the asserted identity's validity.
• Level 2 has some confidence in the asserted identity's validity.
• Level 3 has high confidence in the asserted identity's validity.
• Level 4 has a very high confidence in the asserted identity's validity.

Potential Impact

• FIPS 199 defines three levels of potential impact on organizations or individuals in case of a security breach:
• Low where authentication error could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals
• Moderate where authentication error could be expected to have a serious adverse effect
• High where authentication error could be expected to have a severe or catastrophic adverse effect

Potential Impact Categories

• Potential impact categories for authentication errors, and their assurance level impact profiles:
• Inconvenience, distress, or damage to standing/reputation: Low to High
• Financial loss or organization liability: None to High
• Harm to organization programs or interests: None to High
• Unauthorized release of sensitive information: None to High
• Civil or criminal violations: None to High

Password Authentication

• Password authentication is a widely used line of defense against intruders.
• Users must provide their name/login and password.
• The system compares the password with the one stored for that specified login.
• The user ID:
• Determines that the user is authorized to access the system
• Determines the user's privileges
• Is used in discretionary access control

Password Vulnerabilities

• Common password vulnerabilities include:
• Offline dictionary attack.
• Password guessing against a single user.
• Workstation hijacking.
• Electronic monitoring.
• Specific account attack.
• Popular Password attack.
• Exploiting user mistakes.
• Exploiting multiple password use.

Original UNIX Scheme

• The UNIX implementation originally involved:
• Up to eight printable characters in length.
• 12-bit salt used to modify DES encryption into a one-way hash function.
• Zero value repeatedly encrypted 25 times.
• Output translated to an 11-character sequence.
• The scheme is now regarded as inadequate.
• The scheme is still often required for compatibility with existing account management software or multi-vendor environments.

Improved Implementations

• OpenBSD uses a Blowfish block cipher-based hash algorithm called bcrypt.
• It is the most secure version of the Unix hash/salt scheme
• Uses 128-bit salt to create a 192- bit hash value
• A recommended hash function is based on MD5.
• Has a salt of up to 48-bits.
• Password length is unlimited.
• Produces 128-bit hash.
• Uses an inner loop with 1000 iterations to achieve slowdown.

Password Cracking

• Dictionary attacks involve developing a large dictionary of possible passwords and trying each against the password file.
• Each password must be hashed using each salt value and then compared to stored hash values
• Rainbow table attacks pre-compute tables of hash values for all salts.
• The attack is performed with a mammoth table of hash values.
• Can be countered by using a sufficiently large salt value and a sufficiently large hash length.
• Password crackers exploit the fact that people choose easily guessable passwords, and shorter password lengths are also easier to crack.
• John the Ripper is an open-source password cracker first developed in 1996
• Uses a combination of brute-force and dictionary techniques.

Modern Approaches

• Modern password approaches include enforcing a complex password policy.
• This forces users to pick stronger passwords.
• Password-cracking techniques have also improved.
• This is due to the processing capacity for password cracking increasing dramatically.
• Sophisticated algorithms are now being used to generate potential passwords.
• Studying examples and structures of actual passwords in use is common.

Password File Access Control

• Password File Access Control can be used to block offline guessing attacks by denying access to encrypted passwords.
• Weaknesses can include the Shadow password file, weaknesses in operating systems, accidental permissions making the file readable, users with the same password on other systems, access from backup media, and sniffing passwords in network traffic.

Password Selection Strategies

• Strategies for achieving better password selection include:
• User education, so users understand the importance of using hard-to-guess passwords.
• Computer generated passwords if users have trouble remembering them.
• Reactive password checking where the system periodically runs its own password cracker to find guessable passwords.
• Complex password policy, where users are allowed to select their own password, however the system checks to see if the password is allowable, and if not, rejects it.
• The goal is to eliminate guessable passwords while allowing the user to select a password that is memorable.

Proactive Password Checking

• Proactive Password Checking involves using:
• Password cracker.
• Rule enforcement.
• Bloom Filter.

Tokens

• Tokens come in the form of:
• Memory cards
• Smart cards
• Electronic Identity cards

Memory Cards

• Memory cards can store but not process data.
• The most common memory card is the magnetic stripe card.
• Memory cards can include an internal electronic memory.
• Memory cards rely solely on physical access.
• For example, Hotel room keycards.
• For example, ATM Debit cards.
• A special reader is required.
• Memory cards provide significantly greater security when combined with a password or PIN.
• Drawbacks of memory cards include:
• Requiring a special reader limits usefulness.
• The loss of a token compromises physical access.
• User dissatisfaction is seen because of extra authentication steps/devices.

Smart Tokens

• Physical characteristics include:
  • Embedded microprocessor.
  • A smart token that looks like a bank card.
  • The functionality is installed into calculators, keys, and small portable objects.
• Authentication protocol includes:
• Classified into three categories:
• Static.
• Dynamic password generator.
• Challenge-response.
• Smart tokens typically include three types of memory:
• Read-only memory (ROM) that stores data that doesn't change during the card's life.
• Electrically erasable programmable ROM (EEPROM) that holds application data and programs.
• Random access memory (RAM) that holds temporary data generated when applications are executed.

Electric Identity Cards

• The most advanced deployment for electronic identity cards is the German card "neuer Personalausweis"
• Use of a smart card as a national identity card for citizens:
• Such cards can provide stronger proof of identity and can be used in a wider variety of applications.
• Electronic functions and data for eID cards:
• ePass with Face image; two fingerprint images (optional), MRZ data for biometric identity verification
• Online applications read family and given names; artist name and doctrinal degree: date and place of birth; address and community, ID; for age verification
• Password Authenticated Connection Establishment (PACE) can be used.
• It ensures that the contactless RF chip in the eID card cannot be read without explicit access control
• For online applications, access is established by the user entering the 6-digit PIN (which should only be known to the holder of the card)
• For offline applications, either the MRZ printed on the back of the card or the six-digit card access number (CAN) printed on the front is used.

Biometric Authentication

• Biometric Authentication attempts to authenticate an individual based on unique physical characteristics; it is based on pattern recognition.
• Authentication is technically complex and expensive when compared to passwords and tokens.
• Physical characteristics used include:
• Facial characteristics
• Fingerprints
• Hand geometry
• Retinal pattern
• Iris
• Signature
• Voice.

Remote User Authentication

• Authentication over a network, the Internet, or a communications link is complex.
• Remote user Authentication has additional security threats such as:
• Eavesdropping, capturing a password, replaying an authentication sequence that has been observed
• Remote User Authentication relies generally on a challenge-response protocol to counter threats.

Attacks

• Common attacks include:
• Client Attack
• Host Attack.
• Eavesdropping.
• Replay.