|
12th USENIX Security Symposium — Abstract
Pp. 201-214 of the Proceedings
A New Two-Server Approach for Authentication with Short Secrets
John Brainard, Ari Juels, Burt Kaliski, and Michael Szydlo, RSA Laboratories
Abstract
Passwords and PINs continue to remain the most widespread
forms of user authentication, despite growing awareness of their security
limitations. This is because short secrets are convenient, particularly for an
increasingly mobile user population. Many users are interested in employing a
variety of computing devices with different forms of connectivity and different
software platforms. Such users often find it convenient to authenticate by
means of passwords and short secrets, to recover lost passwords by answering
personal or "life" questions, and to make similar use of relatively
weak secrets.
In typical authentication methods
based on short secrets, the secrets (or related values) are stored in a central
database. Often overlooked is the vulnerability of the secrets to theft en
bloc in the event of server compromise. With this in mind, Ford and
Kaliski and others have proposed various password "hardening" schemes
involving multiple servers, with password privacy assured provided that some
servers remain uncompromised.
In this paper, we describe a new,
two-server secure roaming system that benefits from an especially lightweight
new set of protocols. In contrast to previous ideas, ours can be implemented so
as to require essentially no intensive cryptographic computation by
clients. This and other design features render the system, in our view, the
most practical proposal to date in this area. We describe in this paper the
protocol and implementation challenges and the design choices underlying the
system.
- View the full text of this paper in HTML and
PDF.
Until August 2004, you will need your USENIX membership identification in order to access the full papers. The Proceedings are published as a collective work, © 2003 by the USENIX Association. All Rights Reserved. Rights to individual papers remain with the author or the author's employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. USENIX acknowledges all trademarks within this paper.
- If you need the latest Adobe Acrobat Reader, you can download it from Adobe's site.
|
Need help? Use our Contacts page.
