Password-based Authentication Research Articles

Password-based authentication and key distribution protocols with perfect forward secrecy

In an open networking environment, a workstation usually needs to identify its legal users for providing its services. Kerberos provides an efficient approach whereby a trusted third-party authentication server is used to verify users' identities. However, Kerberos enforces the user to use strong cryptographic secret for user authentication, and hence is insecure from password guessing attacks if the user uses a weak password for convenience. In this paper, we focus on such an environment in which the users can use easy-to-remember passwords. In addition to password guessing attacks, perfect forward secrecy (PFS in short) is another important security consideration when designing an authentication and key distribution protocol. Based on the capability of protecting the client's password, the application server's secret key, and the authentication server's private key, we define seven classes of perfect forward secrecy and focus on protocols achieving class-1, class-3, and class-7 due to their hierarchical relations. Then, we propose three secure authentication and key distribution protocols to provide perfect forward secrecy of these three classes. All these protocols are efficient in protecting poorly-chosen passwords chosen by users from guessing attacks and replay attacks.

Security analysis of a password-based authentication protocol proposed to IEEE 1363

In recent years, several protocols for password-based authenticated key exchange have been proposed. These protocols aim to be secure even though the sample space of passwords may be small enough to be enumerated by an off-line adversary. In Eurocrypt 2000, Bellare, Pointcheval and Rogaway (BPR) presented a model and security definition for authenticated key exchange. They claimed that in the ideal-cipher model (random oracles), the two-flow protocol at the core of Encrypted Key Exchange (EKE) is secure. Bellare and Rogaway suggested several instantiations of the ideal cipher in their proposal to the IEEE P1363.2 working group. Since then there has been an increased interest in proving the security of password-based protocols in the ideal-cipher model. For example, Bresson, Chevassut, and Pointcheval have recently showed that the One-Encryption-Key-Exchange (OEKE) protocol is secure in the ideal cipher model. In this paper, we present examples of real (NOT ideal) ciphers (including naive implementations of the instantiations proposed to IEEE P1363.2) that would result in broken instantiations of the idealised AuthA protocol and OEKE protocol. Our result shows that the AuthA protocol can be instantiated in an insecure way, and that there are no well defined (let alone rigorous) ways to distinguish between secure and insecure instantiations. Thus, without a rigorous metric for ideal-ciphers, the value of provable security in ideal cipher model is limited.

Cryptanalysis of two password-based authentication schemes using smart cards

Recently, Juang [2004. Comput Secur (23)] and Yoon et al. [2005. Comput Secur (24)] proposed password-based authentication schemes using smart cards. Juang's scheme further allows for key agreement. In this paper, we present attacks on both schemes.

A user authentication system using back-propagation network

Information security has been a critical issue in the field of information systems. One of the key factors in the security of a computer system is how to identify the authorization of users. Password-based user authentication is widely used to authenticate a legitimate user in the current system. In conventional password-based user authentication schemes, a system has to maintain a password table or verification table which stores the information of users’ IDs and passwords. Although the one-way hash functions and encryption algorithms are applied to prevent the passwords from being disclosed, the password table or verification table is still vulnerable. In order to solve this problem, in this paper, we apply the technique of back-propagation network instead of the functions of the password table and verification table. Our proposed scheme is useful in solving the security problems that occurred in systems using the password table and verification table. Furthermore, our scheme also allows each user to select a username and password of his/her choice.

Security analysis and improvement of the efficient password-based authentication protocol

We analyze and improve the security of the efficient password-based authentication protocol that has been proposed recently in the Australasian conference on information security and privacy (ACISP) 2003. Its distinct idea is to utilize two generators of a certain cyclic group for efficiency, while the protocol is vulnerable to the server compromise attack on the contrary to the original assumption. Fortunately, we improve its security in this paper and also remark on its extended version called EPA+.

Security analysis and improvement of the efficient password-based authentication protocol

We analyze and improve the security of the efficient password-based authentication protocol that has been proposed recently in the Australasian conference on information security and privacy (ACISP) 2003. Its distinct idea is to utilize two generators of a certain cyclic group for efficiency, while the protocol is vulnerable to the server compromise attack on the contrary to the original assumption. Fortunately, we improve its security in this paper and also remark on its extended version called EPA+.

One-time password-based high performance per-packet authentication for capsule networks

Most traditional security for capsule-type active networks focused on node-level security mechanism that tries to restrict resource consumption of a packet at a node. Network level security mechanism, which restricts resource consumption in the whole network like ttl in ipv4, is also necessary for capsule. We propose high-performance per-packet authentication mechanism for this purpose. The proposed authentication mechanism uses packet-loss-resistant one-time password algorithm to avoid multiple packet exchanges between user terminals and routers. Since the address in a node where a packet’s authentication data is stored can be easily calculated from the information contained in the packet, we can authenticate the packet without searching a database. The overhead in the packet for authentication information is 46 bytes, and a Linuxpc with a 2.8 GHz Intel Pentium 4 processor can authenticate and process a packet in 22 µs, which corresponds to 45,000 authentications per second.

A dynamic ID-based remote user authentication scheme

Password-based authentication schemes are the most widely used techniques for remote user authentication. Many static ID-based remote user authentication schemes both with and without smart cards have been proposed. Most of the schemes do not allow the users to choose and change their passwords, and maintain a verifier table to verify the validity of the user login. In this paper we present a dynamic ID-based remote user authentication scheme using smart cards. Our scheme allows the users to choose and change their passwords freely, and do not maintain any verifier table. The scheme is secure against ID-theft, and can resist the reply attacks, forgery attacks, guessing attacks, insider attacks and stolen verifier attacks.

Password-based user authentication and key distribution protocols for client–server applications

Up to now, most of the literature on three-party authentication and key distribution protocols has focused on the environment in which two users (clients) establish a session key through an authentication server. In this paper, we discuss another environment in which a user (client) requests service from an application server through an authentication server. We propose two secure and efficient authentication protocols (KTAP: key transfer authentication protocol and KAAP: key agreement authentication protocol) to fit this environment. These two proposed protocols can be efficiently applied to various communication systems in distributed computing environments since they provide security, efficiency, and reliability.

Robust and Simple Authentication Protocol

Password-based authentication protocols are currently the conventional authentication protocols in many distributed systems. However, the security of these protocols is falling behind the times because more and more attacks can now break them. The security weaknesses of the Simple And Secure (SAS) protocol, the Optimal Strong-Password Authentication (OSPA) protocol, and the revised SAS protocols are examined in this paper. We then propose our RObust and SImple (ROSI) protocol to help raise security levels. The ROSI protocol can be easily implemented and has lower communication costs than most other protocols.

Security of the Jan-Tseng integrated schemes for user authentication and access control

The authors show that two proposed password-based user authentication and access control schemes by Jan and Tseng are not secure against impersonation attack, i.e. an adversary can successfully pretend to be any legitimate user and take over all access rights granted to that user without being detected. The authors also present corrections to these two schemes, and provide the same administration functions as orignally intended.

Efficient and secure password-based authentication protocols against guessing attacks

We propose authentication and key exchange protocols which are both efficient and secure against password guessing attacks. Conventional authentication protocols have assumed that a strong secret should be shared between communicating participants, in the light of a threat of guessing attacks. A cryptographically long secret would be favored for security reasons, but it is not suitable for users to remember. Recent password-based protocols to defeat guessing attacks are more expensive than previous ones, in terms of the computation and communication costs. Using a one-time pad and a strong one-way hash function, we promote both security and efficiency. Thereby, we also verify our protocol formally.

Authentication services for computer networks and electronic messaging systems

The paper surveys the authentication services used by modern computer systems and presents the major operational authentication services employed by commercial companies, banking as well as government departments. As distributed system services are susceptible to a variety of threats mounted by intruders as well as legitimate users of the system, password-based authentication is not suitable for use on computer networks.

Password-based authentication

The people who invented computer passwords obviously never met Charlie Fox. During my high school years, I worked Saturdays and Summers at Hampton General Store, in the small New England village of Hampton, Connecticut. Charlie Fox was the postman. For many years, every day at 3:30 PM Charlie would come into the store, having finished his route. Every day he took down the phone book, looked up his home telephone number, and called his wife to ask for her grocery order. He was a pleasant and perfectly normal fellow, but one who just couldn't remember a phone number, even his own.