Enhancing Online Security Through Authentication Techniques

1. AuthenticationChapter 11 Modified (heavily) by Dan Fleck 1 1 Coming up: Basics

2. Basics • Authentication: binding of identity to subject • Identity is that of external entity (my identity, Matt, etc.) • Subject is computer entity (process, etc.) • After login your identity is bound to everything you do! 2 2 Coming up: Establishing Identity

3. Establishing Identity • One or more of the following • What entity knows (eg. password) • What entity has (eg. badge, smart card) • What entity is (eg. fingerprints, retinal characteristics) • Where entity is (eg. In front of a particular terminal) 3 3 Coming up: Passwords

4. Passwords • Passwords are ubiquitous because they are simple and clear. • Standard tradeoff between usability and security: • Password must be 27 characters and use no words (huh??) • A typical ruleset (from Chase bank): • Must contain 7-32 characters • Must include at least one number and one letter • Cannot include special characters (&, %, *, etc.) • Cannot be the same as your User ID • Cannot be the same as any of the last five Passwords you’ve used • Goal: Make it hard for computers to guess by making it random. Reality: its very hard to have a short password that a computer cannot guess 4 4 Coming up: Possible Passwords

5. Possible Passwords • Possible options: • Length of password (L) • Possible characters (N) (letter = 26, upper/lower = 52, digits=+10, symbols=+33 (ASCII printable)) = 95 8 char password: 95^8 = 6,634,204,312,890,625 = 6.6342e15 Entropy is 6.6342e15 assuming all symbols equally likely! 5 5 Coming up: Entropy in bits

6. Entropy in bits • H(x) is entropy in bits (how many bits it would take to represent that number of options) • Example: 2X=6.6342e15 • X = 52.5588 bits • Another way to think about it: • Each symbol adds log2(95) bits • We have 8 symbols, thus our entropy is: • H = L (Log2 N) = 8 ( Log2 95 ) = 52.5 bits • Research1 has shown, lower bound on expected guesses E(G) is: • Example: • E(G) ≥ (1/4)*6.6342e15 + 1 = 1.6586e15 6 6 Coming up: Password Guessing 1: http://www.isiweb.ee.ethz.ch/archive/massey_pub/pdf/BI633.pdf

7. Password Guessing • Recent password guessers can guess 2,800,000,000 passwords a second. • Strength of our example: • 1.6586e15 / 2,800,000,000 = 592,340 seconds = 6.85 days • How true is that? • Entropy of a letter in English is –log2(1/26) letter is 4.7bits • Are all letters equally probable? No! • Computed entropy of the English language ranges from 2.77 bits to 1.3 bits because letters aren’t random. • Is your password random? 7 7 Coming up: Cracking

8. Cracking • Password tools use many methods to guess smarter • Dictionaries • Rulesets • Is it more likely that the 1st or 2nd letter is capitalized? • Where are numbers generally? • Substituting numbers for letters is c0mm0n! • Brute force – all possible guesses as a last resort • How do passwords work? Lets see! 8 8 Coming up: Simple Passwords

9. Simple Passwords • Most passwords today use secure one-way hashing • Hash function F(P)  Q • F – hash function • P – plain text password • Q – hashed password • One way • Q is stored on the computer • P is provided by the user, hashed and compared to Q • Secure Hash Functions goal is to NOT be reversible (MD5, SHA1, SHA3, etc…) • Are they still subject to a guessing attack? 9 9 Coming up: Recent Events

10. Recent Events • Yahoo's password leak: What you need to know (FAQ) (Mar 2012) – Plaintext leaked! (ouch!) • Millions of LinkedIn passwords reportedly leaked online (June 6, 2012) – hashed passwords (still hurts) • Nasdaq forum site hacked, passwords compromised (July 2013) – Unclear if hashed or not • Ubuntu forums hacked, 1.8 million passwords and emails compromised – Unclear if hashed or not 10 10 Coming up: How hard is it to crack?

11. How hard is it to crack? • Dec 2009 RockYou’s 18million passwords stolen in plaintext • This started a revolution of password hacking because people could use real world passwords • Password Cracking program + RockYou DB + some rulesets… lets try it: • Take a password, hash it • Crack it • Src: http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/ 11 11 Coming up: Demo of password cracking

12. Demo of password cracking 12 12 Coming up: What can we do?

13. What can we do? • Increase the time to check • Not good at the algorithmic level -- when doing stream decryption want it to be fast • Key stretching can be used • User’s password is run through a stretching algorithm that makes it longer. The algorithm MUST take a long time ~1 second • If we have an uncompromised server key stretching is simple and effective against guessing attacks! Only a problem when attacker has the hashed password • Systems using this: • PGP, GPG • WPA, WPA2 in personal mode • OpenSSL ‘passwd’, Apache .htpasswd • One example algorithm: https://en.wikipedia.org/wiki/PBKDF2 13 13 Ref: http://en.wikipedia.org/wiki/Key_stretching#Some_systems_that_use_key_stretching Coming up: What can we do?

14. What can we do? • Add some Salt • Append a random value to the password before hashing • Store that random value (in plain text) with the password • This does NOT make cracking a single password harder, but when cracking a group of passwords, it does. • For example, the attacker typically computes the hash and checks for it anywhere in the list of hashed passwords. This fails with salt. • Another form of salt is picking a different hashing algorithm per password and storing that choice with the hashed password 14 14 Ref: https://en.wikipedia.org/wiki/Salt_(cryptography) Coming up: Other Authentication Types

15. Other Authentication Types 15 15 Coming up: Challenge-Response

16. Challenge-Response • User, system share a secret function f (in practice, f is a • known function with unknown parameters, such as a • cryptographic key) request to authenticate system user random message r (the challenge) system user f(r) (the response) system user 16 Coming up: Pass Algorithms 16

17. Pass Algorithms • Challenge-response with the function f itself a secret • Example: • Challenge is a random string of characters such as “abcdefg”, “ageksido” • Response is some function of that string such as “bdf”, “gkip” • Can alter algorithm based on ancillary information • Network connection is as above, dial-up might require “aceg”, “aesd” • Usually used in conjunction with fixed, reusable password 17 17 Coming up: One-Time Passwords

18. One-Time Passwords • Password that can be used exactly once • After use, it is immediately invalidated • Challenge-response mechanism • Challenge is number of authentications; response is password for that particular number • Problems • Synchronization of user, system • Generation of good random passwords • Password distribution problem 18 18 Coming up: S/Key

19. S/Key • One-time password scheme based on idea of Lamport • h one-way hash function (MD5 or SHA-1, for example) • User chooses initial seed k – k must remain secret! • System calculates: h(k) = k1, h(k1) = k2, …, h(kn–1) = kn • Passwords are reverse order: p1 = kn, p2 = kn–1, …, pn–1 = k2, pn = k1 19 19 Coming up: S/Key Protocol

20. S/Key Protocol System stores maximum number of authentications n, number of next authentication i, last correctly supplied password pi–1. { name } system user { i } system user { pi } system user System computes h(pi) = h(kn–i) = kn–i+1 = pi–1. If match with what is stored, system replaces pi–1 with pi and increments i. 20 20 Coming up: S/Key Protocol

21. S/Key Protocol System computes h(pi) = h(kn–i) = kn–i+1 = pi–1. If match with what is stored, system replaces pi–1 with pi and increments i. Concretely for table and i=2 (all values in col X are equal): h(p2)=h(k3)=k4=p1 21 21 Coming up: Hardware Support

22. Hardware Support • Token-based • Used to compute response to challenge • May encipher or hash challenge • May require PIN from user • Temporally-based • Every minute (or so) different number shown • Computer knows what number to expect when • User enters number and fixed password 22 22 Coming up: C-R and Dictionary Attacks

23. C-R and Dictionary Attacks • Same as for fixed passwords • Attacker knows challenge r and response f(r); if f encryption function, can try different keys • May only need to know form of response; attacker can tell if guess correct by looking to see if deciphered object is of right form • Example: Kerberos Version 4 used DES, but keys had 20 bits of randomness; Purdue attackers guessed keys quickly because deciphered tickets had a fixed set of bits in some locations 23 23 Coming up: Encrypted Key Exchange

24. Encrypted Key Exchange • Defeats off-line dictionary attacks • Idea: random challenges enciphered, so attacker cannot verify correct decipherment of challenge • Assume Alice, Bob share secret password s • In what follows, Alice needs to generate a random public key p and a corresponding private key q • Also, k is a randomly generated session key, and RA and RB are random challenges 24 24 Coming up: EKE Protocol

25. EKE Protocol Alice,Es(p) Bob Alice Steps used to generate session key Es(Ep(k)) Bob Alice Now Alice, Bob share a randomly generated secret session key k Ek(RA) Bob Alice Steps used to stop replay attacks Ek(RARB) Bob Alice 25 25 Ek(RB) Bob Alice Coming up: Biometrics

26. Biometrics • Automated measurement of biological, behavioral features that identify a person • Fingerprints: optical or electrical techniques • Maps fingerprint into a graph, then compares with database • Measurements imprecise, so approximate matching algorithms used • Voices: speaker verification or recognition • Verification: uses statistical techniques to test hypothesis that speaker is who is claimed (speaker dependent) • Recognition: checks content of answers (speaker independent) 26 26 Coming up: Other Characteristics

27. Other Characteristics • Can use several other characteristics • Eyes: patterns in irises unique • Measure patterns, determine if differences are random; or correlate images using statistical tests • Faces: image, or specific characteristics like distance from nose to chin • Lighting, view of face, other noise can hinder this • Keystroke dynamics: believed to be unique • Keystroke intervals, pressure, duration of stroke, where key is struck • Statistical tests used 27 27 Coming up: Cautions

28. Cautions • These can be fooled! • Assumes biometric device accurate in the environment it is being used in! • Transmission of data to validator is tamperproof, correct 28 28 Coming up: Multifactor Authentication

29. Multifactor Authentication • Many systems now use multi-factor authentication • User must present multiple things typically from different categories: • What you know • What you have • What you are • Examples? 29 29 Coming up: Pluggable Authentication Modules (PAM)

30. Pluggable Authentication Modules (PAM) • Idea: when program needs to authenticate, it checks central repository for methods to use • Library call: pam_authenticate • Accesses file with name of program in /etc/pam.d/ • Modules do authentication checking • binding (new): succeed immediately upon success, otherwise continue down the chain, but ultimately fail • sufficient: succeed immediately if module succeeds • required: fail if module fails, but all required modules executed before reporting failure • requisite: like required, but don’t check all modules upon failure • optional: invoke only, but result is ignored 30 30 Coming up: Example PAM File

31. Example PAM File auth sufficient /usr/lib/pam_ftp.so auth required /usr/lib/pam_unix_auth.so use_first_pass auth required /usr/lib/pam_listfile.so onerr=succeed \ item=user sense=deny file=/etc/ftpusers For ftp: • If user “anonymous”, return okay; if not, set PAM_AUTHTOK to password, PAM_RUSER to name, and fail • Now check that password in PAM_AUTHTOK belongs to that of user in PAM_RUSER; if not, fail • Now see if user in PAM_RUSER named in /etc/ftpusers; if so, fail; if error or not found, succeed 31 31 Coming up: PAM Facilities

32. PAM Facilities PAM provides four facilities each with a chain for different things. Each is typically present in the /etc/pam.d/xyz file: • auth – does the actual authentication of an applicant • account – checks if authentication is allowed ( account not expired, time of day, server’s workload, etc…) • session - after authentication runs chain for session setup / tear down • password – chain used to change passwords Ref: http://www.freebsd.org/doc/en/articles/pam/pam-essentials.html 32 Coming up: PAM Test - Explain these

33. PAM Test - Explain these auth required serviceA auth sufficient serviceB auth required serviceC • versus auth sufficient serviceB auth required serviceA auth required serviceC 33 Coming up: Key Points

34. Key Points • Authentication is not cryptography • You have to consider system components • Passwords are here to stay • They provide a basis for most forms of authentication • Authentication methods can be combined • Example: PAM 32 34 End of presentation