Chapter 3

Question 1

The process of veifying an identity claimed by or for a system entity

Answer 1

RFC 4949

Question 2

Fundamental building block and primary line of defence

Answer 2

Authentication Process

Question 3

Something the individual:

• knows
• possesses
• is (static biometrics)
• does (dynamic biometrics)

Answer 3

4 means fo authenticating user identity

Question 4

Assurance level
Potential impact
Areas of risk

Answer 4

Risk Assessment for User Authentication

Question 5

Degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued

Answer 5

Assurance Level

Question 6

Low - limited effect
Moderate = serious effect
High = Severe effect

Answer 6

Potential Impact

Question 7

Widely used line of defense against intruders

Answer 7

Password Authentication

Question 8

Up to 8 printable characters in length; now regarded as inadequate

Answer 8

UNIX Implementation

Question 9

Much stronger hash schemes available for Unix

Answer 9

Improved Implementations

Question 10

• Dictionary attacks
• Rainbow table attacks
• Password crackers exploit the fact that people choose easy pw
• John the Ripper - open-source pw cracker

Answer 10

Password Cracking

Question 11

Complex pw policy

Answer 11

Modern approches

Question 12

Can block offline guessing attacks by denying access to encrypted pw

Answer 12

Password File Access Control

Question 13

• User education
• Computer generated pw
• Reactive pw checking
• Complex pw policy

Answer 13

Password Selection Strategies

Question 14

Pw cracker
Rule enforcement
Bloom filter

Answer 14

Proactive Pw checking

Question 15

Can store but dont process data
- Most common magnetic stripe card
Cons:
- requires reader
-loss of token

Answer 15

Memory cards

Question 16

Looks like bank card

Man. Interface include keypad a/ display for interaction

Answer 16

Smart tokens

Question 17

Most important category of smart token
- Contain microprocessor
3 type memory:
- Read-only memory(ROM)
- Electrically erasable programmable ROM
- Random Access Memory (RAM)

Answer 17

Smart Cards

Question 18

Use smart card as national identity card for citizens

Answer 18

Electronic Identity Cards (eID)

Question 19

Ensures eID cant be read without access control

• For online apps
• for offline apps

Answer 19

PW Authenticated Connection Establishment (PACE)

Question 20

Based on unique physical characteristics

• Fingerprints
• Iris
• tech. complex/ expensive

Answer 20

Biometric Authentication

Question 21

Authentication over network

Rely on some form of challenge-response protocol since its prone to eavesdropping, getting pw

Answer 21

Remote User Authentication

Question 22

Denial of Service

• Eavesdropping
• Host attacks
• Replay
• Client attacks
• Trojan horse

Answer 22

Authentication security issues