Authentication

Question 1

What is authentication?

Answer 1

Who are you? Prove it.
Checks if requester has access to resource
TCB needs to know who is requesting
Processes request on behalf of user, subject or principal
User associated with identity should be able to authenticate themselves

Question 2

What are the different ways authentication can be implemented?

Answer 2

User knows (password)
User has (RFA token)
User is (biometrics)

Question 3

What are the threat models for passwords?

Answer 3

Attacker guesses password
Login program is spoofed
Keylogging

Question 4

What is a trusted path?

Answer 4

Required to be provided by OS
Special kind of input that leads to a display under OS control

Example: Ctrl+Alt+Delete

Question 5

How do we authenticate passwords?

Answer 5

• Store password in a system file

- Store password hashes

Question 6

Why is storing passwords in a file dangerous?

Answer 6

Needs to be readable by a root/admin account
In a breach, all passwords are compromised
Easy to mess up access permissions

Question 7

What is the problem with storing the password hashes in a file?

Answer 7

Can be brute forced to figure out the hashes

Workaround: SALT the hash

Question 8

What does salt the password mean?

Answer 8

Pad the front of the hash value with a random value

Question 9

How can brute forcing a password be more effective?

Answer 9

Try popular passwords first

Rainbow table

Question 10

What are the problems with passwords?

Answer 10

• As passwords get longer and complexity increases, usability suffers
• Not robust against social engineering
• Once stolen, passwords can be used multiple times
• People can’t remember a lot of passwords

Question 11

What are other authentication methods?

Answer 11

• Use something you have (may require additional hardware, a challenge response)
• Use something you are (biometrics)
• Multi-factor authentication