Brukerautentisering - kapittel 6

Question 1

different between entity and message authentication?

Answer 1

entity authentication - verify the identity of an entity at the end of a session
message authentication : verify the origin of a message

Question 2

Name two cryptographic methods to achieve message authentication

Answer 2

MAC and digital signature

Question 3

4 requirement for biometric authentication

Answer 3

1. universality: every person should have the characteristic (universalitet)
2. distinctiveness: any two persons should have sufficiently different characteristics (særpreg)
3. permanence: shouldn’t change much over time (permanent)
4. collectability - characteristic can be measured quantitatively (målbarhet)

Question 4

n-factor user-authentication

Answer 4

using n independent mechanism for verifying identity
Eks: smart car and pin, fingerprint authentication and password

Question 5

Passordcracking -hvordan?
1. lagret som hashverdi
2. lagret som salt
3. lagret i klartekst
4. lagret som saltet hashverdi

Answer 5

1. med hashtabell
2. ingen
3. uten hashtabell
4. vanskelig å cracke

Question 6

Hva er PAD?

Answer 6

oppdage forsøk på forfalskning av biometri (men vanskelig å oppdage.

Question 7

Hva sier FMR av en biometrisk system?

Answer 7

• False match rate -viser hvor mange ikke-genuine brukere blir godtatt
  -eks: FMR = MAS (matching attacker samples)/ TAS(total numer of attacke samples9
  -FAM = 0,05 tilsvarer 5 personer

Question 8

Hva sier FNMR av en biometrisk system?

Answer 8

False non-match rate
Viser hvor mange genuine brukere blir avvist
- FNMR = NMUS (non-matching user samples/TUS (total numer user samples)
Eks: FNMR = 0,07 tilsvarer 7 personer

Question 9

Hva står EER for?

Answer 9

Equal Error Rate

Question 10

Ideelt biometrisk system er når…

Answer 10

FNMR = FMR = EER = 0

Question 11

Brukes i FIDO-løsninger

Answer 11

onlineenheter

Question 12

har som regel klokke

Answer 12

OTP-brikke

Question 13

Brukes i BankID på mobil

Answer 13

sekundærkanal

Question 14

brukes i BankID

Answer 14

OTP-brikke

Question 15

blir autenisert av leser/terminal

Answer 15

pass og ID-kort

Question 16

Brukes for overføring av autorisasjonskode/mønster til bruker

Answer 16

sekundærkanal

Question 17

Three catgories of credentials for user authentication

Answer 17

1. something you know (knowledge) - password, pin
2. Something you have (ownership - security token
3. Somthing you are (inherence) - face recognition, iris
   (secondary channel ex. SMS)

Question 18

Principle and purpose of salting

Answer 18

password salting is to include a random numer when hashing and it ensures that equal passwords have different hashes and makes cracking more difficult by preventing the use of hash tables

Question 19

eGovernment 3 classes of requirements for assurance level of user authentication

Answer 19

1. authentication method strength
2. credential management assurance
3. identity registration assurance

Question 20

Advantage of Biometrics

Answer 20

easy to use, can not loose or forget

Question 21

Disadvantage of Biometrics

Answer 21

High false negative rate, low performance, threat for personal safety, threat for privacy usability

Question 22

Disadvantage of Biometrics

Answer 22

High false negative rate, low performance, threat for personal safety, threat for privacy usability

Question 23

What is the main advantage of passwords/pins generated by an authenticationtoken compared to “normal” ones?

Answer 23

they are different for each authentication attempt (one time password)

Question 24

Describe 2 synchronised quthentication tokens

Answer 24

clock-based : client and server have synchronized internal clocks, that are used to derive an OTP
Counter-baser: client and server have a counter, which is used to derive an OTP.

Question 25

Hva er FIDO?

Answer 25

(Fast Identity Onlin)
er en industriallianse som standardiserer autentisering med online-enheter, og som forvalter sertifisering av FIDO-godkjente enheter

Question 26

Identity registration assurance

Answer 26

krav til riktig registrering av bruker
-pre-autentiseirng med legitmasint f.eks fødselsattest, biometri

Question 27

credential management assurance

Answer 27

krav til håndtering av autentikatorer
-generering
-mottak
- oppbevaring

Question 28

authentication Method Assurance

Answer 28

krav til autentiseringsmetode
- passordlengde og kvalitet
-kryptografisk styrke
-manipuleringsbestandig brikke
-dynamisk
-PKI-basert
-flerfaktor-autentisering