03 User Authentication - Cheat Sheet

User authentication = verifying an identity claimed by or for a system entity; identification (give identifier) + verification (bind person to identifier); not message authentication (s.4).

Four means (s.5): knows (password, PIN) · possesses (key, token, smartcard) · is (fingerprint, retina) · does (voice, signature).

Password attacks and fixes (s.7-11)

Attack	Fix
offline dictionary	protect file, IDS, reissue passwords
specific account	lockout
popular password	ban common ones, scan IPs
single-user guessing	password policy (length, charset, change time)
electronic monitoring	strong encryption

Hashing and salt (s.12-15)

• Salt: hides duplicates, slows offline dictionary attacks, hides reuse across systems (s.13).
• UNIX Crypt(3): modified DES, password up to 8 chars = 56 bits, 12-bit salt, 11-char output (s.14).
• MD5 variant: 48-bit salt, 1000 inner loops, 128-bit hash, vulnerable. Bcrypt: Blowfish, 128-bit salt, 192-bit hash, most secure (s.15).
• Rainbow table: precomputed hashes for all salts (1.4 GB cracks 99.9% of alphanumeric Windows passwords in 13.8 s); defeated by larger salts (s.16).
• Shadow file = hashes kept separate, privileged access only (s.19).
• Reactive checking (system cracks its own file) vs proactive checking (reject at choice time, best) (s.20).

Tokens and biometrics (s.21-25)

• Memory card: stores only (needs reader). Smartcard: own CPU/memory/I/O; static, dynamic, challenge-response (s.22-23).
• Biometric: matching score vs stored template; false match (imposter in) / false non-match (genuine out); threshold $t$ trades them (s.25). Iris = most accurate and costly (s.24).

Remote authentication (s.26-27)

Challenge-response: $U$ $\to$ host sends $r$ $\to$ user returns $f(r,h(P))$ $\to$ host compares. Stops replay.

Security issues (s.28-31)

Issue	Counter
client attack	strong passwords, limit attempts
host attack	hashing, protect password DB
eavesdropping	diligence, multifactor, revoke
replay	challenge-response, OTP

Quiz-style one-liners

• Hashed passwords in a separate file = shadow. Random value added before hashing = salt. Response repeated by attacker = replay.

Details: 03 User Authentication - Chunk 01 (s.1-33) · 03 User Authentication - Index · Concept - Password Hashing and Salt · Concept - Biometric Authentication