Authentication Flashcards
TOTP
Time-Based One-Time Password:
A password is computed from a shared secret and current time
HOTP
HMAC-based One-Time Password:
A password is computed from a shared secret and is synchronized between the client and the server
Context-Aware Authentication
Process to check the user’s or system’s attributed or characteristics prior to allowing it to connect
Restrict authentication based on the time of day or location
FidM
Federated Identity Management:
A single identity is created for a user and shared with all of the organizations in a federation
FidM: Cross-Certification
Utilizes a web of trust between organizations where each one certifies others in the federation
FidM: Trusted Third-Party
Organizations are able to place their trust in a single third-party (also called the bridge model)
Trusted third-party model is more efficient than a cross certification or web of trust mode
FidM: SAML
Security Assertion Markup Language:
Attestation model built upon XML used to share federated identity management information between systems
Open standard for authentication & authorization
Authenticate via third-party
FidM: OpenID
An open standard and decentralized protocol that is used to authenticate users in a federated identity management system
Used in conjunction with OAuth2
User logs into an Identity Provider (IdP) and uses their account at Relying Parties (RP)
OpenID is easier to implement than SAML
SAML is more efficient than OpenID
802.1x
Standardized framework used for port-based authentication on wired and wireless networks
Helps prevent rogue devices
(Ex: RADIUS, TACACS+)
EAP
Extensible Authentication Protocol:
A framework of protocols that allows for numerous methods of authentication including passwords, digital certificates, and public key infrastructure
EAP-MD5 uses simple passwords for its challenge-authentication
EAP-TLS uses digital certificates for mutual authentication
EAP-TTLS uses a server-side digital certificate and a client-side password for mutual authentication
EAP-FAST
Provides flexible authentication via secure tunneling (FAST) by using a protected access credential instead of a certificate for mutual authentication
PEAP & LEAP
Protected EAP:
Supports mutual authentication by using server certificates and Microsoft’s Active Directory to authenticate a client’s password
Lightweight EAP:
Proprietary to Cisco-based networks (supposedly FAST is an upgrade from LEAP)
LDAP
Lightweight Directory Access Protocol:
A database used to centralize information about clients and objects on the network
Unencrypted: Port 389
Encrypted: Port 636
Active Directory is Microsoft’s version
Kerberos
An authentication protocol used by Windows to provide for two-way (mutual) authentication using a system of tickets
Port 88
A domain controller can be a single point of failure for Kerberos
PAP
Password Authentication Protocol:
Used to provide authentication but is not considered secure since it transmits the login credentials unencrypted (in the clear)