authentication Flashcards
authentication
identifies a global or local identity
eg global id
passport number
e.g. local id
student number
authentication factors
what the user knows, is and has
allows you to prove your identity to a system
knowledge based authentication
have to share information with the authentication system
what are some examples of knowledge based authentication
passwords
pins
pass phrase
personal data
word association
what is an alternative to textual passwords
graphical passwords
graphical passwords
interacting with images
e.g. passmap or unlock patterns
can select images draw on an image or select parts of an image
advantages of knowledge based authentication
cheap
easily revoked
widely used and accepted by users
high security potential (long passwords harder to remember)
disadvantages of knowledge based authentication
user accountability
no privilege control once shared
not aware when leaked
password may be leaked to an untrustworthy host
eavesdropping and illicit capture
can be captured by a masquerade/phishing company
how are textual passwords cracked
determine which hash function has been used
decide which attempt to use (brute force/ dictionary attack)
acquire recourses (brute force requires a storage device)
in what context do we use brute force for textual password cracking
to attempts all possible combinations for a particular account
may take many years
in what context do we use dictionary attacks for textual password cracking
checks most likely passwords for many accounts
how do we crack graphical passwords
using brute force as there’s a limited password space
can use smudge attacks from the touch screen
what are the benefits of using one time passwords
not reused so phishing and eavesdropping isn’t possible
most require access to another device that only the user has
what are the 3 forms of possession based authentication (user has )
magnetic strip card
smart cards
one shot password token
smart card
secure storage of data
contents cant be modified or copied without authorisation
has processing and data storage capabilities due to the imbedded processor (computer chip)
magnetic strip card
contains identification information and a signature on the back
mostly used by banking systems
magnetic strip card positives
universally accepted
cheap to produce
magnetic strip card negatives
limited security and functionality as they’re easy to counterfit
what are the two methods of using one shot password tokens
synchronised password
challenge response system
synchronised password (tokens)
a synchronised password generator produces the same sequence of random passwords in a token and host
what is the process behind synchronised password tokens
the user needs to put the correct pin into the token to display the otp
the system clock is included in the algorithm to calculate the otp ensuring time sensitivity and uniqueness
the user can now input the otp to authenticate
failure if there’s a loss of synchronisation between the clocks
challenge response system (tokens)
one party presents a challenge and the other must provide a valid answer
