Authentication

Question 1

Choosing Strong Passwords - calculation

Answer 1

A^L
A:= symbols; eg A-Z - A = 28
L:= length of password

Question 2

Dictionary Attacks

Answer 2

• passwords aren’t random & we had leaks
• space is cheap
• attacker can precompute hash for the safe passwords(offline)

Question 3

Salt

Answer 3

• append a random nonce to password before hashing (different for each user)
• > H(Password_Alice | salt_Alice)
• store in database salt and hash

Question 4

Pepper

Answer 4

• is a secret at users database
• make impossible with salt to reverse the hash
• > H(Password_Alice | salt_Alice | pepper)
• even when salt and hash are leaked; still no problem

Question 5

Hash Stretching

Answer 5

• slow down hash computation

- by doing several hashing rounds

Question 6

Password-Based Authentication Schemes

Answer 6

C - S: I’m user xxx
S - C: nonce
C - S: HMAC(n, pw)

Question 7

DH-EKE – Encrypted Key Exchange based on DH

Answer 7

A -> B: A, {X = g^x mod p}_pw
B -> A: {Y = g^y mod p}_pw
for themself: calculate key
B -> A: {N_B}_k
A -> B: {N_B, N_A}_k
B -> A: {N_A}_k

Question 8

SPEKE – Simple Password Exponential Key Exchange

Answer 8

A -> B: A, Q_A = f(pw)^x mod p
B -> A: B, Q_B = f(pw)^y mod p
for themself: k = h(Q_B^x mod p) = h(Q_A^y mod p)
B -> A: {N_B}_k
A -> B: {N_B, N_A}_k
B -> A: {N_A}_k

Question 9

Time-based token

Answer 9

• server and a person share same key
• P_T = F(K,T), where T the exact time is
• then server compares if get’s same value

Question 10

Counter-based token

Answer 10

• server and a person share same key
• P_C = F(K,C), where C is an count
• then server compares if get’s same value