User Authentication

User authentication basicsSearch on YouTubeBookmarkSaved

DefinitionSearch on YouTubeBookmarkSaved

User authentication is the process of verifying an identity claimed by or for a system entity. It is a fundamental security building block. It is the basis of access control and user accountability.

User authentication has two steps:

1. Identification: the user specifies an identifier, for example a user name.
2. Verification: the system binds the entity (the person) and the identifier.

User authentication is distinct from message authentication. Message authentication shows that a message is not changed and comes from the claimed source. User authentication verifies the identity of a user.

Means of user authenticationSearch on YouTubeBookmarkSaved

There are four means to authenticate the identity of a user. They are based on something the individual:

• A system can use the means alone or combined, for example a smartcard and a PIN.
• All four means can provide user authentication.
• All four have issues. For example, an attacker can guess a password, and a user can lose a token.

Authentication protocolsSearch on YouTubeBookmarkSaved

Purpose and key issuesSearch on YouTubeBookmarkSaved

An authentication protocol convinces the parties of each other's identity. It also exchanges session keys. A protocol can be one-way (one party proves its identity) or mutual (both parties prove their identity).

The key issues are:

• Confidentiality: the protocol must protect the session keys.
• Timeliness: the protocol must prevent replay attacks.

Replay attacksSearch on YouTubeBookmarkSaved

In a replay attack, an attacker copies a valid signed message and resends it later. The standard types are:

CountermeasuresSearch on YouTubeBookmarkSaved

In challenge/response, the verifier sends a new nonce $N$. The other party returns an answer that depends on $N$, for example $f(N)$. An old answer does not match a new nonce, so a replay fails.

Symmetric key protocolsSearch on YouTubeBookmarkSaved

Two-level key hierarchySearch on YouTubeBookmarkSaved

With symmetric encryption, a system can use a two-level hierarchy of keys. Usually a trusted Key Distribution Center (KDC) controls it:

• Each party shares its own master key with the KDC.
• The KDC generates session keys for the connections between parties.
• The KDC uses the master keys to distribute the session keys.

Needham-Schroeder protocolSearch on YouTubeBookmarkSaved

The Needham-Schroeder protocol is the original third-party key distribution protocol. A KDC mediates a session between $A$ and $B$.

Notation: $K_a$ and $K_b$ are the master keys of $A$ and $B$. $K_s$ is the new session key. $N_1$ and $N_2$ are nonces. $\Vert$ is concatenation.

1. $A \to$ KDC: $ID_A \Vert ID_B \Vert N_1$
2. KDC $\to A$: $E(K_a, [K_s \Vert ID_B \Vert N_1 \Vert E(K_b, [K_s \Vert ID_A])])$
3. $A \to B$: $E(K_b, [K_s \Vert ID_A])$
4. $B \to A$: $E(K_s, [N_2])$
5. $A \to B$: $E(K_s, [f(N_2)])$

The protocol distributes a new session key securely for communications between $A$ and $B$.

Replay weakness and fixesSearch on YouTubeBookmarkSaved

The protocol is vulnerable to a replay attack if an old session key has been compromised. An attacker who knows an old $K_s$ resends message 3. $B$ then believes that it communicates with $A$. The attacker knows $K_s$, so he can also answer step 4.

The modifications that address this require:

• Timestamps in steps 2 and 3 (Denning, 1981).
• An extra nonce (Neuman, 1993).

One-way authenticationSearch on YouTubeBookmarkSaved

RequirementsSearch on YouTubeBookmarkSaved

One-way authentication is necessary when the sender and the receiver are not in communications at the same time, for example email.

• The header must be in clear, so the email system can deliver the message.
• The sender may want the contents of the body protected.
• The receiver may want the sender authenticated.

One-way protocol with a KDCSearch on YouTubeBookmarkSaved

This protocol is a refinement of the KDC protocol for secure email. $B$ is not online, so the protocol drops steps 4 and 5:

1. $A \to$ KDC: $ID_A \Vert ID_B \Vert N_1$
2. KDC $\to A$: $E(K_a, [K_s \Vert ID_B \Vert N_1 \Vert E(K_b, [K_s \Vert ID_A])])$
3. $A \to B$: $E(K_b, [K_s \Vert ID_A]) \Vert E(K_s, M)$

The protocol provides encryption and some authentication. Only $B$ can decrypt $K_s$, so only $B$ can read $M$. The KDC put $ID_A$ with $K_s$, so $B$ knows that the key is for a session with $A$.

Quick self-testSearch on YouTubeBookmarkSaved

Define user authentication and give its two steps.

User authentication is the process of verifying an identity claimed by or for a system entity. Step 1 is identification: the user specifies an identifier. Step 2 is verification: the system binds the entity and the identifier.

How is user authentication different from message authentication?

User authentication verifies the identity of a user. Message authentication shows that a message is not changed and comes from the claimed source.

Give the four means of user authentication with examples.

Something the individual knows (password, PIN), possesses (key, token, smartcard), is (static biometrics: fingerprint, retina) and does (dynamic biometrics: voice, signature).

What are the two key issues of authentication protocols?

Confidentiality, to protect the session keys. Timeliness, to prevent replay attacks.

Give the four types of replay attack.

Simple replay, repetition that can be logged, repetition that cannot be detected, and backward replay without modification.

Give the three countermeasures to replay attacks and the limit of each.

Sequence numbers are generally impractical. Timestamps need synchronized clocks. Challenge/response uses a unique nonce and needs both parties online.

Write the five steps of the Needham-Schroeder protocol.

(1) $A \to$ KDC: $ID_A \Vert ID_B \Vert N_1$. (2) KDC $\to A$: $E(K_a, [K_s \Vert ID_B \Vert N_1 \Vert E(K_b, [K_s \Vert ID_A])])$. (3) $A \to B$: $E(K_b, [K_s \Vert ID_A])$. (4) $B \to A$: $E(K_s, [N_2])$. (5) $A \to B$: $E(K_s, [f(N_2)])$.

What is the weakness of Needham-Schroeder and how is it fixed?

If an old session key is compromised, an attacker resends message 3 and $B$ believes it communicates with $A$. Fixes: timestamps in steps 2 and 3 (Denning 81), or an extra nonce (Neuman 93).

Why does the one-way protocol drop steps 4 and 5, and what does it lose?

$B$ is not online, so $B$ cannot send a challenge. The protocol still gives encryption and some authentication. It does not protect from a replay attack.