CSE4303 Introduction to Computer Security (Lecture 15)

Cryptography applications

Traditional authentication: password-based, single-factor
- Disadvantage: convenience often chosen over security
  - Weak passwords
  - Password re-use: one password compromised ==> many accounts compromised
- Attack: "credential stuffing" (testing single stolen password against many accounts)

Idea: relieve burden of secure passwords
- Use public/private-key auth instead (can be automated!)
- Use secure password once to exchange public key
Protocol: challenge/response to verify possession of keys

SSH can use public-key based authentication to authenticate users
Generate a pair of public and private keys: ssh-keygen -t rsa
private key: /home/seed/.ssh/id_rsa
public key: /home/seed/.ssh/id_rsa.pub
Register public key with server:
- Send the public key file to the remote server using a secure channel
- Add public key to the authorization file ~/.ssh/authorized_keys
Server can use key to authenticate clients

Goal: provide secure 2nd factor for authentication
Idea:
- Generate one-time (single-use) password for each login attempt
- Compute one-time password using secure HMAC with current time as a parameter
Key used for HMAC: exchanged once at setup
Protocol: open standard published by OATH, IETF
- HMAC-based One-Time Password (HOTP)
- e.g. TOTP(k) = HOTP(k, C_t), where C_t is absolute measure of current time interval
- Num digits taken from output: 6 to 10