Crypto U8 (part 3), entity authentication

1. identity assurance
2. freshness

1. mututal
   1. both entities provide each other with assurance
2. unilateral
   1. authentication of one entitiy to another
      1. ex. ATM

Annotations:

• http://en.wikipedia.org/wiki/Zero-knowledge_proof#Abstract_example

1. prover
2. verifier

1. dumb token
   1. ex. card with mag stripe
2. smart token
   1. sometimes have built in user interfaces
   2. have memory, processor, better storage of crypto info
   3. ex. smartcard
3. usually used in combination with some other form of identity assurance like a pin
4. needs some form of reader

1. biometrics
   1. static
      1. measures fixed characteristic like fingerprints
   2. dynamic
      1. measures characteristics that change slightly like voice
   3. measurements of biometric info are digitalized stored for use

1. passwords, pins, passphrases
   1. most common
   2. problems
      1. length
      2. low complexity
      3. repeated across systems
      4. social engineering
      5. password database attacks
      6. shoulder surfing
   3. should be crypto protected at all times
   4. example of Unix password DB
      1. when user attempts login, system pulls user hash from DB & applies to special DES implementation
      2. covert password to 56 bit DES key and encrypt plaintext of all 0s 25 times
      3. check to see if resulting value equals value stored in DB for password
2. dynamic passwords

   Attachments:

   • Crypto U8, example dynamic password scheme
   1. one time password schemes
      1. 2 parts
         1. password function
            1. implemented on a smart token
               1. this results in 2 factor authentication
         2. input
            1. must be fresh (uses freshness mechanism)
      2. analysis
         1. every time new auth challenge issued
         2. local use of pin
         3. 2 factor authentication
   2. advantages
      1. limits exposure
      2. not repeatable