03 User Authentication - Chunk 01 (s.1-33)

Overview

Chapter 3 of Computer Security: Principles and Practice (s.1) covers user authentication: verifying an identity claimed by or for a system entity, as the basis of access control and accountability (s.4). The deck gives four means of authentication (know, possess, are, do) (s.5), then goes deep on passwords: attacks, countermeasures, salted hashing in UNIX, cracking and better password policies (s.6-20). It then covers tokens (memory card, smartcard) (s.21-23), biometrics and their accuracy (s.24-25), remote authentication by challenge-response (s.26-27), four security issues with their countermeasures (s.28-31), and an iris biometric banking example (s.32). See Past Exam - Question Bank & Style Guide for the quiz style (one-word terms).

Detailed notes

1. What user authentication is

• Fundamental security building block, the basis of access control and user accountability (s.4).
• Definition: “the process of verifying an identity claimed by or for a system entity” (s.4).
• Two steps: identification (specify an identifier) and verification (bind the entity/person to the identifier) (s.4).
• Distinct from message authentication, where communicating parties care about the integrity of exchanged messages (s.4).
• Link to Concept - User Authentication.

2. Four means of authentication (s.5)

Based on something the individual:

Means	Slide example
knows	password, PIN
possesses	key, token, smartcard
is (static biometrics)	fingerprint, retina
does (dynamic biometrics)	voice, signature (“sign”)

They can be used alone or combined; all can provide user authentication and all have issues (s.5). See Concept - Means of Authentication. Combined use is called multifactor authentication on s.30.

3. Password authentication (s.6)

• Widely used. The user gives a name/login and a password; the system compares the password with the one saved for that login (s.6).
• It authenticates the user’s ID, checks the user is authorized to access the system, determines the user’s privileges, and is used in discretionary access control (s.6; see Concept - Discretionary Access Control in the Access Control deck).

4. Password vulnerabilities and countermeasures (s.7-11)

Five attacks (s.7). The table follows s.8-10.

Attack	What the attacker does	Countermeasures (slide)
Offline dictionary attack	Bypasses access controls, gets the system password file, compares the password hashes against hashes of commonly used passwords (s.8)	Prevent unauthorized access to the password file; Intrusion Detection System to identify a compromise; rapid reissuance of passwords when compromised (s.8)
Specific account attack	Targets one account (e.g. user john) and submits guesses until the right one (s.7, 9)	Account lockout after a number of failed attempts (s.9)
Popular password attack	Tries one popular password against a wide range of user IDs; assumes users pick easily remembered passwords (s.9)	Policies that inhibit common passwords; scan the IP addresses of authentication requests (s.9)
Password guessing against single user	Uses knowledge about the account holder and the password policy to guess (s.10)	Enforce policies that make passwords hard to guess: minimum length, character set, time before passwords must be changed (s.10)
Electronic monitoring	Eavesdrops a password sent over a network to a remote system (s.10)	Use strong encryption methods (s.10)

Summary list of countermeasures (s.11): stop unauthorized access to the password file; intrusion detection measures; account lockout mechanisms; policies against common passwords but rather hard-to-guess ones; training and enforcement of policies; encrypted network links. See Concept - Password Vulnerabilities and Countermeasures.

5. Hashed passwords and salt (s.12-15)

• Figure s.12 shows the UNIX scheme: (a) loading a new password and (b) verifying a password (details in Figures).
• Why a salt value? (s.13) It (1) prevents duplicate passwords from being visible in the password file, (2) increases the difficulty of offline dictionary attacks, (3) makes it nearly impossible to tell if a person used the same password on multiple systems.
• UNIX original scheme (s.14): user selects a password up to 8 characters to form a 56-bit key (7-bit ASCII, so $8\times 7=56$ bits); the hash function Crypt(3), a modified DES, converts the password together with a 12-bit salt; the modification makes DES a one-way hash function; the output is translated to an 11-character sequence; now regarded as “woefully insecure”.
• Improved implementations (s.15):

Scheme	Salt	Hash details
Original UNIX Crypt(3) (s.14)	12-bit	modified DES, 8-char password, 11-character output
MD5-based (s.15)	48-bit	password length unlimited; hashed with 1000 times inner loop; produces 128-bit hash
Bcrypt (OpenBSD, “the most secure”) (s.15)	128-bit	based on the Blowfish block cipher; creates a 192-bit hash value

Slide warning (s.15, red): “MD5 has been found to suffer from extensive vulnerabilities.” See Concept - Password Hashing and Salt.

6. Password cracking (s.16-18)

• Offline dictionary attack (s.16): uses a large dictionary of possible passwords; each dictionary password is hashed with each available salt value and compared with the system password file; uses common variations (backward spelling, additional numbers, special characters) to raise the chance.
• Rainbow table attack (s.16): a large dictionary; for each password precompute tables of hash values for all salts; a mammoth table (e.g. 1.4 GB) cracks 99.9% of alphanumeric Windows passwords in 13.8 seconds; not feasible if larger salt values are used.
• Password choices/concerns (s.17): short passwords (a Purdue study of 7000 accounts: 3% were 3 characters or less) fixed by rejecting too-short choices; guessable passwords (a study of 14,000 encrypted passwords guessed nearly 1/4; about 1 hour on the fastest systems to compute all variants, “and only need 1 break”).
• Another case study (s.18): analysis of the structure of real passwords to build an intelligent cracker; a study of 25,000 students’ passwords showed that over 10% were recovered after $10^{10}$ guesses.
• See Concept - Password Cracking.

7. Password file access control (s.19)

• Block offline guessing by denying access to the encrypted passwords: make them available only to privileged users, often through a separate shadow password file (hashed passwords kept in a separate file from the user IDs) (s.19).
• Still vulnerable through: an O/S bug exploit; an accident with permissions making the file readable; users with the same password on other systems; access from unprotected backup media; sniffing passwords in unprotected network traffic (s.19). See Concept - Password File Access Control.

8. Using better passwords (s.20)

Goal: eliminate guessable passwords while keeping them easy for the user to remember. Techniques: user education; computer-generated passwords; reactive password checking (the system periodically runs its own password cracker, cancels guessed passwords and notifies the user; can be costly in resources); proactive password checking (user selects the password, the system checks it and rejects it if not allowed; must balance user acceptability and strength; “likely the best solution”). See Concept - Better Passwords.

9. Token-based authentication (s.21-23)

• A token is an object the user possesses; examples: memory card (magnetic stripe) and smartcard (s.21).
• Memory card (s.22): stores but does not process data; magnetic stripe card (e.g. bank card) or electronic memory card; used alone for physical access (hotel rooms), some with a password/PIN (ATMs). Drawbacks: need a special reader; loss of token; user dissatisfaction (OK for ATM, not OK for computer access).
• Smartcard (s.23): credit-card like; has its own processor, memory and I/O ports; ROM, EEPROM, RAM; executes a protocol to authenticate with the reader/computer. Three protocols: static (like memory cards), dynamic (passwords created every minute, entered manually or electronically), challenge-response (computer creates a random number, smartcard provides its hash, “similar to PK”).
• See Concept - Memory Card and Smartcard.

10. Biometric authentication (s.24-25)

• Authenticates the user from a physical characteristic: facial, fingerprint, hand geometry, retina pattern, iris, signature, voice (s.24). Figure s.24 plots cost against accuracy (see Figures).
• Accuracy (s.25): the system generates a matching score (a number) quantifying similarity between the input and the stored template. Concerns: sensor noise and detection inaccuracy. Problems: false match and false non-match. Figure s.25 shows the imposter and genuine-user probability curves and the decision threshold $t$.
• See Concept - Biometric Authentication.

11. Remote user authentication (s.26-27)

• Authentication over a network is more complex: eavesdropping and replay are problems (s.26). Generally use challenge-response: user sends identity; host responds with random number $r$; user computes $f(r,h(P))$ and sends it back; host compares with its own computed value and if they match the user is authenticated (s.26).
• Protocol figure (s.27): the same approach is used for token and biometric verification. See Concept - Challenge-Response.

12. Authentication security issues (s.28-31)

Issue	Description	Countermeasure
Client attacks (s.28)	Attacker tries to achieve user authentication without access to the remote host; masquerades as a legitimate user (guess or try all passwords)	Strong passwords; limit number of attempts
Host attacks (s.29)	Attacker attacks the host where passwords/passcodes are stored	Hashing, protect password databases
Eavesdropping (s.30)	Attacker learns passwords by observing the user, finding written passwords, keylogging	Diligence to keep passwords; multifactor authentication; admin revokes compromised passwords
Replay (s.31)	Attacker repeats a previously captured user response	Challenge-response; 1-time passcodes (OTP)

See Concept - Authentication Security Issues.

13. Practical application: iris biometric system (s.32)

A bank example: customers access accounts from home over the Internet or enroll at a bank branch; the verification server converts an iris image to an iris code and matches it with the CIN against a database. See Concept - Iris Biometric System and Figures.

Figures & diagrams

• Use of hashed passwords (s.12): two flow diagrams. (a) Loading a new password: a 12-bit salt and the 56-bit password enter crypt(3), whose 11-character output is loaded into the Password File with columns User id, salt, crypt(3) output. (b) Verifying a password: the User id selects a row; the stored salt and the entered password go into crypt(3); the result is compared with the stored encrypted password. Takeaway: the salt is stored in clear next to the hash and is reused at verification.
• Password cracking graph (s.18): x-axis number of guesses ($10^4$ to $10^{13}$, log scale), y-axis percent guessed (0-50%). The curve is about 1-2% at $10^7$, about 12% at $10^{10}$ and about 37% at the $10^{13}$ gridline, and ends near 47-48% just past $10^{13}$ (values read by eye from the plot; x-axis labelled $10^4$, $10^7$, $10^{10}$, $10^{13}$). Takeaway: a large fraction of real passwords fall to a feasible number of guesses.
• Smartcard chip (s.23): drawing of a 85.6 mm x 54 mm card (dimensions as printed) with a typical chip layout: RAM, EEPROM, ROM, CPU and Crypto coprocessor.
• Biometric cost vs accuracy (s.24): y-axis cost, x-axis accuracy. Iris is top right (highest cost and accuracy), retina and finger are mid-accuracy (retina higher cost than finger), hand, signature, face and voice sit at low accuracy with cost falling from hand (highest) to voice (lowest). Positions are approximate; the plot has no numbers.
• Biometric accuracy plot (s.25): probability density against matching score $s$. Left curve is the imposter profile (average matching value of imposter), right curve is the profile of genuine user (average matching value of genuine user); a dotted vertical line marks the decision threshold (t). The shaded tail of the genuine curve below $t$ is “false nonmatch possible”; the shaded tail of the imposter curve above $t$ is “false match possible”. Takeaway: moving $t$ trades one error for the other.
• Protocol for a password verification (s.27): client sends $U$ (user); host picks random number $r$ and functions $h()$, $f()$ and sends $(r,h(),f())$; the client enters $P^{\prime }$ and returns $f(r^{\prime },h(P^{\prime }))$; the host checks if $f(r^{\prime },h(P^{\prime }))=f(r,h(P(U)))$ then yes else no, and replies yes/no.
• Iris biometric system (s.32): customer domain (PC/laptop with SecureCam client, Java, browser with home banking screens, 20 Kbytes maximum compressed iris image file) connects over the Internet to the existing IT infrastructure (web server, firewall, local server, PIN server), which accepts access either by PIN or by iris biometric “for higher valued transactions”. Over the bank intranet, the verification server has link decryption, image reconstruction, iris encoding and matching modules plus an iris database and an administrative application. A bank branch office public-use device (enroll or verify station: enroll application/GUI and link encryption) sends enrollment or verification iris code + CIN; customers enroll at a bank branch and access accounts via an ATM. The server matches the iris code and CIN to the database and returns status allowing or denying access.

Key terms

Concept - User Authentication · Concept - Means of Authentication · Concept - Password Vulnerabilities and Countermeasures · Concept - Password Hashing and Salt · Concept - Password Cracking · Concept - Password File Access Control · Concept - Better Passwords · Concept - Memory Card and Smartcard · Concept - Biometric Authentication · Concept - Challenge-Response · Concept - Authentication Security Issues · Concept - Iris Biometric System

Formulas

• Password key size: $8\text{ chars}\times 7\text{ bits}=56\text{ bits}$ (s.14).
• Challenge-response check: user sends $f(r^{\prime },h(P^{\prime }))$; host accepts if $f(r^{\prime },h(P^{\prime }))=f(r,h(P(U)))$ (s.27).
• Hash lengths: MD5 variant 128-bit hash, 48-bit salt; Bcrypt 192-bit hash, 128-bit salt; original UNIX 12-bit salt, 11 characters output (s.14-15).

Likely exam questions

1. List the four means of authenticating a user’s identity with an example each. Something the individual knows (password, PIN), possesses (key, token, smartcard), is (static biometrics: fingerprint, retina), does (dynamic biometrics: voice, signature) (s.5).
2. Fill in the blank: the process of verifying an identity claimed by or for a system entity is called user ____. authentication (s.4). Two steps: identification and verification.
3. Why is a salt used in password hashing? Prevents duplicate passwords being visible in the file, makes offline dictionary attacks harder, and makes it nearly impossible to tell that someone reused a password on several systems (s.13).
4. Describe how a password is loaded and verified in the UNIX scheme. Load: salt (12 bits) + password (56 bits) go through crypt(3), the 11-character output is stored with user id and salt. Verify: user id selects the row, stored salt + entered password through crypt(3), compare with stored output (s.12, 14).
5. Compare offline dictionary attacks and rainbow table attacks. Dictionary: hash each candidate with each salt then compare to the file. Rainbow: precompute tables of hash values for all salts; fast (1.4 GB cracks 99.9% of alphanumeric Windows passwords in 13.8 s) but not feasible when larger salt values are used (s.16).
6. Name a countermeasure for each password attack. Offline dictionary: protect the file, IDS, reissue; specific account: lockout; popular password: ban common passwords, scan IPs; single user guessing: password policy; electronic monitoring: strong encryption (s.8-10).
7. Differentiate reactive and proactive password checking. Reactive: system runs its own cracker periodically and cancels guessed passwords, costly; proactive: checks the user’s choice when set and rejects weak ones, likely the best solution (s.20).
8. Memory card vs smartcard? Memory card only stores data (needs a special reader); smartcard has its own processor, memory and I/O and runs an authentication protocol (static, dynamic, challenge-response) (s.22-23).
9. Explain false match and false non-match in biometrics. Matching score compares input to stored template; false match = imposter accepted, false non-match = genuine user rejected, caused by sensor noise and inaccuracy; threshold $t$ trades them (s.25).
10. Explain challenge-response and which attack it stops. User sends identity; host returns random $r$; user returns $f(r,h(P))$; host compares; stops replay (s.31); s.26 says it protects against a number of attacks.

Added context

The slides do not spell out which side of the threshold each error falls on in words; the mapping “false match = imposter accepted, false non-match = genuine rejected” is the standard reading of the figure on s.25.

Common confusions

• Identification vs verification: identification = say who you are (identifier); verification = prove the binding between you and the identifier (s.4).
• User authentication vs message authentication: the first verifies a person/entity; the second is about integrity of exchanged messages (s.4).
• Salt is not secret: it is stored in the password file beside the hash (s.12); its listed jobs are the three on s.13 (hide duplicates, harden offline dictionary attacks, hide reuse across systems); it does not hide the password. (Added context: it is also what makes precomputed rainbow tables impractical, per s.16 “not feasible if larger salt values used”.)
• Shadow file vs hashing: hashing protects the stored value; the shadow file hides the hashes from ordinary users (s.19). Both are needed.
• Static vs dynamic biometrics: “is” (fingerprint, retina) vs “does” (voice, signature) (s.5).
• Static, dynamic and challenge-response smartcards are three different protocols (s.23).
• Slide quirk: s.14 says “Now regarded as woefully insecure” for the original UNIX scheme, while s.15 flags MD5 as vulnerable too; only Bcrypt is called “the most secure”.

Slide errors and gaps noticed

• s.3 lists “Understand the use of the Bloom filters in password management” as a learning objective, but no slide in this deck covers Bloom filters (see Added Context - Topics Mentioned but Not on the Slides).
• s.2 lists a “case stury: security problems for ATM systems” (sic); s.33 only says “Example application and case study”. There is no ATM case study slide, only the iris system (s.32).
• s.5 typo “Based one something”; s.4 “the exchanges messages”.
• s.26 writes $f(r,h(P))$ while s.27 uses primed values $r^{\prime }$ and $P^{\prime }$ on the client side; they are the same protocol (client may send a wrong $P^{\prime }$).

Slide coverage

Slide	Content	Covered in
1	Title: Chapter 3 User Authentication	Overview
2	Chapter 3 overview list (8 topics)	Overview, gaps
3	Learning objectives (incl. Bloom filters)	Overview, gaps
4	User authentication definition, identification/verification	Detailed 1
5	Four means of authentication	Detailed 2
6	Password authentication	Detailed 3
7	Password vulnerabilities list	Detailed 4
8	Offline dictionary attack + countermeasures	Detailed 4
9	Specific account and popular password attacks	Detailed 4
10	Single-user guessing and electronic monitoring	Detailed 4
11	Countermeasures summary	Detailed 4
12	Use of hashed passwords figure	Detailed 5, Figures
13	Why a salt value	Detailed 5
14	UNIX original scheme (Crypt(3))	Detailed 5
15	Improved implementations: MD5, Bcrypt	Detailed 5
16	Password cracking: dictionary, rainbow tables	Detailed 6
17	Password choices/concerns (Purdue, 14,000)	Detailed 6
18	Another case study + guess graph	Detailed 6, Figures
19	Password file access control, shadow file	Detailed 7
20	Using better passwords, reactive/proactive	Detailed 8
21	Token-based authentication intro	Detailed 9
22	Memory card	Detailed 9
23	Smartcard + chip figure	Detailed 9, Figures
24	Biometric authentication + cost/accuracy chart	Detailed 10, Figures
25	Biometric accuracy + curves	Detailed 10, Figures
26	Remote user authentication (challenge-response)	Detailed 11
27	Protocol for password verification figure	Detailed 11, Figures
28	Security issue: client attacks	Detailed 12
29	Security issue: host attacks	Detailed 12
30	Security issue: eavesdropping	Detailed 12
31	Security issue: replay	Detailed 12
32	Practical application: iris system figure	Detailed 13, Figures
33	Summary	Overview

Previous: none | Next: 04 Access Control - Chunk 01 (s.1-28) (next deck) | Up: 03 User Authentication - Index