Authentication Systems

Nota:

• Authentication of a human, a software or an hardware system against a relaying party.

1. Authentication mechanisms based on
   1. Knowledge
   2. Ownership
   3. Inherence
   4. Different mechanism of authentication can be combined to obtain higher levels of authentication

      Nota:

      • Multi-factor authN: more factors are combined (do not use the same factor twice e.g. two passwords).
      1. One-factor authN
      2. Two-factor authN
      3. Three-factor authN
2. Password-based Authentication
   1. One problem is the storage of the password on the server side
      1. in clear -> anyone can access it
      2. encrypted -> the key should be saved
      3. Hashed -> unprotected digests are subject to dictionary attacks
      4. Hashed with salt -> unpredictable digests are stored. Dictionary attacks and rainbow tables are made impossible
3. Challenge-Response Authentication
   1. Symmetric CRA
   2. Asymmetric CRA
4. One-time password Authentication

   Nota:

   • a simple authentication technique where the password is used only once as authentication information to verify the identity
   1. Synchronous

      Nota:

      • password depends on time
      1. RSA SecurID

         Nota:

         • It is a proprietary solution intrinsically connected with the producer.
   2. Asynchronous
      1. S/KEY
   3. Event-based OTP
   4. OOB OTP

      Nota:

      • A sort of Password-based authN that increments security by using an out of band OTP exchange (SMS, PSTN are deprecated)
   5. Different solutions that are not interoperetable is not good. A common standard has been developed
      1. OATH
         1. HMAC OTP
         2. TOTP
         3. OCRA
         4. PSKC
         5. DSKPP
5. Biometric Authentication
   1. Captcha
   2. Biometric Techniques
      1. API/SPI standardized by CDSA
      2. FIDO
6. Zero Knowledge Password Proof
7. SSO - Single Sign-On
   1. Fictious

      Nota:

      • Different services require different authentication passwords that are provided by a manager that asks for a global password (like the password wallet, that automatically manages pwds and authNs).
   2. Integral
      1. Multi-application

         Nota:

         • asymmetric challenge-response systems. All the services are able to recognize the same user credential.
         1. Kerberos
      2. Multi-domain

         Nota:

         • A service accepts the credential of a service in another domain (like the access with google account on different websites).