User Authentication Methods

User Authentication

• RFC 4949 defines user authentication as the process of verifying an identity claimed by or for a system entity.
• It is a fundamental building block and primary line of defense,
• It is the basis for access control and user accountability.

Authentication Process

• It involves an identification step and a verification step.
• The identification step presents an identifier to the security system.
• The verification step presents or generates authentication information confirming the binding between the entity and the identifier.

Means of Authenticating User Identity

• Something the individual knows, such as a Password, PIN, or answers to prearranged questions.
• Something the individual possesses (token), such as a smartcard, electronic keycard, or physical key.
• Something the individual is ( static biometrics), such as a fingerprint, retina, or face.
• Something the individual does (dynamic biometrics), such as a voice pattern, handwriting, or typing rhythm.

Password Authentication

• Widely used line of defense against intruders.
• The user provides a name/login and password.
• The system compares the provided password with the one stored for that specified login.
• The user ID determines authorization to access the system, the user's privileges, and discretionary access control.

Password Vulnerabilities

• Offline dictionary attacks.
• Password guessing against a single user.
• Workstation hijacking.
• Electronic monitoring.
• Specific account attacks.
• Popular password attacks.
• Exploiting user mistakes.
• Exploiting multiple password use.

UNIX Password Scheme

• When loading a new password, a salt is combined with the password and fed into a slow hash function.
• The output is stored in the password file along with the user ID and salt.
• To verify a password, the system selects the user ID, salt, and hash code from the password file.
• combines the provided password with the salt, applies the slow hash function, and compares the result to the stored hash code.

UNIX Implementation

• An original scheme involves up to eight printable characters in length,
• It involves a 12-bit salt used to modify DES encryption into a one-way hash function,
• It involves a zero value repeatedly encrypted 25 times, and translated into an 11-character sequence.
• The original scheme with printable characters is now regarded as inadequate but is required for compatibility in existing systems.

Improved Implementations

• A recommendation of the hash function suggests basing it on MD5 with a salt of up to 48 bits.
• An improved implementation's password length is unlimited and it produces a 128-bit hash.
• A loop of 1000 iterations is used to achieve slowdown.
• OpenBSD uses Blowfish block cipher-based hash algorithm called Bcrypt.
• Bcrypt is the most secure version of Unix hash/salt scheme,
• It uses a 128-bit salt to create a 192-bit hash value.

Password Cracking

• Dictionary attacks involve developing a large dictionary of possible passwords and trying each one against the password file.
• Each password must be hashed using each salt value and then compared to stored hash values.
• Rainbow table attacks pre-compute tables of hash values for all salts, creating a large table of hash values.
• Can be countered by using a sufficiently large salt value and a sufficiently large hash length
• Password crackers exploit the fact that people choose easily guessable passwords.
• Shorter password lengths are also easier to crack.
• John the Ripper is an open-source password cracker that was developed in 1996.
• A combination of brute-force and dictionary techniques are used.

Modern Approaches to Passwords

• A comples password policy should force users to pick stronger passwords.
• Password-cracking techniques have also improved drastically, where there is an increase of the processing capacity,
• The use of sophisticatedalgorithms, and study of actual passwords in use.

Password File Access Control

• Offline guessing attacks are prevented by denying access to encrypted passwords.
• The weaknesses in the OS ,Accidents related to permissons, , users having multiple accounts, and access through media or network traffic may lead to vulnerabilities.

Password Selection Strategies

• User education is recommended to promote the usage of hard-to-guess passwords and selecting guidelines for selecting strong passwords.
• Computer generated passwords cause trouble with the users remembering them.
• Reactive password checking can take form when the system peridically runs its own password cracker to find guessable passwords.
• Complex password policies, where the user is allowed to select their own password is encouraged, however is checked by a system where otherwise will reject the password.

Proactive Password Checking

• An effective password checker technique that rejects a word on a list that has been implemented on systems.
• Password Cracker - Compile a large dictionary of passwords
• Rule enforcement - apply multiple rules that passwords must adhere to
• Bloom Filter - Use dictionary table and hashes to check desired password

Token-Based Authentication

• Used with memory cards, smart cards, and electronic identity cards.

Types of Cards

• Embossed cards typically used on old credit carts, Raised characters only, on front.
• Magnetic Stripe Cards, Magnetic bar on characters on front.
• Memory Cards, Electrical Memory inside, could be used for a prepaid phone card.
• Smart contact Cards, Electricial memory and processor inside, electrical contacts exposed on surface.
• Smart contacless cards, Radio Attenna Embedded inside.

Memory Cards

• They can store but not process data.
• The most common is the magnetic stripe card.
• They can include internal electronic memory, and can be used alone for physical access such as hotel rooms and ATMs.
• Provides significantly greater security when combined with a password or PIN.
• Drawbacks are that this requires a special reader, loss of the token, and user dissatisfaction if used for computers.

Smart Tokens Physical Characteristics

• Include an embedded microprocessor.
• A smart token looks like a bank card and can look like calculators, keys, small portable objects.
• Interfaces can be Manual which includes the keypad for interface, or electronic where it communicates/reads data

Smart Tokens Authentication

• Static Authentication
• Dynamic password generator
• Challange-Response

Smart Cards

• Most important category of smart token, it has the appeareance of a credit card, and an electronic interface.
• Includes an entire microprocessor, with an I/O port
• Stores read-only memory (ROM), and electrically erasable progrqammable ROM (EEPROM), and RAM

Smart Card Activation

• Activated through an ATR (answer to reset) followed by a protocal called PTS.

Electronic Identity Cards (eID)

• Serves as a national identity card, driver's license, for access to commercial services.
• Provides stronger proof of identity and a wider variety of applications.
• Is a smart card that has been verified by the national government as valid and authentic.
• A key example is the German Card, which has a readable data prinited such as Name and Birthdate.

Password Authenticated Connection Establishment (PACE)

• Ensures that contactelss RF chips cannot be reead without explicit access control
• Online applications need acess that is established with a 6-digit PIN
• Offline applications use an MRZ code on the back, or 6-digit card (CAN) on the front.

Electronic Functions and Data for eID Cards

• ePass: Reserved for government usage with biometric functions
• eID: Stores identity records that require cardholder permissons
• eSign: Certifcation with electronic signatures.

Biometric Authentication

• Attempts to authenticate individuals based on unique physical characteristics based on patter recognition.
• Is technically complex and expensive than passwords or tokens,
• Physical characteristics such are Iris, Fingerprins, Hand geometry and voice.

Biometric Profiles

• Biometrics work by measure profile types such as an inputer profile, genuir profile, average score and matching scores.

High Security Applications

• A high security application may require a very low false match rate.

Forensic Applications

• For forensic applications, require low false non-match rates.

Remote User Authentication

• Authentication over the internet or a communications link is more complex
• Adds Security threats; eavesdropping, capturing passwords, replaying authentification sequence
• Requires relies some form of challange-response

Authentification and Security Issues

• Includes Denial of Services, Eveasdropping, Trojan Horses, Client Attacks, Host Attacks and Replay.