DOCSLIB.ORG

An Authentication Protocol Based on Kerberos 5

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
An Authentication Protocol Based on Kerberos 5 International Journal of Network Security, Vol.12, No.3, PP.159{170, May 2011 159 An Authentication Protocol Based on Kerberos 5 Eman El-Emam 1, Magdy Koutb 2, Hamdy Kelash 3, and Osama S. Faragallah 3 (Corresponding author: Osama S. Faragallah) Egyptian Space Program, National Authority for Remote Sensing and Space Sciences 1 El-Nozha El-Gedeeda, Cairo, Egypt Department of Industrial Electronics & Control, Faculty of Electronic Engineering, Menouf, Egypt 2 Department of Computer Science & Engineering, Faculty of Electronic Engineering, Menouf, Egypt 3 (Email: fademahmo, [email protected]) (Received Aug. 6, 2009; revised and accepted Feb. 12, 2010) Abstract rights can be assigned to individuals. Authentication is a service related to identi¯cation. It is a fundamental We introduce some modi¯cations to the widely deployed building block for a secure networked environment. If a Kerberos authentication protocol. The principle's secret- server knows the identity of a client, it can decide whether key will be independent of the user password to overcome to provide the service, whether the user should be given the weak passwords chosen by the network principal that special privileges, and so forth. In other words, autho- are susceptible to password guessing attacks, the main rization and accounting schemes can be built on top of drawback of the Kerberos protocol. Instead, the Kerberos authentication resulting in the required security to the Distribution Center saves a pro¯le for every instance in computer network system. its realm to generate the principle's secret-key by hashing Protocols play a major role in cryptography and are es- the pro¯le, and encrypting the output digest. Besides, sential in meeting cryptographic goals. We need protocols the lifetime of the secret-key is controlled using the sys- to apply cryptographic algorithms and techniques among tem clock. Triple-Des is used for encryption, SHA-256 for the communicating parties. Encryption schemes, hash hashing, and Blum Blum Shub for random number gen- functions, and random number generation are among the eration. primitives which may be utilized to build a protocol. A Keywords: Access control, authentication protocols, au- cryptographic protocol is a distributed algorithm de¯ned thorization, computer network security, Kerberos by a sequence of steps precisely specifying the actions re- quired of two or more entities to achieve a speci¯c secu- rity objective. The whole point of using cryptography in 1 Introduction a protocol is to detect or prevent attacks. We will begin with describing the motivation for the An elaborate set of protocols and mechanisms have been Kerberos approach and its environment in Section 2. created to deal with information security issues. The tech- Then, we will present a brief overview of the related work nical means to achieve information security in an elec- in Section 3. After that, we will outline the Kerberos tronic society are provided through cryptography. The messages exchange and we will analyze the publicly re- cryptography is the study of mathematical techniques leased versions of Kerberos Version 4 and Version 5 in related to aspects of information security such as con¯- Section 4. While in Section 5, we will discuss the Ker- dentiality, data integrity, access control, and authentica- beros drawbacks. Then, in Section 6, we will examine the tion. Con¯dentiality is a service used to keep the contents details used in our proposed implementation, address its of information from all but those authorized to have it. associated database, comparing it with the previous ver- There are numerous approaches to provide con¯dentiality, sions, list its security properties and describe our testing e.g. the mathematical algorithms which render data un- environment and our testing results. Finally, we will sum- intelligible. Data integrity is a service that addresses the marize our conclusions and our future work in Section 7. unauthorized alteration of data. To assure data integrity, one must have the ability to detect data manipulation by unauthorized parties. Data manipulation includes in- 2 Motivation sertion, deletion, and substitution. Access control is the ability to limit the access to authorized users and appli- Today, more common in computer network architec- cations. To achieve this, each entity trying to gain access ture is a distributed architecture consisting of dedicated must ¯rst be identi¯ed, or authenticated, so that access user workstations (clients) and distributed or centralized International Journal of Network Security, Vol.12, No.3, PP.159{170, May 2011 160 servers. In this environment, network connections to 3.2 Kerberos Security other machines are supported. Thus, we need to pro- tect user information and resources housed at the server. Security of Kerberos has been analyzed in many works, The authentication service in these environments can be e.g. [1, 2, 3, 10, 21, 23] and [24]. Most commonly analyzes achieved by using Kerberos. It is one of the most widely identify certain limitations of Kerberos and sometimes used authentication protocols. It addresses an open dis- propose ¯xes. This leads to the evolution of the proto- tributed environment in which users at workstations wish col when a new version patches the known vulnerabilities to access services on servers distributed throughout the of the previous versions. The current version Kerberos V5 network. is already being revised and extended [14, 18], and [17]. Butler, Cervesato, Jaggard, and Scedrov have analyzed Kerberos employs one or more Kerberos servers (KDC: portions of the current version of Kerberos and have for- Kerberos Distribution Center) to provide an authentica- mally veri¯ed that the design of Kerberos' current version tion service. The overall scheme of Kerberos is that of meets the desired goals for the most parts [6]. Boldyreva a trusted third party that uses a protocol based on that and Kumar at 2007 take a close look at Kerberos' encryp- proposed by Needham and Schroeder [12]. It is trusted tion and con¯rm that most of the options in the current in the sense that clients and servers trust Kerberos to version provably provide privacy and authenticity [4]. mediate their mutual authentication. Kerberos relies exclusively on symmetric encryption, making no use of public-key encryption. Most of the se- 3.3 Kerberos Applications cure routing protocols rely on public key infrastructures Kerberos is also used in wireless applications. Erdem pro- (PKI) to authenticate communicating nodes. Although posed a high speed 2G wireless authentication systems PKI is secure, it is based on asymmetric cryptography based on Kerberos [7]. He used DES, 3DES and AES as and hence requires excessive processing and communica- secret-key crypto algorithms. He also used SHA-1 mes- tion resources [8]. This resource hungry feature makes sage digest algorithm to hash the message blocks. Besides, PKI based systems more susceptible to Denial of Service Pirzada and McDonald discuss how Kerberos is used for attacks. In contra authentication in mobile ad-hoc networks [16]. Kerberos is also introduced to be used in IPv6 net- works. Sakane, Okabey, Kamadaz, and Esakix describe 3 Related Work a method to establish secure communication using Ker- beros in IPv6 networks [19]. They propose a mechanism 3.1 Kerberos History to achieve access control using Kerberos and to deal with address resolution using Kerberos with modi¯cation. Massachusetts Institute of Technology (MIT) developed Nitin et al. present an image based authentication sys- Kerberos to protect network services provided by Project tem using Kerberos protocol at 2008 [15]. That paper is Athena. Several versions of the protocol exist; versions a comprehensive study on the subject of using images as 1-3 occurred only internally at MIT. Many members of a password and the implementation of Jaypee University Project Athena contributed to the design and implemen- of Information Technology (JUIT) Image Based Authen- tation of Kerberos [13]. In [5] there is a dialogue that tication (IBA) system called as JUIT-IBA using Kerberos was written in 1988 to help its readers understand the protocol. fundamental reasons for why the Kerberos V4 protocol Kerberos has grown to become the most widely was the way it was. It was amazing how much this di- deployed system for authentication and authorization alogue was still applicable for the Kerberos V5 protocol. in modern computer networks. Kerberos is currently Although many things were changed, the basic core ideas shipped with all major computer operating systems and of the protocol have remained the same. Miller and Neu- is uniquely positioned to become a universal solution to man are the primary designers of Kerberos Version 4 with the distributed authentication and authorization problem contributions from Saltzer and Schiller [22]. They pub- of communicating parties [9]. lished that version in the late 1980s, although they had targeted it primarily for Project Athena. Version 5, de- signed by Kohl and Neuman, appeared as RFC 1510 in 4 Kerberos Overview 1993 [11] (made obsolete by RFC 4120 in 2005 [14]), with the intention of overcoming the limitations and security 4.1 Kerberos Authentication Dialogue problems of version 4. In 2007, MIT formed the Kerberos Consortium along The Kerberos protocol allows a client to repeatedly be with some of the major vendors and users of Kerberos authenticated to multiple servers assuming that there is such as Sun Microsystems, Apple, Google, Microsoft, etc., a long-term secret key shared between the client and to foster continued development. The MIT Kerberos Con- Kerberos infrastructure. The client long-term secret key sortium was created to establish Kerberos as the univer- was generated using the client's password ([20] describes sal authentication platform for the world's computer net- the password to key transformation technique that is works. presented by the standard speci¯cation). A simpli¯ed International Journal of Network Security, Vol.12, No.3, PP.159{170, May 2011 161 overview of the Kerberos actions is shown in Figure 1.
Load more

Recommended publications
  • Extensible Authentication Protocol (EAP) and IEEE 802.1X: Tutorial and Empirical Experience
    CHEN LAYOUT 11/17/05 11:57 AM Page 52 Extensible Authentication Protocol (EAP) and IEEE 802.1x: Tutorial and Empirical Experience JYH-CHENG CHEN AND YU-PING WANG, NATIONAL TSING HUA UNIVERSITY Abstract oped WIRE1x to support various versions of MS Windows. As This article presents the technical details of the Extensible the name suggests, WIRE1x is an open-source implementa- Authentication Protocol (EAP) and IEEE 802.1x by using tion of IEEE 802.1x client (supplicant)1 developed by the WIRE1x, an open-source implementation of IEEE 802.1x Wireless Internet Research & Engineering (WIRE) Laborato- client (supplicant) and various EAP-based authentication ry.2 Both source code and executable code of WIRE1x can be mechanisms. By using a real implementation, 802.1x and EAP downloaded freely from http://wire.cs.nthu.edu.tw/wire1x/. should be easily understood. Essentially, 802.1x provides a framework for port-based access control. It can work with various authentication mecha- nisms to authenticate and authorize users. The Extensible Introduction Authentication Protocol (EAP, IETF RFC 2284) is a protocol Wireless local area networks (WLANs) have become increas- commonly used in 802.1x to authenticate users. Currently, ingly more prevalent in recent years. The IEEE 802.11 stan- WIRE1x provides various authentication mechanisms, includ- dard is one of the most widely adopted standards for ing EAP Message Digest 5 (EAP-MD5, IETF RFC 1321), broadband wireless Internet access. However, security consid- EAP Transport Layer Security (EAP-TLS, IETF RFC 2716), erations with regard to wireless environments are more com- EAP Tunneled TLS (EAP-TTLS) [5], and Protected Extensi- plicated than those in wired environments.
    [Show full text]
  • Kerberos: an Authentication Service for Computer Networks by Clifford Neuman and Theodore Ts’O
    Kerberos: An Authentication Service for Computer Networks by Clifford Neuman and Theodore Ts’o Presented by: Smitha Sundareswaran Chi Tsong Su Introduction z Kerberos: An authentication protocol based on cryptography z Designed at MIT under project Athena z Variation of Needham Schroeder protocol - Difference: Kerberos assumes all systems on the network to be synchronized z Similar function as its mythological namesake: “guards” the access to network protocols Contribution z Defines ideas of authentication, Integrity, confidentiality and Authorization z Working of Kerberos z Limitations z Utilities z How to obtain and use Kerberos z Other methods to improve security Why Kerberos? z Foils threats due to eavesdropping z More convenient than password based authentication { Allows user to avoid “authentication by assertion” z Authentication based on cryptography: attacker can’t impersonate a valid user How Kerberos Works z Distributed authentication service using a series of encrypted messages {Password doesn’t pass through the network z Timestamps to reduce the number of messages needed for authentication z “Ticket granting Service” for subsequent authentication Kerberos Authentication and Encryption zAuthentication proves that a client is running on behalf of a particular user zUses encryption key for authentication {Encryption key = Password zEncryption implemented using DES {Checksum included in message checksum and encryption provide integrity & confidentiality The Kerberos Ticket z Initially, client and Server don’t share an encryption
    [Show full text]
  • PUF Based Authentication Protocol for Iot
    S S symmetry Article PUF Based Authentication Protocol for IoT An Braeken Vrije Universiteit Brussel, Pleinlaan 2, 1050 Brussel, Belgium; [email protected]; Tel.: +32-468-104-767 Received: 11 July 2018; Accepted: 11 August 2018; Published: 20 August 2018 Abstract: Key agreement between two constrained Internet of Things (IoT) devices that have not met each other is an essential feature to provide in order to establish trust among its users. Physical Unclonable Functions (PUFs) on a device represent a low cost primitive exploiting the unique random patterns in the device and have been already applied in a multitude of applications for secure key generation and key agreement in order to avoid an attacker to take over the identity of a tampered device, whose key material has been extracted. This paper shows that the key agreement scheme of a recently proposed PUF based protocol, presented by Chatterjee et al., for Internet of Things (IoT) is vulnerable for man-in-the-middle, impersonation, and replay attacks in the Yao–Dolev security model. We propose an alternative scheme, which is able to solve these issues and can provide in addition a more efficient key agreement and subsequently a communication phase between two IoT devices connected to the same authentication server. The scheme also offers identity based authentication and repudiation, when only using elliptic curve multiplications and additions, instead of the compute intensive pairing operations. Keywords: physical unclonable function; authentication; elliptic curve cryptography; internet of things 1. Introduction Internet of Things (IoT) is experiencing worldwide growth. Not only classical computing and communication devices are connected, but also a whole range of other gadgets that are used in our daily life, such as thermostats, light switches, door locks, refrigerators, etc.
    [Show full text]
  • Recommendation for EAP Methods
    Archived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated below). Archived Publication Series/Number: NIST Special Publication 800-120 Title: Recommendation for EAP Methods Used in Wireless Network Access Authentication Publication Date(s): September 2009 Withdrawal Date: October 19, 2018 Withdrawal Note: This publication is out of date. Refer to relevant standards from the Internet Engineering Task Force (IETF), http://www.ietf.org/ . Superseding Publication(s) The attached publication has been superseded by the following publication(s): Series/Number: Title: Author(s): Publication Date(s): URL/DOI: Additional Information (if applicable) Contact: Computer Security Division (Information Technology Laboratory) Latest revision of the attached publication: Related information: https://csrc.nist.gov https://csrc.nist.gov/publications/detail/sp/800-120/archive/2009-09-17 Withdrawal N/A announcement (link): Date updated: October 19, 2018 NIST Special Publication 800-120 Recommendation for EAP Methods Used in Wireless Network Access Authentication Katrin Hoeper and Lily Chen Computer Security Division Information Technology Laboratory C O M P U T E R S E C U R I T Y September 2009 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick Gallagher, Deputy Director Abstract This Recommendation specifies security requirements for authentication methods with key establishment supported by the Extensible Authentication Protocol (EAP) defined in IETF RFC 3748 for wireless access authentications to federal networks. KEY WORDS: EAP methods, authentication, key establishment. SP 800-120: Recommendation for EAP Methods Used in Wireless Network Access Authentication Acknowledgments The authors, Katrin Hoeper and Lily Chen, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content.
    [Show full text]
  • Diameter-Based Protocol in the IP Multimedia Subsystem
    International Journal of Soft Computing and Engineering (IJSCE) ISSN: 2231 – 2307, Volume- 1 Issue- 6, January 2012 Diameter-Based Protocol in the IP Multimedia Subsystem Vinay Kumar.S.B, Manjula N Harihar Abstract— The Diameter protocol was initially developed by II. ROLE OF DIAMETER IN IMS the Internet Engineering Task Force (IETF) as an Authentication, Authorization, and Accounting (AAA) framework The IMS is based on a horizontally layered architecture, intended for applications such as remote network access and IP consisting of three layers, namely, Service Layer, Control mobility. Diameter was further embraced by the Third Generation Layer, and Connectivity Layer. Service Layer comprises Partnership Project (3GPP) as the key protocol for AAA and application and content servers to execute value-added mobility management in 3G networks. The paper discusses the use services for the user. Control layer comprises network control of Diameter in the scope of the IP Multimedia Subsystem (IMS) as servers for managing call or session set-up, modification and specified by 3GPP. This paper presents a solution for the problem release. The most important of these is the Call Session of how to provide authentication, authorization and accounting Control Function (CSCF). Connectivity Layer comprises of (AAA) for multi-domain interacting services by referring open routers and switches, for both the backbone and the access diameter. We have studied the case of ‘FoneFreez’, a service that provides interaction between different basic services, like network telephony and television. The involvement of several parties like A. IMS functions television provider, telephony provider etc., secure interaction between multiple domains must be assured.
    [Show full text]
  • Formal Analysis of Combinations of Secure Protocols Elliott Blot, Jannik Dreier, Pascal Lafourcade
    Formal Analysis of Combinations of Secure Protocols Elliott Blot, Jannik Dreier, Pascal Lafourcade To cite this version: Elliott Blot, Jannik Dreier, Pascal Lafourcade. Formal Analysis of Combinations of Secure Protocols. FPS 2017 - 10th International Symposium on Foundations & Practice of Security, Oct 2017, Nancy, France. pp.53-67, 10.1007/978-3-319-75650-9_4. hal-01596010v2 HAL Id: hal-01596010 https://hal.archives-ouvertes.fr/hal-01596010v2 Submitted on 11 Nov 2017 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Formal Analysis of Combinations of Secure Protocols? Elliott Blot1, Jannik Dreier2, and Pascal Lafourcade1 1 LIMOS, University Clermont Auvergne, France [email protected] 2 LORIA, Universit´ede Lorraine, INRIA, CNRS, France [email protected] 3 LIMOS, University Clermont Auvergne, France [email protected] Abstract. When trying to prove the security of a protocol, one usually analyzes the protocol in isolation, i.e., in a network with no other proto- cols. But in reality, there will be many protocols operating on the same network, maybe even sharing data including keys, and an intruder may use messages of one protocol to break another. We call that a multi- protocol attack.
    [Show full text]
  • Salted Challenge Response Authentication Mechanism (SCRAM) SASL Authentication Mechanism
    Salted Challenge Response Authentication Mechanism (SCRAM) SASL authentication mechanism draft-newman-auth-scram-10.txt draft-newman-auth-scram-gs2-01.txt Abhijit Menon-Sen <[email protected]> Chris Newman <[email protected]> Alexey Melnikov <[email protected]> Simon Josefsson <[email protected]> IETF 74, Sa n Francisco SASL Framework • Specified in RFC 4422 • Used by application layer protocols – IMAP – RFC 3501 – POP3 – RFC 5034 – LDAP – RFC 4510 – SMTP – RFC 4954 – ManageSieve – RFC-ietf-sieve-managesieve-09.txt – XMPP – RFC 3920 – BEEP – RFC 3080 – And few others • Not used by HTTP Existing password based SASL mechanisms (1 of 3) • PLAIN – Doesn't support server authentication – And sends username/password in the cleartext, so it relies on encryption provided by lower- level security services (e.g., TLS) – Can be used with most authentication databases – Allows “bad” servers to reuse the password in order to break into other user's accounts Existing password based SASL mechanisms (2 of 3) • CRAM-MD5 – Doesn't send password in cleartext – But doesn't support server authentication – Doesn't support some modern SASL features like • Internationalization • Acting on behalf of other users • Channel bindings – So it is simple to implement, but not considered secure anymore (e.g. it allows connection hijacking) Existing password based SASL mechanisms (3 of 3) • DIGEST-MD5 – Doesn't send password in cleartext – Supports server authentication – Was designed to be compatible with HTTP-Digest but in practice this compatibility is limited
    [Show full text]
  • A Blockchain-Based Authentication Protocol for Cooperative Vehicular Ad Hoc Network
    sensors Article A Blockchain-Based Authentication Protocol for Cooperative Vehicular Ad Hoc Network A. F. M. Suaib Akhter 1 , Mohiuddin Ahmed 2 , A. F. M. Shahen Shah 3 , Adnan Anwar 4 , A. S. M. Kayes 5,* and Ahmet Zengin 1 1 Department of Computer Engineering, Sakarya University, Serdivan 54050, Sakarya, Turkey; [email protected] (A.F.M.S.A.); [email protected] (A.Z.) 2 School of Science, Edith Cowan University, Perth, WA 6027, Australia; [email protected] 3 Department of Electrical and Electronics Engineering, Istanbul Gelisim University, Avcilar 34315, Istanbul, Turkey; [email protected] 4 Centre for Cyber Security Research and Innovation (CSRI), School of IT, Deakin University, Waurn Ponds, VIC 3216, Australia; [email protected] 5 Department of Computer Science and Information Technology, School of Engineering and Mathematical Sciences (SEMS), La Trobe University, Bundoora, VIC 3086, Australia * Correspondence: [email protected] Abstract: The efficiency of cooperative communication protocols to increase the reliability and range of transmission for Vehicular Ad hoc Network (VANET) is proven, but identity verification and communication security are required to be ensured. Though it is difficult to maintain strong network connections between vehicles because of there high mobility, with the help of cooperative communication, it is possible to increase the communication efficiency, minimise delay, packet loss, and Packet Dropping Rate (PDR). However, cooperating with unknown or unauthorized vehicles could result in information theft, privacy leakage, vulnerable to different security attacks, etc. In this paper, a blockchain based secure and privacy preserving authentication protocol is proposed for the Citation: Akhter, A.F.M.S.; Internet of Vehicles (IoV).
    [Show full text]
  • Diameter Extensible Authentication Protocol Eap Application
    Diameter Extensible Authentication Protocol Eap Application Gershon often effaces florally when raftered Vassili waxing pretendedly and alligating her milages. Giff butstill Matthewreinspiring sourly punishingly ice her whiledaikons. one Tyler towelled that crunch. Saleable and psilotic Benji diamond, Allen institute for accounting aspect of grouped and derive this recommendation for future mobile communication has good deal effectively performed a success as inner method. Souheil Ben Ayed, the EAP peer and server are the parties involved in the EAP method conversation, encryption for doctor to end security is needed. A Multi-authentication Architecture Based on DIAMETER XIE. Both users should record that it is part of authorization to verify that caused a value is derived from eap server implementations conforming to reside, thisparameter is sometimas physically protected. The extensible authentication algorithm is not be omitted in terms of mechanisms for example, in traffic is robust against negotiation attacks on a hss. After a diameter protocol eap authentication application on ppp. It may authentication with diameter extensible authentication protocol eap application? Api assumes ordering guarantees provided ciphersuite meet all diameter extensible authentication protocol eap application layer error condition and not that holds keying material. This diameter extensible authentication protocol eap application specifies diameter maintanence and peer. The extensible authentication has already pending. Annex a dual stack of the absence of other authentication phase, the extensible authentication and accounting stop message, its respective password that. Api channel binding data are not be easy to. Library of operation efficiently by using this an eap mtu from unauthorized authenticator and authentication fails using diameter extensible authentication protocol eap application.
    [Show full text]
  • Understanding and Configuring PPP CHAP Authentication
    Document ID: 25647 Updated: Oct 21, 2015 Download PDF Print Feedback Related Products ● Point-to-Point Protocol (PPP) Contents Introduction Prerequisites Requirements Components Used Conventions Configure CHAP One-Way and Two-Way Authentication CHAP Configuration Commands and Options Transactional Example Call Challenge Response Verify CHAP Result Troubleshoot CHAP Related Information Related Cisco Support Community Discussions Introduction The Challenge Handshake Authentication Protocol (CHAP) (defined in RFC 1994 ) verifies the identity of the peer by means of a three-way handshake. These are the general steps performed in CHAP: 1. After the LCP (Link Control Protocol) phase is complete, and CHAP is negotiated between both devices, the authenticator sends a challenge message to the peer. 2. The peer responds with a value calculated through a one-way hash function (Message Digest 5 (MD5)). 3. The authenticator checks the response against its own calculation of the expected hash value. If the values match, the authentication is successful. Otherwise, the connection is terminated. This authentication method depends on a "secret" known only to the authenticator and the peer. The secret is not sent over the link. Although the authentication is only one-way, you can negotiate CHAP in both directions, with the help of the same secret set for mutual authentication. For more information on the advantages and disadvantages of CHAP, refer to RFC 1994 . Prerequisites Requirements Readers of this document should have knowledge of these topics: ● How to enable PPP on the interface through the encapsulation ppp command. ● The debug ppp negotiation command output. Refer to Understanding debug ppp negotiation Output for more information.
    [Show full text]
  • B-CRAM: a Byzantine-Fault-Tolerant Challenge-Response
    1 B-CRAM: A Byzantine-Fault-Tolerant Challenge-Response Authentication Mechanism Akshay Agrawal, Robert Gasparyan, Jongho Shin [email protected], [email protected], [email protected] Abstract—B-CRAM is an authentication protocol that the TTP is a single point of failure – if it were to fail, all enables applications to consult a distributed trusted third- authentication would come to a halt. We can alleviate this party (TTP) in order to validate end-user identities. shortcoming by distributing the KDC and maintaining Short for Byzantine-Fault-Tolerant Challenge-Response its state with a replication algorithm; indeed WebAuth, Authentication Mechanism, B-CRAM’s novelty lies in its Stanford’s own authentication system, does just that [16]. resilience to node failures, malicious or otherwise. The TTP layer, which stores end-user credentials, implements While replication increases redundancy, it does little the BFT2F replication algorithm. In particular, given a to guard against byzantine failures. In the context of TTP distributed 3f + 1 ways, our system guarantees both authentication, fault-tolerance to malicious attacks on safety and liveness when no more than f nodes fail; the TTPs is particularly important – a compromised moreover, we bound the space of possible attacks when no system could falsely authenticate imposters. None of the more than 2f nodes fail. B-CRAM prevents adversaries WebAuth, OpenID, or OAuth protocols require that their from obtaining sensitive end-user information, no matter TTPs survive byzantine faults [16], [8], [6]. Even if the how many TTPs they compromise: Unlike many other protocols did replicate their data using PBFT [2], security authentication protocols, B-CRAM ensures that TTPs do vulnerabilities would remain.
    [Show full text]
  • GSS-REST, a Proposed Method for HTTP Application-Layer Authentication
    GSS-REST, a Proposed Method for HTTP Application-Layer Authentication [email protected] April 27, 2011 Abstract Applications often require context-specic authentication decisions, particularly HTTP applications. TLS provides limited authentication facilities, and only at the transport-layer, which is often inconvenient. GSS-REST is a method that obtains pluggable application-layer authen- tication for HTTP-based applications, using o-the-shelf authentication mechanisms and without replacing TLS for transport protection. Addi- tionally, GSS-REST provides a method by which to get away from cookies. GSS-REST, as its name indicates, consists of POSTing GSS-API se- curity context tokens to a resource in order to authenticate the client user and the service and to exchange cryptographic key material, the lat- ter needed only optionally to strengthen cookies. Additionally, we discus some aspects of identity selection UI issues. Contents 1 Introduction 2 1.1 GSS-API Primer . 3 1.2 Channel Binding Primer . 4 2 GSS-REST 5 2.1 JavaScript Bindings for GSS-REST . 6 2.1.1 Accessing channel binding data from scripts . 6 2.1.2 JavaScript bindings for the GSS-API . 6 2.1.3 User interface (UI) considerations and identity selection . 6 2.1.4 Possible local policies for identity selection . 7 2.2 Non-Broswer HTTP Applications . 7 2.3 Server-Side Implementation of GSS-REST . 8 3 Security Benets of GSS-REST 8 4 Security Considerations 8 1 1 Introduction Today's HTTP[RFC2616] applications suer from very limited choices for user authentication. The available user authentication methods are: • TLS[RFC5246] renegotiation with user certicates.
    [Show full text]