Outline for October 20, 2023

Reading: text, §12.4, 13
Due: Homework 2, due October 23; Background Research, due October 27

1. Privacy-enhanced email
2. Authentication
   1. Validating client (user) identity
   2. Validating server (system) identity
   3. Validating both (mutual authentication)
   4. Basis: what you know/have/are, where you are

3. Passwords
   1. Problem: common passwords, easy to guess passwords
   2. Best: use passphrases: goal is to make search space as large as possible, distribution as uniform as possible

4. Attacks
   1. Exhaustive search
   2. Guessing
   3. Scavenging: passwords often typed where they might be recorded as login name, in other contexts, etc.
   4. Ask the user: very common with some public access services

5. Defenses
   1. For trial and error at login: dropping or back-off
   2. For thwarting dictionary attacks: salting

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: mabishop@ucdavis.edu

ECS 235A, Computer and Information Security Version of October 20, 2023 at 6:08PM

You can also obtain a PDF version of this.