Password

About: Password is a research topic. Over the lifetime, 35069 publications have been published within this topic receiving 389691 citations. The topic is also known as: pwd & p.

Generating Cancelable Fingerprint Templates

Abstract: Biometrics-based authentication systems offer obvious usability advantages over traditional password and token-based authentication schemes. However, biometrics raises several privacy concerns. A biometric is permanently associated with a user and cannot be changed. Hence, if a biometric identifier is compromised, it is lost forever and possibly for every application where the biometric is used. Moreover, if the same biometric is used in multiple applications, a user can potentially be tracked from one application to the next by cross-matching biometric databases. In this paper, we demonstrate several methods to generate multiple cancelable identifiers from fingerprint images to overcome these problems. In essence, a user can be given as many biometric identifiers as needed by issuing a new transformation "key". The identifiers can be cancelled and replaced when compromised. We empirically compare the performance of several algorithms such as Cartesian, polar, and surface folding transformations of the minutiae positions. It is demonstrated through multiple experiments that we can achieve revocability and prevent cross-matching of biometric databases. It is also shown that the transforms are noninvertible by demonstrating that it is computationally as hard to recover the original biometric identifier from a transformed version as by randomly guessing. Based on these empirical results and a theoretical analysis we conclude that feature-level cancelable biometric construction is practicable in large biometric deployments

Network Security: Private Communication in a Public World

Abstract: Acknowledgments. 1. Introduction. Roadmap to the Book. What Type of Book Is This? Terminology. Notation. Primer on Networking. Active vs. Passive Attackc. Layers and Cryptography. Authorization. Tempest. Key Escrow for Law Enforcement. Key Escrow for Careless Users. Viruses, Worms, Trojan Horses. The Multi-level Model of Security. Legal Issues. I. CRYPTOGRAPHY. 2. Introduction to Cryptography. What Is Cryptography? Breaking an Encryption Scheme. Types of Cryptographic Functions. Secret Key Cryptography. Public Key Cryptography. Hash Algorithms. Homework. 3. Secret Key Cryptography. Introduction. Generic Block Encryption. Data Encryption Standard (DES). International Data Encryption Algorithm (IDEA). Advanced Encryption Standard (AES). RC4. Homework. 4. Modes of Operation. Introduction. Encrypting a Large Message. Generating MACs. Multiple Encryption DES. CBC Outside vs. Inside. Homework. 5. Hashes and Message Digests. Introduction. Nifty Things to Do with a Hash. MD2. MD4. MD5. SHA-1. HMAC. Homework. 6. Public Key Algorithms. Introduction. Modular Arithmetic. RSA. Diffie-Hellman. Digital Signature Standard (DSS). How Secure Are RSA and Diffie-Hellman? Elliptic Curve Cryptography (ECC). Zero Knowledge Proof Systems. Homework Problems. 7. Number Theory. Introduction. Modular Arithmetic. Primes. Euclid's Algorithm. Chinese Remainder Theorem. Zn. Euler's Totient Function. Euler's Theorem. Homework Problems. 8. Math with AES and Elliptic Curves. Introduction. Notation. Groups. Fields. Mathematics of Rijndael. Elliptic Curve Cryptography. Homework. II. AUTHENTICATION. 9. Overview of Authentication Systems. Password-Based Authentication. Address-Based Authentication. Cryptographic Authentication Protocols. Who Is Being Authenticated? Passwords as Cryptographic Keys. Eavesdropping and Server Database Reading. Trusted Intermediaries. Session Key Establishment. Delegation. Homework. 10. Authentication of People. Passwords. On-Line Password Guessing. Off-Line Password Guessing. How Big Should a Secret Be? Eavesdropping. Passwords and Careless Users. Initial Password Distribution. Authentication Tokens. Physical Access. Biometrics. Homework. 11. Security Handshake Pitfalls. Login Only. Mutual Authentication. Integrity/Encryption for Data. Mediated Authentication (with KDC). Nonce Types. Picking Random Numbers. Performance Considerations. Authentication Protocol Checklist. Homework. 12. Strong Password Protocols. Introduction. Lamport's Hash. Strong Password Protocols. Strong Password Credentials. Strong Password Credentials Download Protocols. Homework. III. STANDARDS. 13. Kerberos V4. Introduction. Tickets and Ticket-Granting Tickets. Configuration. Logging Into the Network. Replicated KDC's. Realms. Interrealm Authentication. Key Version Numbers. Encryption for Privacy and Integrity. Encryption for Integrity Only. Network Layer Addresses in Tickets. Message Formats. Homework. 14. Kerberos V5. ASN.1. Names. Delegation of Rights. Ticket Lifetimes. Key Versions. Making Master Keys in Different Realms Different. Optimizations. Cryptographic Algorithms. Hierarchy of Realms. Evading Password-Guessing Attacks. Key Inside Authenticator. Double TGT Authentication. PKINIT-Public Keys for Users. KDC Database. Kerberos V5 Messages. Homework. 15. PKI (Public Key Infrastructure). Introduction. Some Terminology. PKI Trust Models. Revocation. Directories and PKI. PKIX and X.509. X.509 and PKIX Certificates. Authorization Futures. Homework. 16. Real-time Communication Security. What Layer? Session Key Establishment. Perfect Forward Secrecy. PFS-Foilage. Denial-of-Service/Clogging Protection. Endpoint Identifier Hiding. Live Partner Reassurance. Arranging for Parallel Computation. Session Resumption. Plausible Deniability. Data Stream Protection. Negotiating Crypto Parameters. Easy Homework. Homework. 17. IPsec: AH and ESP. Overview of Ipsec. IP and Ipv6. AH (Authentication Header). ESP (Encapsulating Security Payload). So, Do We Need AH? Comparison of Encodings. Easy Homework. Homework. 18. IPsec: IKE. Photuris. SKIP. History of IKE. IKE Phases. Phase 1 IKE. Phase - 2 IKE: Setting up Ipsec Sas. ISAKMP/IKE Encoding. Homework. 19. SSL/TLS. Introduction. Using TCP. Quick TCP. Quick History. SSL/TLS Basic Protocol. Session Resumption. Computing the Keys. Client Authentication. PKI as Deployed by SSL. Version Numbers. Negotiating Cipher Suites. Negotiating Compression Method. Attacks Fixed in v3. Exportability. Encoding. Further Reading. Easy Homework. Homework. IV. ELECTRONIC MAIL. 20. Electronic Mail Security. Distribution Lists. Store and Forward. Security Services for Electronic Mail. Establishing Keys. Privacy. Authentication of the Source. Message Integrity. Non-Repudiation. Proof of Submission. Proof of Delivery. Message Flow Confidentiality. Anonymity. Containment. Annoying Text Format Issues. Names and Addresses. Verifying When a Message Was Really Sent. Homework. 21. PEM & S/MIME. Introduction. Structure of a PEM Message. Establishing Keys. Some PEM History. PEM Certificate Hierarchy. Certificate Revocation Lists (CRLs). Reformatting Data to Get Through Mailers. General Structure of a PEM Message. Encryption. Source Authentication and Integrity Protection. Multiple Recipients. Bracketing PEM Messages. Forwarding and Enclosures. Unprotected Information. Message Formats. DES-CBC as MIC Doesn't Work. Differences in S/MIME. S/MIME Certificate Hierarchy. Homework. 22. PGP (Pretty Good Privacy). Introduction. Overview. Key Distribution. Efficient Encoding. Certificate and Key Revocation. Signature Types. Your Private Key. Key Rings. Anomalies. Object Formats. V. LEFTOVERS. 23. Firewalls. Packet Filters. Application Level Gateway. Encrypted Tunnels. Comparisons. Why Firewalls Don't Work. Denial-of-Service Attacks. Should Firewalls Go Away? 24. More Security Systems. NetWare V3. NetWare V4. KryptoKnight. DASS/SPX. Lotus Notes Security. DCE Security. Microsoft Windows Security. Network Denial of Service. Clipper. Homework. 25. Web Issues. Introduction. URLs/URIs. HTTP. HTTP Digest Authentication. Cookies. Other Web Security Problems. Homework. 26. Folklore. Perfect Forward Secrecy. Change Keys Periodically. Multiplexing Flows over a Single SA. Use Different Keys in the Two Directions. Use Different Secret Keys for Encryption vs. Integrity Protection. Use Different Keys for Different Purposes. Use Different Keys for Signing vs. Encryption. Have Both Sides Contribute to the Master Key. Don't Let One Side Determine the Key. Hash in a Constant When Hashing a Password. HMAC Rather than Simple MD. Key Expansion. Randomly Chosen Ivs. Use of Nonces in Protocols. Don't Let Encrypted Data Begin with a Constant. Don't Let Encrypted Data Begin with a Predictable Value. Compress Data Before Encrypting It. Don't Do Encryption Only. Avoiding Weak Keys. Minimal vs. Redundant Designs. Overestimate the Size of Key. Hardware Random Number Generators. Timing Attacks. Put Checksums at the End of Data. Forward Compatibility. Negotiating Parameters. Homework. Bibliography. Glossary. Index.

Déjà Vu: a user study using images for authentication

Abstract: Current secure systems suffer because they neglect the importance of human factors in security. We address a fundamental weakness of knowledge-based authentication schemes, which is the human limitation to remember secure passwords. Our approach to improve the security of these systems relies on recognition-based, rather than recall-based authentication. We examine the requirements of a recognition-based authentication system and propose Deja Vu, which authenticates a user through her ability to recognize previously seen images. Deja Vu is more reliable and easier to use than traditional recall-based schemes, which require the user to precisely recall passwords or PINs. Furthermore, it has the advantage that it prevents users from choosing weak passwords and makes it difficult to write down or share passwords with others. We develop a prototype of Deja Vu and conduct a user study that compares it to traditional password and PIN authentication. Our user study shows that 90% of all participants succeeded in the authentication tests using Deja Vu while only about 70% succeeded using passwords and PINS. Our findings indicate that Deja Vu has potential applications, especially where text input is hard (e.g., PDAs or ATMs), or in situations where passwords are infrequently used (e.g., web site passwords).

The design and analysis of graphical passwords

Abstract: In this paper we propose and evaluate new graphical password schemes that exploit features of graphical input displays to achieve better security than text-based passwords. Graphical input devices enable the user to decouple the position of inputs from the temporal order in which those inputs occur, and we show that this decoupling can be used to generate password schemes with substantially larger (memorable) password spaces. In order to evaluate the security of one of our schemes, we devise a novel way to capture a subset of the "memorable" passwords that, we believe, is itself a contribution. In this work we are primarily motivated by devices such as personal digital assistants (PDAs) that offer graphical input capabilities via a stylus, and we describe our prototype implementation of one of our password schemes on such a PDA, namely the Palm PilotTM.

A new remote user authentication scheme using smart cards

Abstract: We propose a new remote user authentication scheme using smart cards. The scheme is based on the ElGamal's (1985) public key cryptosystem. Our scheme does not require a system to maintain a password table for verifying the legitimacy of the login users. In addition, our scheme can withstand message replaying attack.