Abstract
Safe long-term storage of user private keys is a problem in client/server systems. The problem can be addressed with a roaming system that retrieves keys on demand from remote credential servers, using password authentication protocols that prevent password guessing attacks from the network. Ford and Kaliski’s methods [11] use multiple servers to further prevent guessing attacks by an enemy that compromises all but one server. Their methods use a previously authenticated channel which requires client-stored keys and certificates, and may be vulnerable to offiline guessing in server spoofing attacks when people must positively identify servers, but don’t. We present a multi-server roaming protocol in a simpler model without this need for a prior secure channel. This system requires fewer security assumptions, improves performance with comparable cryptographic assumptions, and better handles human errors in password entry.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
S. Bellovin and M. Merritt, Encrypted Key Exchange: Password-based Protocols Secure against Dictionary Attacks, Proc. IEEE Symposium on Research in Security and Privacy, May 1992.
V. Boyko, P. MacKenzie and S. Patel, Provably Secure Password Authenticated Key Exchange Using Die-Hellman, Advances in Cryptology — EUROCRYPT 2000, Lecture Notes in Computer Science, vol. 1807, Springer-Verlag, May 2000.
M. Bellare, D. Pointcheval and P. Rogaway, Authenticated Key Exchange Secure Against Dictionary Attack, Advances in Cryptology — EUROCRYPT 2000, Lecture Notes in Computer Science, vol. 1807, pp. 139–155, Springer-Verlag, May 2000.
M. K. Boyarsky, Public-Key Cryptography and Password Protocols: The Multi-User Case, Proc. 6th ACMConference on Computer and Communications Security, November 1–4, 1999, Singapore.
D. Chaum, Security without Identification: Transaction Systems to Make Big Brother Obsolete, Communications of the ACM, 28 (1985), 1030–1044.
Cohen, F., 50 Ways to Attack Your World Wide Web System, Computer Security Institute Annual Conference, Washington, DC, October 1995.
T. Dierks and C. Allen, The TLS Protocol Version 1.0, IETF RFC 2246, http://www.ietf.org/rfc/rfc2246.txt, Internet Activities Board, January 1999.
E. Felton, D. Balfanz, D. Dean and D. Wallach, Web Spoofing: An Internet Con Game, 20th National Information Systems Security Conference, Oct. 7–10, 1997, Baltimore, Maryland, http://www.cs.princeton.edu/sip/pub/spoofing.html.
FIPS 186, Digital Signature Standard (DSS), NIST, 19 May 1994.
FIPS 180-1, Secure Hash Standard (SHA), NIST, 11 July 1994.
W. Ford and B. Kaliski, Server-Assisted Generation of a Strong Secret from a Password, Proc. 9th InternationalWorkshops on Enabling Technologies: Infrastructure for Collaborative Enterprises, IEEE, June 14–16, 2000.
A. Frier, P. Karlton, and P. Kocher, The SSL 3.0 Protocol, Netscape Communications Corp., Nov 18, 1996.
L. Gong, T.M.A. Lomas, R.M. Needham, and J.H. Saltzer, Protecting Poorly Chosen Secrets from Guessing Attacks, IEEE Journal on Selected Areas in Communications, vol.11, no.5, June 1993, pp. 648–656.
L. Gong, Increasing Availability and Security of an Authentication Service, IEEE Journal on Selected Areas in Communications, vol. 11, no. 5, June 1993, pp. 657–662.
L. Gong, Optimal Authentication Protocols Resistant to Password Guessing Attacks, Proc. 8th IEEE Computer Security Foundations Workshop, Ireland, June 13, 1995, pp. 24–29.
S. Halevi and H. Krawczyk, Public-Key Cryptography and Password Protocols, Proc. Fifth ACM Conference on Computer and Communications Security, 1998.
IEEE Std 1363-2000, IEEE Standard Specifications for Public-Key Cryptography, IEEE, August 29, 2000, A.11.1, p. 131.
D. Jablon, Strong Password-Only Authenticated Key Exchange, ACM Computer Communications Review, October 1996, http://www.IntegritySciences.com/links.html#Jab96.
D. Jablon, Extended Password Protocols Immune to Dictionary Attack, Proc. 6th Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises, Enterprise Security Workshop, IEEE, June 1997, http://www.IntegritySciences.com/links.html#Jab97.
C. Kaufman, R. Perlman, M. Speciner, Network Security: Private Communication in a Public World, Prentice-Hall, 1995, Chapter 8: Authentication of People, p. 205, 3rd paragraph.
S. Lucks, Open Key Exchange: How to Defeat Dictionary Attacks Without Encrypting Public Keys, The Security Protocol Workshop’ 97Ecole Normale Superieure, April 7–9, 1997.
P. MacKenzie and R. Swaminathan, Secure Network Authentication with Password Identification, submission to IEEE P1363 working group, http://grouper.ieee.org/groups/1363/, July 30, 1999.
R. Perlman and C. Kaufman, Secure Password-Based Protocol for Downloading a Private Key, Proc. 1999 Network and Distributed System Security Symposium, Internet Society, January 1999.
J. Tardo and K. Alagappan, SPX: Global Authentication Using Public Key Certificates, Proc. 1991 IEEE Computer Society Symposium on Security and Privacy, 1991, pp. 232–244.
P. C. van Oorschot, M. J. Wiener, On Diffe-Hellman Key Agreement with Short Exponents, Proceedings of Eurocrypt 96, Springer-Verlag, May 1996.
T. Wu, The Secure Remote Password Protocol, Proc. 1998 Network and Distributed System Security Symposium, Internet Society, January 1998, pp. 97–111.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2001 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Jablon, D.P. (2001). Password Authentication Using Multiple Servers. In: Naccache, D. (eds) Topics in Cryptology — CT-RSA 2001. CT-RSA 2001. Lecture Notes in Computer Science, vol 2020. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-45353-9_26
Download citation
DOI: https://doi.org/10.1007/3-540-45353-9_26
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-41898-6
Online ISBN: 978-3-540-45353-6
eBook Packages: Springer Book Archive