Chapter 1

Access Control
Authentication
 Access Control
• Two parts to access control…
• Authentication: Are you who you say you are?
– Determine whether access is allowed or not
– Authenticate human to machine
– Or, possibly, machine to machine

• Authorization: Are you allowed to do that?

– Once you have access, what can you do?
– Enforces limits on actions

• Note 1: Authentication ≠ Identification

• Note 2: “access control” often used as synonym for
authorization
Chapter 1: Authentication 2
 Are You Who You Say You Are?
• Authenticate a human to a machine?
• Can be based on…
– Something you know
• For example, a password
– Something you have
• For example, a smartcard
– Something you are
• For example, your fingerprint

Chapter 1: Authentication

3
 Something You Know

• Passwords
• Lots of things act as passwords!
– PIN
– Secret question & its answer
– Handwritten signature
– Social security number (week)
– Mother’s maiden name (week)
– Date of birth (week)
– etc.
Chapter 1: Authentication

4
 Trouble with Passwords
• Attacks on passwords
1. Guessing, Dictionary, Rules, Masks
2. Social engineering
3. DB dumping, keylogging
4. Brute force
• Passwords are one of the biggest practical problems
facing security engineers today
– users tend to select bad passwords, which makes password
cracking easy (password experiment)

Chapter 1: Authentication

5
 Password Experiment
• Three groups of users. Each group advised to select
passwords as follows
– Group A: At least 6 chars, at least 1 non-letter
winner – Group B: Password based on passphrase
– Group C: 8 random characters
• Results
– Group A: About 30% of passwords cracked
– Group B: About 10% cracked
• A & B passwords easy to remember
– Group C: About 10% cracked
• Passwords hard to remember

Chapter 1: Authentication

6
 Password Experiment
• Passphrases provide the best option for password selection
• If no policy set, user compliance hard to achieve
– In each case, 1/3 did not comply
– 10% of passwords are likely easy to crack
• If passwords not assigned, best advice is…
– Choose passwords based on passphrase
– Use pwd cracking tool / cracked pwds DB to test for weak pwds:
HaveIBeenPwned
• Some apps prohibit passwords found in these DBs.

• Require periodic password changes?

– Forcing reluctant users to choose reasonably strong passwords is
not as simple as it might seem
Chapter 1: Authentication

7
 Good and Bad Passwords
• Bad passwords • Good Passwords?
– frank – jfIej,43j-EmmL+y
– Fido – 09864376537263
– Password – P0kem0N
– incorrect – FSa7Yago
– Pikachu
– 0nceuP0nAt1m8
– 102560
– PokeGCTall150
– AustinStamp
 A solution to the password problem would be to instead use
randomly generated cryptographic keys
 Humans must remember their passwords
Chapter 1: Authentication

8
 Keys vs. Passwords
• Crypto keys • Passwords
– Space key is 64 bits – Space passwords are 8
characters, and 256
different characters
– Then 264 keys – Then 2568 = 264 pwds
– Choose key at random… – Users do not select
passwords at random
– …then attacker must try – Attacker has far less
than 263 pwds to try
about 263 keys on
(dictionary attack)
average
Chapter 1: Authentication

9
 Password Retry Dilemma
• Suppose system locks after 3 bad passwords.
How long should it lock?
– 5 seconds
• Trudy might cycle through accounts!!
– 5 minutes
• Cause denial of service (DoS)
– Until SA restores service
• No apparent solution to this dilemma.

Chapter 1: Authentication

10
 Why Passwords?
• Why is “something you know” more popular than
“something you have” and “something you are”?
• Cost: passwords are free
• Convenience: easier for sysadmin to reset a password
than to issue a new thumb!!

Chapter 1: Authentication

11
 Attacks on Passwords
• Attacker could target…
– one particular account
– any account on system
– any account on any system
Or attempt a denial of service (DoS) attack (retry restriction)
• Attacking systems via passwords
– Common attack path
Outsider  normal user  administrator
• Access any account and then upgrade its level of privilege
– One weak password may be one too many!

Chapter 1: Authentication

12
 Password Storing and Verification
• Bad idea to store passwords in a file
• But we need to verify passwords
• Solution?
– Hash passwords
• Store y = h(password)
• Can verify entered password by hashing
• If Trudy obtains the password file (the ones that are
hashed),
– she does not (directly) obtain passwords ?!
– she obtained their hashed values, so what is the difference?
• But Trudy can try a forward search
– Guess x and check whether y = h(x)
Chapter 1: Authentication

13
 Dictionary Attack
• Trudy pre-computes h(x) for all x in a dictionary of
common passwords
• Suppose Trudy gets access to password file containing
hashed passwords
– She only needs to compare hashes to her pre-computed
dictionary
• What about public one time hashed dictionary
– Pre-computed hashes may be made public and attackers
widen their dictionary hash database
• Can we prevent this forward search attack?
– Or at least make it more difficult? And how?
Chapter 1: Authentication

14
 Salt
• Adding random data to the input of a hash function:
– Force hash uniqueness: same password results in different hashes
– Increase complexity without increasing user requirements (no extra
requirements for users)
• Choose random salt s, compute: y = h(password, s)
and store (s,y) in the password file.
• The salt is not secret
– Analogous to IV
• Still easy to verify salted password
• But lots more work for Trudy
– Why?
Chapter 1: Authentication

15
 Pepper
• A pepper (aka secret salt) is a secret value added to a
password before hashing. It can be considered as a second
salt.
• A pepper is generated and kept secret by the server outside
the DB to protect passwords against DB dumping (it is
usually a hard-coded constant).
• Choose secret pepper p and random salt s and compute:
y = h(password, s, p)
– store (s,y) in the password file
• Without the pepper Trudy cannot find the correct password
• How can Trudy calculate p?
Chapter 1: Authentication

16
 Still Other Password Issues
• Too many passwords to remember
– results in password reuse. Is this a problem?
• Social engineering
– 34% of users will give their passwords if asked.
– “Social engineering is the term used for a broad range of malicious activities
accomplished through human interactions. It uses psychological manipulation
to trick users into making security mistakes or giving away sensitive
information.”
• keystroke logging, spyware, ……etc.
• Failure to change default passwords
• Who suffers from bad password?
– ATM weak PIN: you lose
– Work password: whole company loses
Chapter 1: Authentication

17
 Password Cracking Tools
• Popular password cracking tools
– Software: Hashcat, John the Ripper
– Online: Password Crackers
– Hardware rental: onlinehashcrack
• Admins should use these tools to test for weak
passwords since attackers will

Chapter 1: Authentication

18
 Biometrics

Chapter 1: Authentication

19
 Something You Are
• Biometric
– “You are your key” : Schneier
 Examples
• Fingerprint
• Facial recognition Are
• Speech recognition Have
Know
• Gait (walking) recognition
• “Digital doggie” (odor recognition)
• Many more!

Chapter 1: Authentication

20
 Why Biometrics?
• May be better than passwords
• But, cheap and reliable biometrics needed
– Today, an active area of research
• Biometrics are used in security today
– Thumbprint mouse
– Palm print for secure entry
– Fingerprint to unlock car door
– Fascial recognition to unlock phone
– etc.
• But biometrics not too popular
– Has not lived up to its promise/ hype (yet?)
Chapter 1: Authentication

21
 Ideal Biometric
• Universal : applies to (almost) everyone
– In reality, no biometric applies to everyone
• Distinguishing : distinguish with certainty
– In reality, cannot hope for 100% certainty
• Permanent : physical characteristic being measured never
changes
– In reality, OK if it remains valid for long time
• Collectable : easy to collect required data
– Depends on whether subjects are cooperative (when used
for identification)
• Also safe, robust, user-friendly, and ???
Chapter 1: Authentication

22
 Identification vs. Authentication
• Identification : Who are you?
– Compare one-to-many
– Example: suspicious fingerprint is sent to the FBI database of fingerprints for
comparison with millions of fingerprints.
• Authentication : Are you who you say you are?
– Compare one-to-one
– Example: Thumbprint mouse
– Username/Password
• i.e. is the used password matches the one that is saved on the system?

• Identification problem is more difficult

– More “random” matches since more comparisons
• We are (mostly) interested in authentication
Chapter 1: Authentication

23
 Enrollment vs. Recognition
• Enrollment phase
– Subject’s biometric info are collected and put into database
– Must carefully measure the required info
– Since it is one-time work, it is OK if it is slow and multiple measurements are
required
– Must be very precise
– Fielded vs. laboratory measurement: May be a weak point in real-world use
• Recognition phase
– Biometric detection, when used in practice
– Must be quick and simple
– But must be reasonably accurate

Chapter 1: Authentication

24
 Biometric Errors
• Fraud rate vs. insult rate
– Fraud : Trudy mis-authenticated as Alice
– Insult : Alice not authenticated as Alice
• For any biometric,
– we can decrease fraud or insult, but the other one will increase
– For example
• 99% voiceprint match required  low fraud, high insult
• 30% voiceprint match required  high fraud, low insult

• Equal error rate: rate where fraud == insult (balanced)

– A way to compare different biometrics
Chapter 1: Authentication

25
 Fingerprint Comparison
• Galton's system:
– Pre-computer era system
– Examples of loops, whorls, and arches
– Minutia extracted from these features

Loop (double) Whorl Arch

Chapter 1: Authentication

26
 Fingerprint: Enrollment
• Modern systems

1. Capture image of fingerprint

2. Enhance image
3. Identify “points”
• Some countries require fixed number of “points” to match in
criminal cases
– In Britain, at least 15 points
– In US, no fixed number of points
Chapter 1: Authentication

27
 Fingerprint: Recognition

match

• Extracted points are compared with information

stored in database
• Is it a statistical match?
• Aside: Do identical twins’ fingerprints differ?
Chapter 1: Authentication

28
 Hand Geometry
 A popular biometric
 Measures shape of hand
o Width of hand, fingers
o Length of fingers, etc.

 Human hands not so unique!!!

 Hand geometry sufficient for
many situations
 OK for authentication
 Not useful for ID problem

Chapter 1: Authentication

29
 Hand Geometry
• Advantages
– Quick : 1 minute for enrollment, 5 seconds for
recognition
– Hands are symmetric : so what?
• The other hand can be used
• Disadvantages
– Cannot use on very young or very old people
– Relatively high equal error rate

Chapter 1: Authentication 30
 Iris Patterns

• One of the best biometric authentication

• Iris pattern development is “chaotic”
– Minor variations lead to large differences
• Little or no genetic influence
– Even for identical twins, uncorrelated
– Even the two eyes of one individual
• Pattern is stable through lifetime
Chapter 1: Authentication

31
 Iris Scan
• Needs sophisticated equipment and software.

• Process
– First, the scanner locates the iris

– Then take black/white photo

– Then a 2-D wavelet transform

• The result is 256 bytes (2048-bit) iris code

• Two iris codes are compared based on the

Hamming distance between them

Chapter 1: Authentication

32
 Measuring Iris Similarity
• Based on Hamming distance
• Define d(x,y) to be:
Ex. d(0010,0101) = 3/4 and
d(101111,101001) = 2/6 = 1/3
• Compute d(x,y) on 2048-bit iris code
– Perfect match is d(x,y) = 0
• Can be expected in practice ???
• Under lab conditions, for same iris, expected distance is 0.08
– At random, expect distance of 0.50
– Accept iris scan as match if distance < 0.32
Chapter 1: Authentication

33
 Iris Scan Error Rate
distance Fraud rate
0.2 1 in
9 1.31010
0.3
1 in 1.5109
0
0.3
1 in 1.8108
1
0.3
1 in 2.6107
2
0.3
distance 1 in 4.0106
3 == equal error rate
The overlap does NOT exist (or very small in practice),
0.3
which means very small error rate 1 in 6.9105
4
Chapter 1: Authentication 34
0.3 5
 Attack on Iris Scan
• Good photo of eye can be scanned
– Attacker could use photo of eye
 Eg. Afghan woman was authenticated by iris scan of an
old photo
o Story can be found here (http://news.bbc.co.uk/2/hi/south_asia/1870382.stm)
 To prevent attack, scanner could use light to be sure it
is a “live” iris (pupil contracts).

Chapter 1: Authentication

35
 Equal Error Rate Comparison
• Equal error rate (EER): the point at
which the Fraud-Rate = Insult-Rate
– The best measure

• Fingerprint biometrics used in practice

have EER ranging from about 10-3
• Hand geometry has EER of about 10-3
• Iris scan has EER of about 10-5
– Enrollment phase may be critical to
accuracy

• Biometrics useful for authentication…

– …but for identification, not so impressive
today
Chapter 1: Authentication

36
 Biometrics: The Bottom Line
• Biometrics are hard to forge
• But attacker could
– Steal Alice’s thumb
– Photocopy Bob’s fingerprint, eye, etc.
– Subvert software, database, “trusted path” …
• More sophisticated biometric systems might be able
to detect such attacks, but for which cost?
• And how to revoke a “broken” biometric?
• Passwords are (to remain) free
• Biometric use is relatively limited today, should that
change in the (near) future?
Chapter 1: Authentication

37
 Something You Have
• Something in your possession
• Examples include following…
– Car key (or any physical key)
– RFID tag
– Phone, Laptop computer
– Password generator (next)
– ATM card, smartcard, etc.

Chapter 1: Authentication

38
 Smart Cards

A Smartcard reader

• The Private key is generated in the crypto module residing in the smart
card.
• The key is kept in the memory of the smart card.
• The key is highly secured as it doesn’t leave the card, the message digest is
sent inside the card for signing, and the signatures leave the card.
• The card gives mobility to the key and signing can be done on any system.
(Having smart card reader)

Chapter 1: Authentication 39
 Hardware Tokens

• They are similar to smart cards in functionality as

– Key is generated inside the token.
– Key is highly secured as it doesn’t leave the token.
– Highly portable.
– Machine Independent.
• iKEY is one of the most commonly used tokens as it doesn’t need a
special reader and can be connected to the system using USB port.

Chapter 1: Authentication 40
 Hardware Tokens
Several types :
• Static password token
The device contains a password (key) which is physically hidden (not
visible to the possessor), but which is transmitted for each
authentication. This type is vulnerable to replay attacks.
• Synchronous dynamic password token
A timer is used to rotate through various combinations produced by a
cryptographic algorithm. The token and the authentication server must
have synchronized clocks.
• Asynchronous password token
A one-time password is generated without the use of a clock, either
from a one-time pad or cryptographic algorithm.

Chapter 1: Authentication

41
 Hardware Tokens
Several types :
• Challenge response token
Using public key cryptography, it is possible to prove possession of a
private key without revealing that key. The authentication server
encrypts a challenge (typically a random number, or at least data with
some random parts) with a public key; the device proves it possesses a
copy of the matching private key by providing the decrypted challenge.
• Password generator token
A password generator is a small device that the user must have (and use)
to log in to a system (next)

Chapter 1: Authentication

42
 Password Generator
0. “I’m Alice”
1. R
2. PIN, R
password 3. h(K,R)
generator 4. h(K,R)
K Alice Bob, K
1. Alice receives random “challenge” R from Bob
2. Alice enters PIN and R in password generator
3. Password generator has symmetric key K with R
4. Alice sends “response” h(K,R) back to Bob
 Bob verifies response
– Both Bob and the password generator must have the key K

– If the response is correct, Bob is convinced that he's indeed talking to Alice,

• since only Alice is supposed to have the password generator

• Note: Alice has pwd generator and knows PIN
– since the password generator needs the1:key
Chapter to compute the hash, and Bob needs the key to verify Alice's
Authentication
response. Alice accesses the key K only indirectly—by entering her PIN into the key generator
43
 Two-factor Authentication
• Requires any 2 out of 3 of
– Something you know
– Something you have
– Something you are

• Examples
– ATM: Card and PIN
– Password generator: Device and PIN
– Email verification: Password and Device

Chapter 1: Authentication

44
 Single Sign-On (SSO)
• Multiple systems typically require multiple sign-on dialogues
• E.g. Desktop logon, email, library systems, external resources …
• Multiple sets of credentials (usernames/password)
• Presenting credentials multiple times

• The more security domains, the more sign-ons required, the

more users have to remember and maintain pwds, the more
admins have to handle pwds
 Why SSO?
With the number of websites and services rising, a centralized login
system has become a necessity
 Alice would like to authenticate only once
Chapter 1: Authentication

45
 Simple SSO operation

Authentication Domain Secondary domain

1. Access application
Applicatio
n/
Alice 2. Refer
resource
for
3. Ask for authn.
credentials SSO 4. Transfer to application
Application

Applicatio
n/
resource

Secondary domain

Chapter 1: Authentication 46
 Simple SSO operation
• Different SSO protocols share session information in
different ways, but the essential concept is the same:
– There is a central domain, through which authentication is
performed, and then
– The session is shared with other domains in some way.
• For instance,
– The central domain may generate a signed JSON Web Token
(which may be encrypted).
– This token (TGT) may then be passed to the client and used by
the authentication domain as well as any other domains.

Chapter 1: Authentication 47
 Different protocols
• There are many different implementations:
– Microsoft Account (formerly Passport, .NET, Live ID)
– Sign in with Apple
– Google Account SSO
– Facebook Connect
– etc.
• Nowadays, three standards are basically used
– Security Assertion Markup Language (SAML)
– OpenID Connect (OIDC)
– OAuth 2.0
Chapter 1: Authentication 48
 Single Sign-On (SSO)
• Security implications
– Credentials never leave the authentication domain (Identity provider,
IDP)
– Secondary domains (service providers) have to trust the authentication
domain
• Credentials must be asserted correctly
• Protected from unauthorised use
– Authentication transfer has to be protected against
• Replay attack
• Interception/masquerade attacks, ….etc.
• SSO system relies on other infrastructure
– Authentication system
– Interface with web server (HTTP/HTTPS)
– Identity management/registration
– E.g. Kerberos : a single sign-on protocol
Chapter 1: Authentication

49
 Web Cookies
• Numerical values that are stored and managed by a web browser.
• Cookie is provided by a Website and stored on user’s machine
• Cookie indexes and retains information about a user at Website
Database.
• Cookies maintain state across sessions
– Web uses a stateless protocol: HTTP
– Cookies also maintain state within a session

• Sort of a single sign-on for a website

– But, very, very weak form of authentication

• Cookies also create privacy concerns ???

Chapter 1: Authentication

50