Authentication, Definition and Properties,Password schemes

The general setting for an identification protocol involves a prover (or claimant) A and a verifier B. Entity authentication is defined as the process of acquiring corroborative evidence that a second party is who they claim to be and has actually participated in the protocol, meaning they are active at or immediately prior to the time the evidence is acquired.

Properties of Identification Protocols

• Authentication can be unidirectional or mutual
• Efficiency - Identification must be quite efficient
• Security Guarantees - Some protocols offer zero-knowledge properties, which reveals partial information of secret during the exchange.
• Storage of secrets - Protocols vary based on where the secrets are stored

Techniques used in Fixed Password Schemes

This is a weak form of authentication where the prover reveals a secret memorised string for verification.

• Storing passwords in clear text (Bad choice)
• Encrypted Password files (vulnerable to dictionary attacks)
• Password Rules
• Slowing down password mapping by making the verification function computationally expensive (multiple iterations, where the output of one iteration is the input of the next iteration)
• Salting of password
• Passphrases - long stream of random words, which has more entropy than short complex passwords long-term key

One way Authentication

Password Authentication

• Plain Text Password
• Hashed Password
• Random Nonce that may or may not be encrypted with password (Freshness prevents replay attacks)

Certification Authentication

A → B (Certificate) B → A (Random Nonce) A → (Pvt.A(R))

A → B (Certificate) B → A (Pub.A(R)) A → B (Random nonce generated by B)

Mutual Authentication

Shared Secret based Authentication

A → B (Identity of A, Ra) B → A(Ek(Ra), Rb) A → B (Ek(Rb))

Reflection Attack

Asymmetric key based Authentication

A → B (“A”, Ra, A’s Certificate) B → A ([Ra, Rb]b, B’s Certificate) A → B ((Ra)b)

Flaw

Solution

Add recipient details as well and sign it

Centralised Authentication

In asymmetric key authentication, we need a trustable Public Key Infrastructure that includes a Certificate Authority to issue and Digital Signatures to verify → Computationally expensive

Symmetric systems are fast and efficient but suffer from a "Scalability Bottleneck."

• Key Management: For N people to communicate, you need N(N−1)/2 unique keys if everyone talks to everyone else directly. This becomes impossible as N grows.
• Secure Storage: Every party must securely store and manage every key they share with every other party. If one person's storage is compromised, all their shared connections are at risk.

We use Key Distribution Center to counter this problem. If Alice wants to communicate with Bob, it asks KDC who then verifies the user and sends Session Key to both Alice and Bob

Feature	Secret Key (KDC)	Public Key (PKI)
Speed	Fast (High throughput)	Slow (High latency)
Key Type	Shared Secret (Symmetric)	Public/Private Pair (Asymmetric)
Trust Model	Trusted Third Party (KDC)	Certificate Authority (CA)
Major Constraint	KDC is a single point of failure.	High cost of PKI and Certificates.
Authentication	Based on shared long-term secret.	Based on Digital Certificates.
#### Disadvantages

• Single point of failure
• KDC needs to trusted
• Susceptible to MITM, Replay attacks etc.