Prof Ravi Sandhu Executive Director and Endowed Chair February 1 2013 ravisandhuutsaedu wwwprofsandhucom Ravi Sandhu WorldLeading Research with RealWorld Impact CS 6393 Lecture 3 ID: 730415
Download Presentation The PPT/PDF document "1 Authentication with Passwords" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
1
Authentication with PasswordsProf. Ravi SandhuExecutive Director and Endowed ChairFebruary 1, 2013ravi.sandhu@utsa.eduwww.profsandhu.com
© Ravi Sandhu
World-Leading Research with Real-World Impact!
CS 6393 Lecture 3Slide2
© Ravi Sandhu
2World-Leading Research with Real-World Impact!User AuthenticationUserSomething you knowe.g., passwordsSomething you havee.g., token, smartcardSomething you aree.g., fingerprintSingle factorMulti factor
PrimarySecondary
WeakStrong
Single sign onReduced sign onReset
RevocationSlide3
© Ravi Sandhu
3World-Leading Research with Real-World Impact!Kill the PasswordSlide4
Many things have changed beyond recognition in the past 20 years, but passwords have advanced little.
Arguably, the Internet could not have grown to its current size and influence without them.Repeated and sustained effort has failed to uncover a silver- bullet replacement for passwords. It’s time to admit that this is unlikely to change.In the absence of a silver bullet, we can’t escape the messy work of tradeoffs.We assert that passwords are the best fit for many (but alone, not the highest level of) authentication needs.We might say that passwords are the worst possible authentication system, except for all the other systems. © Ravi Sandhu
4
World-Leading Research with Real-World Impact!
Herley-Oorschot 2012 QuotesSlide5
Ending the Belief that Passwords Are Dead
Understanding Strength and Attack ResistancePolicies and Support ToolsPassword aging policies.Realistic password guidance.Password managers.Prioritizing Competing Requirements © Ravi Sandhu5World-Leading Research with Real-World Impact!
Herley-Oorschot Research Agenda
“Although passwords might not be viewed as the “rocket science” of security research, their scale of deployment is such that any improvement in their usability would be hard to equal for impact.”Slide6
Although we lack the data to attach likelihoods to the individual pie-chart threats, we can reasonably conjecture that keystroke logging harvests more passwords than phishing
and phishing harvests more than online brute-force attacks.© Ravi Sandhu6World-Leading Research with Real-World Impact!Herley-Oorschot Concluding QuoteSlide7
Although we lack the data to attach likelihoods to the individual pie-chart threats, we can reasonably conjecture that keystroke logging harvests more passwords than phishing
and phishing harvests more than online brute-force attacks.© Ravi Sandhu7World-Leading Research with Real-World Impact!Herley-Oorschot Concluding QuoteSlide8
Evolution of UNIX password mechanism
Store passwords in a highly protected fileSingle point of total failureEasily copied by privileged usersStored in plaintext on backupsProtection mechanisms are imperfectStore hashed passwords© Ravi Sandhu8World-Leading Research with Real-World Impact!
Morris-Thomson 1979
Encrypt
Plaintext =
Fixed Constant
Key =
Password
Hashed
PasswordSlide9
Evolution of UNIX password mechanism
Store hashed passwordsInvention of dictionary attack rather than inversion attackIn the initial enthusiasm hashed passwords were put in a world readable file!!© Ravi Sandhu
9
World-Leading Research with Real-World Impact!
Morris-Thomson 1979
Encrypt
Plaintext =
Fixed Constant
Key =
Password
Hashed
PasswordSlide10
DoD
Green Book requirement 1985:The goal is to resist a year’s worth of dictionary attacks with a cracking probability of 10–6 (or 10–20 for sensitive systems).Cheswick Table 2, page 42Trying to meet this requirement by changing passwords regularly is rather hopeless© Ravi Sandhu10
World-Leading Research with Real-World Impact!
Cheswick 2013Slide11
“We demonstrate that as long as passwords remain human-memorable, they are vulnerable to “smart-dictionary” attacks even when the space of potential passwords is large.”
It’s not just human-memorable it is also human-enterable.© Ravi Sandhu11World-Leading Research with Real-World Impact!Narayanan-Shmatikov 2005