DMCA
Leveraging Personal Devices for Stronger Password Authentication from Untrusted Computers (2008)
Cached
Download Links
| Citations: | 9 - 1 self |
BibTeX
@MISC{Mannan08leveragingpersonal,
author = {Mohammad Mannan and P. C. van Oorschot},
title = {Leveraging Personal Devices for Stronger Password Authentication from Untrusted Computers },
year = {2008}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Internet authentication for popular end-user transactions, such as online banking and e-commerce, continues to be dominated by passwords entered through end-user personal computers (PCs). Most users continue to prefer (typically untrusted) PCs over smaller personal devices for actual transactions, due to usability features related to keyboard and screen size. However most such transactions and their existing underlying protocols are vulnerable to attacks including keylogging, phishing, and pharming, which can extract user identity and sensitive account information allowing account access. We propose a simple approach to counter such attacks, which cryptographically separates a user’s long-term secret input (typically low-entropy password) from the client PC. The latter continues to be used for most of the interaction and computations but has access only to temporary secrets, while the user’s long-term secret is input through an independent personal trusted device such as a cellphone which makes it available to the PC only after encryption under the intended far-end recipient’s public key. Our proposal is intended to safeguard passwords from the attacks mentioned above, as well as to provide transaction security to foil session hijacking. To facilitate a comparison to our proposal, we also provide a comprehensive survey of web authentication techniques that use an additional factor of authentication such as a cellphone, PDA (personal digital assistant) or hardware token; this survey may be of independent interest. A proof sketch of MP-Auth using the Protocol Composition Logic (PCL) is also provided.
Keyphrases
personal device untrusted computer password authentication independent interest client pc proof sketch additional factor popular end-user transaction user identity actual transaction online banking personal digital assistant user long-term secret transaction security web authentication technique screen size underlying protocol intended far-end recipient protocol composition logic temporary secret user long-term secret input sensitive account information account access internet authentication usability feature end-user personal computer comprehensive survey public key simple approach
