electronic credentials
Post on 17-May-2015
1.791 Views
Preview:
TRANSCRIPT
Electronic CredentialsAdvisor: Dr. Alex Wiesmaier
Introduction
Security is important for privacy protection
Electronic credentials are needed for authentication and secure identification (e.g. ID Cards, passports…)
Two main types of electronic credentials Software based electronic credentials and Hardware based electronic credentials
Software based credentials: Certificates, Assertions
Hardware based credentials: HSMs, Smart Cards
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 2
Content
Software based credentials Passwords, X.509, CVCs, SAML, OpenID
Hardware based credentials HSMs, Smart Cards, Smart Tokens
Comparison Software credentials (OpenID vs. SAML)
Hardware credentials (Magnetic Stripe Cards vs. Chip Cards)
SW vs. HW
Conclusion and future work
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 3
Passwords
username and password
increase security length, case sensitivity, characters brute-force attacks no dictionary words dictionary attacks use salt brute-force attacks, avoiding comparison
Salt: value appended to a password before hashing saved as plain text
One Time Password (OTP) password generator/list
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 4
X.509 certificates
hierarchical Public Key Infrastructure (PKI) Certification Authority (CA): issues certificates Root CA: CA, which is trusted in the first place
verification: iterate over certification path certificate valid = signature verified & issuing CA‘s certificate valid
Certificate Revocation List (CRL) checked while verification
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 5
X.509 certificates - Fields
further fields version (most current: 3) subject‘s public key signature extensions (since v3)
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 6
X.509 certificates - Extensions
value represented as string
criticality flag – what if extension is not supported? critical abort verification
non-critical ignore
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 7
ISO/IEC 7816-8 certificates/ Card verifiable certificates (CVC)
command set for security applications on Smart Cards computation/verification of checksums/signatures, hashing,
encryption/decryption, verification of CVCs
verification completely done by Smart Card itself
consume less space than X.509 certificates even less space: non-self-descriptive CVCs
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 8
Security Assertion Markup Language (SAML)
more general assertion exchange
typical use case service of Identity Provider (IdP) is used IdP communicates authentication data to Reliying Party (RP)
Basic components Assertions (next slide) Protocols
for requests/answers Bindings
embed SAML messages Profiles
perform specific tasks with SAML
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 10
Security Assertion Markup Language (SAML) - Assertions
predefined statement types Authentication Attribute Authorization decision
signatures & encryption possible
extensions possible at many points
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 11
OpenID
especially for SSO applications in web browsers
1. at RP: User enters OpenID identifier (URL)2. redirection OpenID provider (= IdP)3. authentication (if necessary)4. confirmation of RP‘s request5. redirection back to RP (with authentication info)
http://bob_smith.myopenid.com
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 12
OpenID
signatures & encryption possible
extensions key-value pairs
predefined extensions by OpenID Attribute Exchange Provider Authentication Policy Extension Simple Registration Extension
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 13
Hardware based credentials
Cryptography can also be implemented in Hardware (HW)
HW Modules are exclusively developed for execution of cryptographic procedures or...
In some cases for secure data storage, which are needed for authentication
Types Hardware Secure Modules, Smart Cards, Smart Tokens
and SecureID Card
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 14
Hardware based credentials - HSM
Hardware Security Module (HSM) defined as a piece of hardware and associated software/firmware
that usually attaches to the inside of a PC or server and provides at least the minimum of cryptographic functions (encyption, decryption, key generation, hash…)
Other name for HSM Personal Computer Security Module (PCSM)
Secure Application Module (SAM)
Hardware Cryptographic Device or Cryptographic Module
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 15
Hardware based credentials - HSM
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi
Requirements Random Key Generator
Cryptographic functions: encryption, decryption and hash algorithms
Protection against side channel attacks
Tamper-resistant
Possibility for “cloning”
Hardware based credentials – Smart Cards
People almost certainly carry a Plastic Card around in their wallet
For traveling with a Railway Card, make calls with Telephone Card or pay with Credit Card
Smart Cards may have the same size, but sometimes have completely different functions
ePersoTUD Card /Athene Card
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 17
Hardware based credentials – Smart Cards
Magnetic Stripe Cards
Dark Stripe (approx. 1 cm)
Based on ISO 7811 standard
226 bytes fit on a stripe
Not secure but cheap
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 18
Hardware based credentials – Smart Cards
Chip Cards More powerful than Magnetic Stripe Card
There are also non-Contact Chip Cards
Telphone Cards, Bank Cards…
Two kinds of Chip Card: Memory and Smart Card Memory Card: used only for data storage Smart Card: is a miniature computer (ROM, RAM and
EEPROM)
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 19
Hardware based credentials – Authentication with Smart Cards
•Authentication based on challenge-response protocol
Requirements: Smart Card reader, dedicated accessing SW, PC and Smart Card share the secret PIN
After inserting the Smart Card into the reader, PC ask for PIN and sends a random number RND (challenge)
Smart Card applies a key depended hash function to the RND and send it to the PC (response)
PC verifies the response, if it is OK => the user is logged in
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 20
Hardware based credentials – Smart Tokens
Problem: Smart Cards have the darwback that they are useless without a reading device
Smart Token is a possible solution A small object with an inbuilt computer chip and display Some of them look like a small pocket calculator Many of smart tokens have a keyboard Authentication through a challenge-response protocol
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 21
Hardware based credentials SecureID Card
Produced by RSA Security
Most important feature using the current time as the challange
The Chip contains a pseudo-generator, which changes every minute starting from the initial settings
Initial settings are obviously different for every SecurID Card
How the Chip works internaly it is a RSA Security secret
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 22
Hardware based credentials - News
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 23
Comparison Software based credentials
OpenID vs. SAML
Focus on: Security point of view on the authentication protocol
Vulnerabilities and different attacks
Range of applications
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 24
Comparison Vulnerabilities of OpenID
The assertion response message is the only message that is integrity protected
Other OpenID messages are by default not protected by any encryption
The authentication method is not specified in the OpenID specification
Different attacks are possible...
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 25
ComparisonAttacks against OpenID
Eavesdropping attack OpenID default protocol does not use any encryption
Tracking user’s authentication
Every message that is not integrity protected can be manipulated
Domain Name System (DNS) attack
Phishing attack
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 26
ComparisonVulnerabilities of SAML
SAML does not include a general security analysis
SAML provides an attack-by-attack list of countermeasures
Different attacks are possible...
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 28
ComparisonAttacks against SAML
Man-In-The-Middle attack
1. Rewrite the HTTP response
that initiates the redirect and
change the target URL
2. As there is no unilateral
authentication in step 3 and 6
a browser cannot distinguish
between an attacker AD and
destination site D
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 30
ComparisonAttacks against SAML
Replay attack
HTTP Referrer attack
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 31
ComparisonRange of applications
OpenID is especially designed for SSO
SAML in contrast is a more general solution for exchanging assertions including SSO
If a simple SSO solution is desiered, OpenID is a good suggestion, if flexibitlity is an important requirement, SAML should be chosen
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 32
Comparison Hardware based credentials
Magnetic Stripe Cards vs. Chip Cards
Focus: Security point of view
Vulnerabilities
Range of applications
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 33
Comparison Magnetic card‘s vulnerabilities
Skimming Information of a valid card is copied to another card
Counterfeiting The magnetic stripe is invalid but the plastic card/carrier is copied
very carefully
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 34
Comparison Chip card‘s vulnerabilities
Reverse Engineering of the chip Take the chip appart and find out how it was put together and how
it functions
Requieres special equipment and knowledge
Diffrential Power Analysis
Flaws in Design
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 35
Comparison Range of applications
Magnetic cards: Entitlement cards
Tickets and access control systems
Chip Cards: Financial transactions
Security system access
Sotrage of records, e.g medical records
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 36
Comparison HW vs. SW
HW: Pros: Faster, Portability, Secure Storage, more Security
Cons: Expensive, usually used for a single pourpose
SW: Pros: Chiper, Reusability, special HW is not needed
Cons: Source code is known, easier to spot backdoors and unintentional flows, more vuernarable, no Secure Storage
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 37
Conclusion and future work
Two differen types of electronic credentials Software based credentials and Hardware based credentials
Comparison: Hardware vs. Software credentials
Future work: OpenID spreading will increase security? how can I log in, if my OpenID provider is under attack (SPOF)? Solution: OpenID approach based on P2P data stored encrypted authentication anonymously done by a random chosen node
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 38
Questions???
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 39
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi
References
Trusted System lecture (WS10/11)
C. Eckert. IT-Sicherheit: Konzepte - Verfahren – Protokolle. Oldenbourg, 2009.
J. Buchmann. Einführung in die Kryptographie. Springer, 2010
Public Key Infrastructures lecture (SS10)
16/3/2011 | TUD | Department 20 | CDC | Electronic Credentials | S. Pöschel, A. Neziri & J. Budurushi 41
top related