Outline for March 4, 2002

Reading: §12.1-12.3

1. Greetings and Felicitations
2. Puzzle of the day
3. Authentication:
1. validating client (user) identity
2. validating server (system) identity
3. validating both (mutual authentication)
4. Basis: what you know/have/are, where you are
5. Passwords
1. How UNIX does selection
2. Problem: common passwords; Go through Morris and Thompson ; Klein and mine, etc.
3. May be pass phrases: goal is to make search space as large as possible, distribution as uniform as possible
4. Other ways to force good password selection: random, pronounceable, computer-aided selection
5. Go through problems, approaches to each, esp. proactive
6. Password Storage
1. In the clear; MULTICS story
2. Enciphers; key must be kept available; get to it and it's all over
3. Hashed; present idea of one-way functions using identity and sum
4. Show UNIX version
7. Attack Schemes Directed to the Passwords
1. Exhaustive search: UNIX is 1-8 chars, say 96 possibles; it's about 7e16
2. Inspired guessing: think of what people would like (see above)
3. Random guessing: can't defend against it; bad login messages aid it
4. Scavenging: passwords often typed where they might be recorded (b\as login name, in other contexts, etc.
5. Ask the user: very common with some public access services
6. Expected time to guess
8. Password aging
1. Pick age so when password is guessed, it's no longer valid
2. Implementation: track previous passwords vs. upper, lower time bounds
9. Ultimate in aging: One-Time Password
1. Password is valid for only one use
2. May work from list, or new password may be generated from old by a function
3. Example: S/Key
10. Challenge-response systems
1. Computer issues challenge, user presents response to verify secret information known/item possessed
2. Example operations: f(x) = x+1, random, string (for users without computers), time of day, computer sends E(x), you answer E(D(E(x))+1)
3. Note: password never sent on wire or network
4. Attack: monkey-in-the-middle
5. Defense: mutual authentication