Upload
chiara
View
83
Download
1
Tags:
Embed Size (px)
DESCRIPTION
Kerberos Authentication. Alternative to one time passwords. Need for an authentication scheme which never sends the passwords in clear text form over the network. - PowerPoint PPT Presentation
Citation preview
1
Kerberos Authentication
2
Alternative to one time passwords
Need for an authentication scheme which never sends the passwords in clear text form over the network.
One time password is an example where the actual password is not sent along the communication line, rather a derivative is sent on to the server.
Authentication methods based on cryptography are required.
Also there is a need to authenticate for services without entering password every time. E.g. r-commands on Unix.
3
One-time passwords
As the name implies a password is used only once. Typically password is generated by applying repeatedly MD5 algorithm on a secret password.
Let p the password and f is the one-way MD5 function. Initially let n=9, then the first time password transmitted for verification will be f9(p) and next time it will be f 8(p) and so on.
4
Kerberos Authentication
Alternative to one-time passwords Allow workstations to authenticate
themselves to services running on servers without ever sending a password in clear text over the network.
5
Kerberos Authentication
Kerberos is a distributed authentication service that allows a process (a client) running on behalf of a principal (a user) to prove its identity to a verifier (an application server or server) without sending data across the network.
Developed as part of MIT’s Project Athena.
6
The Word of “Kerberos”
Also spelled as Cerberus. n. The watch dog of Hades (in the ancient Greece), whose duty was to guard the entrance -- against whom or what does not clearly appear; ...it is known to have three heads. ...
--- The Enlarged Devil’s Dictionary, by Ambrose Bierce
7
How Kerberos works?
Kerberos authentication scheme uses a series of encrypted messages to a verifier (server) that a client is running on behalf of a particular user.
More precisely that the client has knowledge of an encryption key that is known by the user and the authentication server.
The users encryption key is derived and should be thought of as a password; similarly, each application server shares an encryption key with the authentication server- call this key as the sever key.
8
How Kerberos works?
The client (C)and server (V) do not initially share an encryption key.
Whenever the client authenticates itself to a new verifier it relies on the authentication server (AS) to generate a new encryption key and distribute it securely to both parties.
This new encryption key is called session key and a ticket mechanism is used to distribute this key to the verifier.
9
Kerberos Ticket? Ticket is a certificate issued by the authentication
server, encrypted using server key. Ticket contains a random session key, which will
be used to for the authentication of the principal to the verifier, the name of the principal to whom the session key was issued, and an expiration time after which the session key is no longer valid (time stamp).
The ticket is not sent directly to the verifier, but is instead sent to the client who forwards it to the verifier as part of the application request.
Since the ticket is encrypted in the server key, known only by the authentication server and the indented verifier, it is not possible for the client to modify the ticket without detection.
10
Basic Kerberos (simplified)
symbols used:c: client/client namev: server/server nameAS: authentication servicen: nonceKc,v: shared key btwn c & vtimeexp: expiring timeKc: shared key btwn c & ASKv: shared key btwn v & ASKsubsession: a session key
btwn c & v
11
1 2
Basic Kerberos (simplified)
authentication service
Client 34 server
1. client-name, server-name, expiring-time, random-num.
2. DESKc(Kc,v, expiring-time,random-num.,...), DESKv(Tc,v)
3. DESKc,v(time-stamp, session-key,...), DESKv(Tc,v)
4. DESKc,v(time-stamp), (this step is optional)
where Tc,v = Kc,v, client-name, expiring-time, ...
12
Full Kerberos (simplified)
Symbols used:c: client/client namev: server/server nameAS: authentication serviceTGS: ticket grant servicen: nonceKc,v: shared key btwn c & vtimeexp: expiring timeKc: shared key btwn c & ASKv: shared key btwn v & ASKtgs: shared key btwn TGS & ASKc,tgs: shared key btwn c & TGSKsubsession: a session key btwn c & v
13
Identification
An Identification (ID) ProtocolIdentification (ID) Protocol allows one party (say Alice) to convince another party (say Bob) of her identity similar to Authentication.
But an ID protocol must also meet a more stringent requirement: It must be secure against ALL THREE types of attacks
Marvin can mount (see Attacks slide) • Protocol Eavesdropping
• Impersonating as Verifier to Prover
• Honest Verifier knowledge compromise
Hence it’s also called a “passport protocol”.
14
Exercise
State whether or not each of the following is an ID protocol, and if not, describe an attack (one of the 3 type/s) that it succumbs to:Challenge-and-Response ProtocolOne-way function based Password Protocol
15
Schnorr passport protocol
InvolvingA trusted authority (TA) to issue
“certificates/passports”A certificate holderA verifier
16
Setting up by the TA
TA’s public key = (y, p, q, g), wherep = a prime of at least 512 bits.q = a 160-bit prime divisor of p-1.g = h(p-1)/q mod p, where h is any integer with 1 <
h < p-1 s.t. h(p-1)/q mod p > 1
(g has order q mod p.)y = g -x mod p, where x is an integer randomly
selected from [1, q-1].
TA’s secret key is x.
17
Issuing a certificate by TA
Alice TA xIDAlice || V
W
pgV
qaa
R
mod
]1,1[
Check the ID, and then usingSchnorr signatureto sign (IDAlice || V ).Let W = sign(IDAlice ||V )
•Alice’s certificate: (IDAlice || V || W)
•Alice’s secret: a
a
18
Schnorr signature - Signing a doc M by TA
To sign a document M=(IDAlice || V), TA does the following:randomly pick an integer k from [1, q-1].r = Hash(gk mod p, M)s = (k + x * r)) mod q,
where Hash is a 1-way hash.
TA’s signature on M is the pair of numbers W=(r, s).
19
How Alice proves her ID to Bob
Alice Boba Forwarding cert.(IDAlice || V || W)
OK
pgQ
qkk
R
mod
]1,1[
Verify the cert.If not OK, then abort.
Q
]]1,1[ qc Rc
qcakd mod dAccept ifQ=gdVc mod p
20
Important points
Setting up & certificate issuing are one-off operations.
Bob the verifier needs to have access to TA’s public key.
The actual proving protocol has 2 parts:Shows that the certificate is OK, &Demonstrate that Alice “knows” the secret
associated with the certificate.
21
Security of Schnorr Protocol
The Schnorr protocol (slightly modified) can be proved to be an ID Protocol, assuming that the discrete-logarithm problem is difficult:The probability that Marvin can successfully
masquerade Alice to an Honest verifier Bob is negligibly small, even if Marvin mounts all of the three types of attacks.