Chapter 3 Flashcards
The process of veifying an identity claimed by or for a system entity
RFC 4949
Fundamental building block and primary line of defence
Authentication Process
Something the individual:
- knows
- possesses
- is (static biometrics)
- does (dynamic biometrics)
4 means fo authenticating user identity
Assurance level
Potential impact
Areas of risk
Risk Assessment for User Authentication
Degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued
Assurance Level
Low - limited effect
Moderate = serious effect
High = Severe effect
Potential Impact
Widely used line of defense against intruders
Password Authentication
Up to 8 printable characters in length; now regarded as inadequate
UNIX Implementation
Much stronger hash schemes available for Unix
Improved Implementations
- Dictionary attacks
- Rainbow table attacks
- Password crackers exploit the fact that people choose easy pw
- John the Ripper - open-source pw cracker
Password Cracking
Complex pw policy
Modern approches
Can block offline guessing attacks by denying access to encrypted pw
Password File Access Control
- User education
- Computer generated pw
- Reactive pw checking
- Complex pw policy
Password Selection Strategies
Pw cracker
Rule enforcement
Bloom filter
Proactive Pw checking
Can store but dont process data - Most common magnetic stripe card Cons: - requires reader -loss of token
Memory cards
Looks like bank card
Man. Interface include keypad a/ display for interaction
Smart tokens
Most important category of smart token - Contain microprocessor 3 type memory: - Read-only memory(ROM) - Electrically erasable programmable ROM - Random Access Memory (RAM)
Smart Cards
Use smart card as national identity card for citizens
Electronic Identity Cards (eID)
Ensures eID cant be read without access control
- For online apps
- for offline apps
PW Authenticated Connection Establishment (PACE)
Based on unique physical characteristics
- Fingerprints
- Iris
- tech. complex/ expensive
Biometric Authentication
Authentication over network
Rely on some form of challenge-response protocol since its prone to eavesdropping, getting pw
Remote User Authentication
Denial of Service
- Eavesdropping
- Host attacks
- Replay
- Client attacks
- Trojan horse
Authentication security issues
