Sebery J.Cryptography.An introduction to computer security.1989

e) V stops and rejects when gh 6 xb mod N.

After passing through t(n) rounds without rejection, V halts and accepts.

Show that the protocol is complete and sound.

5.Consider G3C$ protocol. It is assumed that the veri er strictly obeys the protocol. Modify the corresponding transcript simulator. What is the time complexity of the modi ed simulator?

6.Take the bit commitment scheme based on DL. Prove that secrecy is unconditional. Is this still true if the veri er knows that the prover chooses y < p2 ?

7.Let us consider the bit commitment based on the GI problem. Show how the prover can cheat if she knows the permutation that establishes the isomorphism between public graphs H and G.

8.Given the bit commitment scheme based on QR. Assume that P cheats and sends s that

9.Recall the string commitment scheme based on DL. Prove that secrecy is unconditional. Show that if a particular instance of DL is easy, then P can always open a blob to a di erent string.

10.Consider the bit commitment based on claw free permutations. Prove that binding is conditional and secrecy holds unconditionally.

13 IDENTIFICATION

Identi cation is usually one of the rst safeguards that is used to protect computer resources against an unauthorized access. Any access control that governs how the computer resources are accessed and by whom, assumes that there is an identi cation mechanism that works reliably.

There is a large volume of literature that covers di erent aspects of entity identi cation. A good overview of the topic can be found in [338, 497].

13.1 Basic Identi cation Techniques

Identi cation of a person, host, intelligent terminal, program, system, etc. can be seen as a two-party protocol. The two players involved are: the prover and veri er. The prover P also mnemonically called Peggy, wish to introduce herself to the veri er V , Victor, in such a way that Victor is convinced that he is indeed dealing with Peggy. An identi cation protocol can go wrong in two di erent ways. First, the failure can occur when an opponent, Oscar, manages to convince Victor that he is Peggy. This is a false acceptance. Secondly the failure occurs when Peggy fails to convince Victor about her identity. This is a false rejection. An identi cation protocol is characterized by two probabilities (also called rates). The probability of false acceptance Pfa and the probability of false rejection Pfr.

Consider two trivial identi cation protocols. In the rst protocol, Victor asks Peggy for her name and always accepts her under the given name. The probability of false acceptance Pfa = 1 and the probability of false rejection Pfr = 0. In the second protocol, Victor always rejects Peggy's proofs of identity. The probabilities of false acceptance Pfa = 0 and false rejection Pfr = 1. A \good" identi cation protocol should achieve both Pfa and Pfr as small as possible.

434 13 IDENTIFICATION

Identity of an entity (person, host, intelligent terminal, program, etc.) can be asserted by the veri cation of what the entity

{is,

{has, or

{knows.

The veri cation of \what the entity is" is traditionally referred to as user identi cation mainly because in a computer environment, hardly any entity displays unique and nontransferable identi cation characteristics. On the contrary, due to the ease of copying, all digital information can be duplicated making it impossible to distinguish copies from the original. Typically, a user identi cation mechanism uses unique and nontransferable characteristics such as ngerprints, retinal prints, hand signature, etc.

The veri cation of \what the entity has" makes sure that the entity has a unique token such as a smart card with some secret information, which can be used to prove the identity of the holder. The proof of identity is based on the assumption that the owner never loses its token. If a token is lost, it can be used by some other entity to falsely claim the identity of the owner of the token.

The veri cation of \what the entity knows" exploits a piece of secret information that is known to a given entity only. A common identi cation mechanism in this class applies passwords. The security of the identi cation relies on the security of the secret. Secrets that are compromised (revealed) can be used by unauthorized entities. On the other hand, forgotten secrets cannot be used by an authorized entity.

The identi cation based on what the entity has and knows uses a secret and unique information. The di erence is in the storage of the information. The secret can be stored away from the entity on a token (the token is owned by the entity) or just be stored within the entity (the entity knows the secret).

13.2 User Identi cation

Fingerprints are commonly considered as a unique characteristic of a person. The reliability of ngerprint identi cation is so high that it is legally admissible in court. Fingerprint identi cation systems use ridge and valley patterns. The patterns are classi ed into a collection of minutiae. The minutiae are stored as an individual ngerprint template. Currently available automated ngerprint

identi cation machines (AFIMs) verify persons with false acceptance/rejection probabilities approximately 10 3 or better. The enrollment time necessary to store an individual ngerprint template is usually below 10 seconds and requires about 1 kbyte memory storage. The veri cation time, typically takes around few seconds. However, AFIMs are still expensive and their prices range close to or above US$1000. Because of the cost and the relatively high error rates, their application in the computer environment is limited.

Similarly, both the iris and retina can be used as the base for identi cation. Retinal scan technology applies the capillary pattern of the retina and converts it to a digital pattern template. The template takes about 40 bytes of storage. The probability of false acceptance/rejection is smaller than 10 6. The enrollment time is approximately 30 seconds and the veri cation can be done in less than 2 seconds. Again this technology requires a dedicated hardware and is expensive.

Hand geometry and face images fall in the same category of biometric identi-cation. Hand geometry identi cation uses key geometric features of the topography of a hand. The features are encoded into a template that needs 10 bytes only. Face recognition is rapidly growing due to a noninvasive nature of the method. It can also be used for massive scanning for instance in the search for terrorists in airports. The false acceptance/rejection probabilities are smaller than 10 4.

The handwritten signature is a common method of authenticating paper documents. There are some features of the signature that tend to be di erent for each signature. More importantly, there are also features that do not change at all. They are related to habitual aspects of signing. To capture these unique signing patterns, signature veri cation systems uses analysis of the pen pressure, style, stroke direction, acceleration, and speed. A typical template that characterizes the unique signing features of an individual, takes about 1 kbyte. To create a template for a new person, the person is required to sign from ve to eight times. The veri cation time is less than 1 second. An attractive characteristic of signature is that a simple veri cation system can be implemented for all computer systems with a mouse with no additional hardware. The mouse can be used as a pen.

Voice veri cation can also be an option for person identi cation. Voice recognition devices are probably the least reliable in terms of their high false ac-

436 13 IDENTIFICATION

ceptance/rejection probabilities. Their useful feature is, however, that a voice sample can be taken remotely using a telephone only (no additional hardware).

When a person types on a keyboard, the keystroke characteristics (typing rhythms) also contain some unique features of the person. This veri cation method is the most \computer" friendly. Experiments showed that the false acceptance/rejection rate is still too high for any practical and reliable identi-cation. To make this technique reliable for identi cation, keyboards need to be equipped with special sensors to measure not only a typing rhythm but also some other typing features such as speed, acceleration, key pressure, etc.

For the sake of completeness, DNA identi cation needs to be added to the list of available identi cation methods. In theory, this method o ers the false acceptance/rejection rate equal to zero. The only exception is when the method is used to identify one of two identical twins. In practice, the identi cation service is provided by specialized laboratories only. The veri cation is time consuming and requires a sample of the tested person genetic material. Because of these properties, the method is not used for personal identi cation in the computer environment.

Biometric identi cation is vulnerable to all kinds of replay attacks. For example voice could be recorded and later replayed unless the tested person has to repeat a randomly selected sentence.

13.3 Passwords

The most popular single identi cation technique used in computer environments is via what a person knows. The piece of information memorized by a person is a password or personal identi cation number (PIN). PINs are passwords that are sequences of digits. This restriction is imposed by a speci c technology used in for example automated teller machines (ATMs) where the keypad has digit keys only. As the main requirement for passwords is that they have to be memorized by persons, their length has to restricted. Typically, the length varies from 4 to 9 alphanumeric characters.

Given a password of n characters. If the number of letters is 26 (upper and lower case letters are considered to be identical), the probability of guessing the password is 26 n, provided the password is selected independently and uniformly from the set of 26n possible words. If upper and lower case letters are

considered di erent, the guessing probability drops to 52 n. Further reduction can be achieved if a password can contain not only letters but also digits, and other printable characters such as $, %, <, f, ;, ", etc.

Typically password identi cation takes place every time a user, Peggy, wishes to login to a host computer V . Peggy knows her password while the host V maintains a password le in which V stores passwords of all registered users. Peggy types her login name and her password. Having the pair: login name, password, the host V checks whether there is an entry for Peggy and if so, compares the password submitted by Peggy with the one stored in the passwordle. If there is a match, Peggy can access the host, otherwise Peggy is identi ed as an illegal user and the access is denied. Note that the password le in the host has to be protected not only against users but, preferably, against a superuser as well. Usually, password les are protected by storing either encrypted or hashed passwords. The veri cation process would involve the same steps except that a password provided by Peggy is rst encrypted (or hashed) and then compared. Hashing has an advantage over encryption as it applies no cryptographic key.

Every time a password is used, its security decreases. The simple remedy would be to introduce password aging. A password is valid for its life time that is usually any time between 20 days and 3 months. In extreme, the life-time of a password can be a single login attempt. These passwords are called onetime passwords. Implementation of one-time passwords can be done simply by generating a list of passwords and applying them in some order. The main problem is now having them memorized by a user. A way out would be to store passwords on a token. This obviously shifts the identi cation from what a person knows to what a person possesses. One-time passwords could be created by repetitive application of a one-way function. Given a one-way function f and a password p0. The sequence of passwords is pi = f(pi 1) for i = 1; : : : ; n. The passwords are used by their holder in reverse order so the rst password to be used is pn and the last one is p0.

13.3.1 Attacks on Passwords

A password can be compromised every time it is used. An outsider may look over Peggy's shoulder when she is typing her password and learn it. To thwart the attack requires putting a keyboard in such a position that the movement of hands cannot be observed. Also, the use of one-time password may be a possi-

438 13 IDENTIFICATION

bility. After Peggy has typed her password, the password needs to be veri ed by the host. If Peggy access her host via remote terminal, her password may travel via unprotected communication channels to the host. The security risk becomes even higher if Peggy uses the Internet for a remote login.

Selection of passwords is crucial. Ideally, Peggy should choose her password at random. The problem with this is that random passwords are diÆcult to learn by heart. Consequently, users tend to choose passwords in a nonrandom way, making their passwords vulnerable to an exhaustive search attack. Knowing Peggy's habits, favourite movies, songs, etc. a potential attacker Oscar may restrict the search for Peggy's password to: her name, names of her friends, names of her relatives, names of her pets, names of her favourite actors, singers, sportwomen. If this fails, Oscar may try the name of Peggy's host computer, her phone numbers, her car registration number, the number of her passport, her address details, her birthday, and so on. Oscar may also try some easy to memorize combination of digits/letters such as a sequence of zeros. In general, Oscar may apply the so called dictionary attack. In this attack, Oscar tries all words (in lower and upper cases, written also backwards) in a typical (around 100,000 words) dictionary. To limit the eÆciency of the dictionary attack, it is desirable to put the upper bound on the number of unsuccessful password guesses after which the system terminates the login session with extra delays between subsequent attempts. This may not work when Oscar can access the encrypted password le.

Passwords may be easier to memorized and more diÆcult to guess if Peggy obeys the following rules when she selects her password:

1.Passwords should use the full allowed length of the password.

2.Password should contain special characters as $, %, &, @, f, [, (, etc. digits, lower and upper case letters.

3.Words in passwords should not be part of any dictionary (words should be composed from parts of an easy to memorize and long sequence with inserted digits and special characters).

Again we emphasize that only long and truly random passwords are immune against the exhaustive search and against any dictionary attack.

13.3.2 Weaknesses of Passwords

Identi cation based on passwords su ers from the following inherent weaknesses:

{The password veri cation process requires Peggy to show her password to Victor. After learning her password, Victor can try to impersonate Peggy.

{Victor never proves his identity to Peggy. Oscar may try to impersonate Victor to learn Peggy's password.

{The password communicated by Peggy to Victor does not depend on the current time. Oscar may use the replay attack.

The impact of the rst weakness can be reduced by encrypting or hashing passwords at the point of entry and handling them in an encrypted or hashed form. Typing passwords on a keyboard is itself still a potential hazard for security of a password. This weakness also raises the following question: is it possible to verify a piece of secret information without telling the secret? The answer is aÆrmative, and examples of such veri cation techniques are given in the next sections.

The prover-veri er relation is highly asymmetrical. Victor veri es Peggy's credentials but Peggy knows nothing about Victor's identity. The lack of mutual authentication is a major hurdle for extending the password-based identi cation to peer entities such as collaborating concurrent processes. Moreover, the two rst weaknesses can be used to launch a variety of masquerade attacks. Typically in the attack, an intelligent remote terminal (disconnected from the host) is applied to collect passwords from unsuspecting users who want to login to the host. After the prescribed user name and password have been typed by a user, the terminal aborts the session displaying a message

the host is temporarily unavailable due to scheduled maintenance, try again in 30 minutes

The attacker may even connect the terminal back to its host after 30 minutes making users believe that the message was true. Some other variants of the above attack may include a forged login program. The program asks a user for their name and password, stores the pair: user name, password and displays

wrong password, try again

440 13 IDENTIFICATION

After that it calls the original login program making the user believe that he or she has made a typing mistake. In these attacks, most users will not even realize that their passwords have been compromised.

Notice that passwords do not depend on time so, consequently, Victor does not know whether the current password has been sent now or perhaps it is a copy of a password sent some time ago. This property can also be exploited to design an attack on the password identi cation mechanism.

13.4 Challenge-Response Identi cation

Challenge-response identi cation is also called a strong entity authentication or handshaking protocol. The identi cation takes the form of a dialog between Peggy and Victor in which the password is never exchanged between them. Instead, the password known to both P and V, is used to generate \proper" responses to random challenges. In this context, passwords are playing the role of secret cryptographic keys used to perform computations on challenges. The challenge-response protocol can also be used by P and V to assert that they have been successful in running their key establishment protocol. In other words, P and V wish to verify whether they possess the right collection of keys.

13.4.1 Authentication of Shared Keys

Assume that two peer entities A and B (mnemonically Alice and Bob) are supposed to know the same cryptographic key k. Now they would like to verify whether they indeed share the same key. A typical challenge-response dialog for this case may proceed as follows.

Challenge-response protocol (a shared key)

Goal: Mutual authentication of A and B by checking whether they share a key k.

Assumptions: A and B choose two random challenges (nonces) rA and rB, respectively, and they use the same encryption algorithm.

Message Sequence: The protocol consists of the following sequence of messages:

1.A ! B : rA.

2.B ! A : fA; rA; rB gk.