Authentication and Authorization in Information Assurance
Authentication
CSE 465
– Information Assurance
Fall 2017
Adam Doupé
Arizona State University
http://adamdoupe.com
Authentication vs. Authorization
•
Authentication
–
Who are you?
•
Authorization
–
What can you do?
2
Authentication Terms
•
Principal
–
Unique entity
•
Identity
–
Specifies a principal
–
Internal representation of an entity
•
Subject
–
Acts on behalf of an entity
•
Authentication
–
Binding an identity to a subject
3
Authentication Mechanisms
•
What you know
•
What you possess
•
What you are
•
Where you are
4
Authentication System
•
(A, C, F, L, S)
–
A
a
u
t
h
e
n
t
i
c
a
t
i
o
n
i
n
f
o
r
m
a
t
i
o
n
t
h
a
t
p
r
o
v
e
s
i
d
e
n
t
i
t
y
–
C
c
o
m
p
l
e
m
e
n
t
a
r
y
i
n
f
o
r
m
a
t
i
o
n
s
t
o
r
e
d
o
n
a
c
o
m
p
u
t
e
r
a
n
d
u
s
e
d
t
o
v
a
l
i
d
a
t
e
a
u
t
h
e
n
t
i
c
a
t
i
o
n
i
n
f
o
r
m
a
t
i
o
n
–
F
c
o
m
p
l
e
m
e
n
t
a
t
i
o
n
f
u
n
c
t
i
o
n
s
•
f
o
r
f
∈
F
,
f
:
A
-
>
C
–
L
a
u
t
h
e
n
t
i
c
a
t
i
o
n
f
u
n
c
t
i
o
n
s
t
h
a
t
v
e
r
i
f
i
e
s
i
d
e
n
t
i
t
y
•
f
o
r
l
∈
L
,
l
:
A
x
C
-
>
{T
r
u
e
,
F
a
l
s
e
}
–
S
s
e
l
e
c
t
i
o
n
f
u
n
c
t
i
o
n
s
e
n
a
b
l
i
n
g
e
n
t
i
t
y
t
o
c
r
e
a
t
e
o
r
a
l
t
e
r
i
n
f
o
r
m
a
t
i
o
n
i
n
A
o
r
C
5
Password System
•
Passwords stored in plaintext
•
Authentication System
–
A
s
e
t
o
f
s
t
r
i
n
g
t
h
a
t
c
a
n
b
e
u
s
e
d
f
o
r
p
a
s
s
w
o
r
d
–
C
=
A
–
F
s
i
n
g
l
e
t
o
n
s
e
t
o
f
c
o
m
p
l
e
m
e
n
t
a
t
i
o
n
f
u
n
c
t
i
o
n
{f
}
–
L
s
i
n
g
l
e
e
q
u
a
l
i
t
y
t
e
s
t
o
p
e
r
a
t
i
o
n
{e
q
}
–
S
f
u
n
c
t
i
o
n
t
o
s
e
t
/
c
h
a
n
g
e
p
a
s
s
w
o
r
d
6
UNIX Standard Hash Function
•
A = { strings of 8 chars or less }•
C = { 2 char hash id || 11 char hash }•
F = { 4096 versions of modified DES }•
L = { login, su, …
}
•
S = { passwd, nispasswd, passwd+, …
}
7
external entities
principal (alice)
alice:y5SfcRm53cpiE:12:23:Alice User:/bin/sh
service provider
UNIX Standard Hash Function
High-Level Attacking Authentication
•
Attacker’s Goal
–
F
i
n
d
a
∈
A
s
.
t
.
–
F
o
r
s
o
m
e
f
∈
F
,
f
(
a
)
=
c
∈
C
–
c is associated with entity
•
Direct approach
–
Attacker has a c, find a f(a) = c
–
Attacker does not have c, find a, l(f, a) = True
9
Preventing Attacks
•
Hide one of a, f, or c
–
Prevents some types of attacks
–
Unix/Linux shadow password files
•
Can we hide L?
–
Prevents attacker from knowing if guess
succeeded
–
Preventing any network-based logins or
restrict logins to only IP address
10
Password-based Authentication
•
Most common
–
Passwords are the worst form of authentication ... except for all
those other forms that have been tried from time to time.
•
Paraphrasing Winston Churchill
•
Several problems
–
Inherent vulnerabilities
•
easy to guess
•
easy to snoop
•
easy to lose
•
no control on sharing
•
social engineering
–
Practical vulnerabilities
•
Visible over insecure distributed and networked systems
•
Susceptible to replay attacks
•
Password reuse
•
Requires proactive management
11
Dictionary Attack
•
General attack for all password-based
authentication
•
Try to use each word in the dictionary or
word file w, compute f(w), check f(w) == c
•
Is it possible to search all possible
passwords?
–
Easy to search all likely passwords!
12
Dictionary Attack
•
Offline
–
Know f and c, repeatedly try different guesses
•
crack, john-the-ripper
•
Online
–
Have access to functions in L and try guesses
until l(g) succeeds
•
Logging into a website guessing a password
13
Countering Password Guessing
•
Deny access to C (complementary
information)
–
All guesses must be online
–
Hard to guarantee
•
Add delay to L when incorrect
–
Many systems do this
•
Increase time to compute f(a)
–
Use a different hashing function
14
Rainbow Tables
•
Essentially precompute the size of some
key space
–
Why not just store key and hash?
•
Rainbow tables allow a tradeoff between
time to crack and space required
•
Space requirements are large
–
MD5 1-8 character alphanumeric 127GB
–
MD5 1-9 character alphanumeric 690GB
15
Salts
•
Add a random value, salt, to each
password before it is hashed
–
salt is public and know
•
Therefore, each password hash is unique
–
Essentially selecting a different f for every
user
16
“Slow” Hashes
•
Controllable work factor
–
Stored with the salt and hash
•
bcrypt
–
Designed to be a slow hash
–
Used on submission server
–
Computing hash takes 300ms on server
•
scrypt
–
Designed to take memory to perform hash
17
Password Reuse
•
How many passwords do you have?
–
For what service?
•
Are they all equally secure?
•
What happens if one of your passwords is
leaked?
–
3.5B Yahoo (2013)
–
412M Adult Friend Finder (2016)
–
152M Adobe (2013)
–
145M eBay (2014)
18
Adobe Breach
19
https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/
Adobe Breach
20
https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/
Password Managers
•
Keep track of passwords and generate
random passwords per website
–
Encrypted/locked with a “master” password
•
Who do you trust?
•
Many options
–
LastPass
–
1Password
–
KeePass
–
…
21
Password Recovery
•
What happens when you forget your
password?
–
Completely locked out of account?
•
Most work by sending email to your
registered email account with a link to
reset your password
–
Is this secure?
•
What does this mean about the security of
your inbox?
22
Two-Factor Authentication
•
Two things required for authentication
–
Based on the authentication categories
•
Google authenticator
•
DuoSecurity (ASU uses this)
23
CAPTCHA
•
C
o
m
p
l
e
t
e
l
y
A
u
t
o
m
a
t
e
d
P
u
b
l
i
c
T
u
r
i
n
g
t
e
s
t
t
o
t
e
l
l
C
o
m
p
u
t
e
r
s
a
n
d
H
u
m
a
n
s
A
p
a
r
t
•
Is CAPTCHA authentication?
•
How to break CAPTCHA?
24
Additional Authentication
Mechanisms
•
Token-based authentication
–
Google 2FA
–
Hardware token
•
Address-based authentication
–
Restrict access to VPN or server based on IP address
•
Location-based authentication
–
Unlocking car only when “close”
•
Biometrics-based authentication
–
Fingerprint readers
–
Voice recognition
–
Face recognition
25
Authentication Research
•
Continuous authentication
–
Continuously verify the user
•
Replacing passwords
–
FIDO
•
Access/authentication delegation
–
OAuth 2.0
–
ASU online services
26
Explore the concepts of authentication and authorization in information assurance through a series of visuals and explanations provided by Adam Doup from Arizona State University. Learn about authentication terms, mechanisms, password systems, and UNIX standard hash functions. Gain insights into how authentication information proves identity, complements stored information, and facilitates secure access control.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Authentication CSE 465 Information Assurance Fall 2017 Adam Doup Arizona State University http://adamdoupe.com
Authentication vs. Authorization Authentication Who are you? Authorization What can you do? Adam Doup , Information Assurance 2
Authentication Terms Principal Unique entity Identity Specifies a principal Internal representation of an entity Subject Acts on behalf of an entity Authentication Binding an identity to a subject Adam Doup , Information Assurance 3
Authentication Mechanisms What you know What you possess What you are Where you are Adam Doup , Information Assurance 4
Authentication System (A, C, F, L, S) A authentication information that proves identity C complementary information stored on a computer and used to validate authentication information F complementation functions for f F , f : A -> C L authentication functions that verifies identity for l L , l : A x C -> {True, False} S selection functions enabling entity to create or alter information in A or C Adam Doup , Information Assurance 5
Password System Passwords stored in plaintext Authentication System A set of string that can be used for password C = A F singleton set of complementation function { f} L single equality test operation { eq } S function to set/change password Adam Doup , Information Assurance 6
UNIX Standard Hash Function A = { strings of 8 chars or less } C = { 2 char hash id || 11 char hash } F = { 4096 versions of modified DES } L = { login, su, } S = { passwd, nispasswd, passwd+, } Adam Doup , Information Assurance 7
UNIX Standard Hash Function service provider external entities S: create a password alice :: password A principal (alice) L: A x C {True, False} F(password) = y5SfcRm53cpiE ? F: generate an encrypted password alice:y5SfcRm53cpiE:12:23:Alice User:/bin/sh C
High-Level Attacking Authentication Attacker s Goal Find a A s.t. For some f F, f(a) = c C c is associated with entity Direct approach Attacker has a c, find a f(a) = c Attacker does not have c, find a, l(f, a) = True Adam Doup , Information Assurance 9
Preventing Attacks Hide one of a, f, or c Prevents some types of attacks Unix/Linux shadow password files Can we hide L? Prevents attacker from knowing if guess succeeded Preventing any network-based logins or restrict logins to only IP address Adam Doup , Information Assurance 10
Password-based Authentication Most common Passwords are the worst form of authentication ... except for all those other forms that have been tried from time to time. Paraphrasing Winston Churchill Several problems Inherent vulnerabilities easy to guess easy to snoop easy to lose no control on sharing social engineering Practical vulnerabilities Visible over insecure distributed and networked systems Susceptible to replay attacks Password reuse Requires proactive management Adam Doup , Information Assurance 11
Dictionary Attack General attack for all password-based authentication Try to use each word in the dictionary or word file w, compute f(w), check f(w) == c Is it possible to search all possible passwords? Easy to search all likely passwords! Adam Doup , Information Assurance 12
Dictionary Attack Offline Know f and c, repeatedly try different guesses crack, john-the-ripper Online Have access to functions in L and try guesses until l(g) succeeds Logging into a website guessing a password Adam Doup , Information Assurance 13
Countering Password Guessing Deny access to C (complementary information) All guesses must be online Hard to guarantee Add delay to L when incorrect Many systems do this Increase time to compute f(a) Use a different hashing function Adam Doup , Information Assurance 14
Rainbow Tables Essentially precompute the size of some key space Why not just store key and hash? Rainbow tables allow a tradeoff between time to crack and space required Space requirements are large MD5 1-8 character alphanumeric 127GB MD5 1-9 character alphanumeric 690GB Adam Doup , Information Assurance 15
Salts Add a random value, salt, to each password before it is hashed salt is public and know Therefore, each password hash is unique Essentially selecting a different f for every user Adam Doup , Information Assurance 16
Slow Hashes Controllable work factor Stored with the salt and hash bcrypt Designed to be a slow hash Used on submission server Computing hash takes 300ms on server scrypt Designed to take memory to perform hash Adam Doup , Information Assurance 17
Password Reuse How many passwords do you have? For what service? Are they all equally secure? What happens if one of your passwords is leaked? 3.5B Yahoo (2013) 412M Adult Friend Finder (2016) 152M Adobe (2013) 145M eBay (2014) Adam Doup , Information Assurance 18
Adobe Breach https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/ Adam Doup , Information Assurance 19
Adobe Breach https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/ Adam Doup , Information Assurance 20
Password Managers Keep track of passwords and generate random passwords per website Encrypted/locked with a master password Who do you trust? Many options LastPass 1Password KeePass Adam Doup , Information Assurance 21
Password Recovery What happens when you forget your password? Completely locked out of account? Most work by sending email to your registered email account with a link to reset your password Is this secure? What does this mean about the security of your inbox? Adam Doup , Information Assurance 22
Two-Factor Authentication Two things required for authentication Based on the authentication categories Google authenticator DuoSecurity (ASU uses this) Adam Doup , Information Assurance 23
CAPTCHA Completely Automated Public Turing test to tell Computers and Humans Apart Is CAPTCHA authentication? How to break CAPTCHA? Adam Doup , Information Assurance 24
Additional Authentication Mechanisms Token-based authentication Google 2FA Hardware token Address-based authentication Restrict access to VPN or server based on IP address Location-based authentication Unlocking car only when close Biometrics-based authentication Fingerprint readers Voice recognition Face recognition Adam Doup , Information Assurance 25
Authentication Research Continuous authentication Continuously verify the user Replacing passwords FIDO Access/authentication delegation OAuth 2.0 ASU online services Adam Doup , Information Assurance 26
