SCRAM authentication Heikki Linnakangas / Pivotal
|
|
|
- Brianna Lawson
- 5 years ago
- Views:
Transcription
1 SCRAM authentication Heikki Linnakangas / Pivotal
2 pg_hba.conf # TYPE DATABASE USER ADDRESS METHOD # "local" is for Unix domain socket connections only local all all trust # Use plaintext authentication from localhost host all all plain # Allow md5 authentication from example.com, with SSL hostssl all all.example.com md5 # Require SCRAM for everyone else host all all /0 scram
3 PostgreSQL authentication methods Password-based: password (plaintext) crypt md5 scram RADIUS / LDAP / PAM Others: SSL certificate kerberos
4 (Plain) Password authentication Server: Hey, what s your password? Client: Swordfish Server: ok, cool
5 Plain password authentication Obviously weak Password sniffing Ok over SSL With sslmode=verify-full Used by RADIUS, LDAP, PAM, BSD authentication methods!
6 MD5 authentication Server: Here are 4 random bytes (salt). Please compute: md5(md5(password username), salt) Client: 23dff85f7c38ee928f0c21ae710bba5d Server: Ok, cool
7 MD5 weaknesses md5(md5(password username), salt) Password guessing My laptop can compute about 7 million MD5 hashes per second Replay Only 4 billion unique 4-byte salts (birthday attack) Stolen hashes You don t need the original password to log in. The hash stored in pg_auth.rolpassword is enough.
8 Other MD5 issues Renaming a user invalidates the password Because the hash includes the username db_user_namespace cannot be used For same reason MD5 has a bad reputation
9 SCRAM to the rescue! Salted Challenge Response Authentication Mechanism To be precise, PostgreSQL implements SCRAM-SHA-256 Defined by RFC 5802 and RFC 7677 Challenge-response like MD5 authentication
10 SCRAM Client: Hi! Here s a random nonce: r=fyko+d2lbbfgonrv9qkxdawl Server: Hi! Here s my random nonce, salt and iteration count: r=fyko+d2lbbfgonrv9qkxdawl3rfcnhyjy1zvvwvs7j, s=qsxcr+q6sek8bf92, i=4096 Client: Here s my proof that I know the password: <ClientProof> Server: Ok, cool. And here s my proof that I knew it too: <ServerProof>
11 SCRAM More resistant to dictionary attacks The computation to guess password is much more resource intensive Configurable iteration count Longer nonces defeat replay attacks The verifiers stored in pg_authid.rolpassword don t allow impersonating the user
12 SCRAM-SHA-256 Relatively simple implementation < 1000 lines of code in libpq Relies only on SHA-256 hash function
13 Simple Authentication and Security Layer (SASL) The Simple Authentication and Security Layer (SASL) is a framework for providing authentication and data security services in connection-oriented protocols via replaceable mechanisms. Decouples authentication from application protocol (like PostgreSQL s FE/BE protocol) SCRAM is one SASL authentication mechanism
14 SASL Currently, PostgreSQL has a built-in SCRAM-SHA-256 implementation Would be straightforward to add more SASL authentication mechanisms Could use an external library to add support for more (e.g. Cyrus libsasl) Client can use a library that implements SASL and SCRAM-SHA-256 Java has a very generic SASL implementation, but no built-in SCRAM-SHA-256 provider
15 Password verifiers set password_encryption='plain'; create user plain_user password 'foo'; set password_encryption='md5'; create user md5_user password 'foo'; set password_encryption='scram'; create user scram_user password 'foo';
16 Password verifiers scram-sha-256:<salt>:<iteration count>:<hashes> postgres=# select rolname, rolpassword from pg_authid rolname rolpassword plain_user foo md5_user md591334fcda a9cdb3f551e3cc8 scram_user scram-sha- 256:pXLPIrUTzmEzow==:4096:6eee f2bafd38063a6f7dcc110c e641b65 a9b a462d:3cad59b e37ee7eb5db0e11c811f52d d d3e3b09 (3 rows)
17 Compatibility matrix Kind of verifier Authentication method in pg_hba.conf plain md5 hash scram verifier password md5 [1] scram [1] Will use SCRAM, requires client support
18 SCRAM is not encryption! SSL is still recommended SCRAM is only authentication, not encryption!
19 PostgreSQL implementation SCRAM-SHA-256 Channel binding not supported Unicode normalization not implemented yet Username is always passed as empty
20 Migrating 1.Upgrade all clients 2.Set password_encryption= scram 3.Change all user passwords
21 Future, short-term Implement SCRAM-SHA-256 in all the drivers JDBC, ODBC (uses libpq), Python,.Net, Ruby, Add option to libpq to require SCRAM Unicode normalization
22 Future, long-term Allow storing SCRAM verifier in LDAP Zero-knowledge proof SRP
23 Questions?
SCRAM authentication Heikki Linnakangas / Pivotal
SCRAM authentication Heikki Linnakangas / Pivotal pg_hba.conf # TYPE DATABASE USER ADDRESS METHOD # "local" is for Unix domain socket connections only local all all trust # Use plaintext authentication
SCRAM authentication. Michael Paquier VMware 2017/12/06, PGConf Asia 2017
SCRAM authentication Michael Paquier VMware 2017/12/06, PGConf Asia 2017 Authentication methods Password Plain text MD5 SCRAM-SHA-256 RADIUS, ldap, pam, BSD... SSL certificates Kerberos, SSPI (Windows)
Authentication in PostgreSQL Michael Paquier VMware 2018/05/31, PGCon 2018
Authentication in PostgreSQL Michael Paquier VMware 2018/05/31, PGCon 2018 The man Michael Paquier. French, based in Tokyo. PostgreSQL contributor since 2009 Some patches, some reviews and some bug fixes.
Securing PostgreSQL From External Attack
Securing PostgreSQL From External Attack BRUCE MOMJIAN systems are rich with attack vectors to exploit. This presentation explores the many potential PostgreSQL external vulnerabilities and shows how they
Securing PostgreSQL From External Attack
Securing From External Attack BRUCE MOMJIAN, ENTERPRISEDB September, 2009 Abstract systems are rich with attack vectors to exploit. This presentation explores the many potential external vulnerabilities
Securing PostgreSQL From External Attack
Securing From External Attack BRUCE MOMJIAN systems are rich with attack vectors to exploit. This presentation explores the many potential external vulnerabilities and shows how they can be secured. Includes
NYC PostgreSQL User Group New York. Magnus Hagander
Secure PostgreSQL 11 Deployments NYC PostgreSQL User Group New York Magnus Hagander magnus@hagander.net Magnus Hagander Redpill Linpro Principal database consultant PostgreSQL Core Team member Committer
Computer Security 3/20/18
Authentication Identification: who are you? Authentication: prove it Computer Security 08. Authentication Authorization: you can do it Protocols such as Kerberos combine all three Paul Krzyzanowski Rutgers
Computer Security. 08. Authentication. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08. Authentication Paul Krzyzanowski Rutgers University Spring 2018 1 Authentication Identification: who are you? Authentication: prove it Authorization: you can do it Protocols such
Secure PostgreSQL Deployment
Secure PostgreSQL Deployment PGDay'14 Russia St Petersburg, Russia Magnus Hagander magnus@hagander.net PRODUCTS CONSULTING APPLICATION MANAGEMENT IT OPERATIONS SUPPORT TRAINING Magnus Hagander PostgreSQL
Network Security CHAPTER 31. Solutions to Review Questions and Exercises. Review Questions
CHAPTER 3 Network Security Solutions to Review Questions and Exercises Review Questions. A nonce is a large random number that is used only once to help distinguish a fresh authentication request from
Password. authentication through passwords
Password authentication through passwords Human beings Short keys; possibly used to generate longer keys Dictionary attack: adversary tries more common keys (easy with a large set of users) Trojan horse
Secure PostgreSQL Deployments
Secure PostgreSQL Deployments JDCon-East 2010 Philadelphia, PA Magnus Hagander Redpill Linpro AB There's much to security Identify the threats Apply the correct measures Don't do things just because you
OS Security. Authentication. Radboud University Nijmegen, The Netherlands. Winter 2014/2015
OS Security Authentication Radboud University Nijmegen, The Netherlands Winter 2014/2015 What does an OS do? Definition An operating system (OS) is a computer program that manages access of processes (programs)
CS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 6 Week of March 6, 2017 Question 1 Password Hashing (10 min) When storing a password p for user u, a website randomly generates a string s (called
Strong Password Protocols
Strong Password Protocols Strong Password Protocols Password authentication over a network Transmit password in the clear. Open to password sniffing. Open to impersonation of server. Do Diffie-Hellman
The LinkedIn Hack: Understanding Why It Was So Easy to Crack the Passwords
The LinkedIn Hack: Understanding Why It Was So Easy to Crack the Passwords LinkedIn was breached in 2012 with a reported 6.5 million user accounts compromised. LinkedIn sent a request to known hacked users
Attacking Your Two-Factor Authentication (PS: Use Two-Factor Authentication)
Attacking Your Two-Factor Authentication (PS: Use Two-Factor Authentication) 08 Jun 2017 K-LUG Technical Meeting Rochester, MN Presented by: Vi Grey Independent Security Researcher https://vigrey.com Who
Computer Security 4/12/19
Authentication Computer Security 09. Authentication Identification: who are you? Authentication: prove it Authorization: you can do it Paul Krzyzanowski Protocols such as Kerberos combine all three Rutgers
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 9 March 30, 2011 Question 1 Another Use for Hash Functions (8 min) The traditional Unix system for password authentication works more or less like
Study Guide for the Final Exam
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Handout #22 Professor M. J. Fischer April 30, 2005 1 Exam Coverage Study Guide for the Final Exam The final
Key Management. Digital signatures: classical and public key Classic and Public Key exchange. Handwritten Signature
Key Management Digital signatures: classical and public key Classic and Public Key exchange 1 Handwritten Signature Used everyday in a letter, on a check, sign a contract A signature on a signed paper
OS Security. Authentication. Radboud University Nijmegen, The Netherlands. Winter 2014/2015
OS Security Authentication Radboud University Nijmegen, The Netherlands Winter 2014/2015 What does an OS do? Definition An operating system (OS) is a computer program that manages access of processes (programs)
Cryptographic Hash Functions. Secure Software Systems
1 Cryptographic Hash Functions 2 Cryptographic Hash Functions Input: Message of arbitrary size Output: Digest (hashed output) of fixed size Loreum ipsum Hash Function 23sdfw83x8mjyacd6 (message of arbitrary
Lecture 4: Hashes and Message Digests,
T-79.159 Cryptography and Data Security Lecture 4: Hashes and Message Digests Helsinki University of Technology mjos@tcs.hut.fi 1 Cryptographic hash functions Maps a message M (a bit string of arbitrary
Network Working Group. Category: Standards Track September The SRP Authentication and Key Exchange System
Network Working Group T. Wu Request for Comments: 2945 Stanford University Category: Standards Track September 2000 Status of this Memo The SRP Authentication and Key Exchange System This document specifies
Internet Engineering Task Force (IETF) Obsoletes: 2831 July 2011 Category: Informational ISSN:
Internet Engineering Task Force (IETF) A. Melnikov Request for Comments: 6331 Isode Limited Obsoletes: 2831 July 2011 Category: Informational ISSN: 2070-1721 Abstract Moving DIGEST-MD5 to Historic This
Overview. Terminology. Password Storage
Class: CSG254 Network Security Team: Enigma (team 2) Kevin Kingsbury Tejas Parikh Tony Ryan Shenghan Zhang Assignment: PS3 Secure IM system Overview Our system uses a server to store the passwords, and
User Authentication. Modified By: Dr. Ramzi Saifan
User Authentication Modified By: Dr. Ramzi Saifan Authentication Verifying the identity of another entity Computer authenticating to another computer Person authenticating to a local/remote computer Important
Chapter 9: Key Management
Chapter 9: Key Management Session and Interchange Keys Key Exchange Cryptographic Key Infrastructure Storing and Revoking Keys Digital Signatures Slide #9-1 Overview Key exchange Session vs. interchange
Distributed Systems. 25. Authentication Paul Krzyzanowski. Rutgers University. Fall 2018
Distributed Systems 25. Authentication Paul Krzyzanowski Rutgers University Fall 2018 2018 Paul Krzyzanowski 1 Authentication For a user (or process): Establish & verify identity Then decide whether to
Lorikeet Integrated Authentication
Lorikeet Integrated Authentication Who am I? 'Student Network Administrator' at Hawker College Samba Team Authentication in the real world 800 students 170 client computers Win NT, Win2k, WinXP Single
Oracle Database Security and Audit. Authentication and authorization
Copyright 2014, Oracle Database Security and Audit Beyond Checklists Authentication and authorization Copyright 2014, Learning objectives Understand authentication Understand authorization Understand the
CS 161 Computer Security
Popa & Wagner Spring 2016 CS 161 Computer Security Midterm 2 Print your name:, (last) (first) I am aware of the Berkeley Campus Code of Student Conduct and acknowledge that academic misconduct will be
Passwords CSC 193 WAKE FOREST. U N I V E R S I T Y Department of Computer Science. Spring 2014
Passwords CSC 193 WAKE FOREST U N I V E R S I T Y Department of Computer Science Spring 2014 Unix Passwords In Unix, users are identified by user names Authenticated by passwords Therefore to login as
Cryptographic Checksums
Cryptographic Checksums Mathematical function to generate a set of k bits from a set of n bits (where k n). k is smaller then n except in unusual circumstances Example: ASCII parity bit ASCII has 7 bits;
CS November 2018
Authentication Distributed Systems 25. Authentication For a user (or process): Establish & verify identity Then decide whether to allow access to resources (= authorization) Paul Krzyzanowski Rutgers University
Passwords. CS 166: Introduction to Computer Systems Security. 3/1/18 Passwords J. Liebow-Feeser, B. Palazzi, R. Tamassia, CC BY-SA 2.
Passwords CS 166: Introduction to Computer Systems Security 1 Source: https://shop.spectator.co.uk/wp-content/uploads/2015/03/open-sesame.jpg 2 Password Authentication 3 What Do These Passwords Have in
Intro to PostgreSQL Security
Intro to PostgreSQL Security NordicPGDay 2014 Stockholm, Sweden Stephen Frost sfrost@snowman.net Resonate, Inc. Digital Media PostgreSQL Hadoop techjobs@resonateinsights.com http://www.resonateinsights.com
Hashes, MACs & Passwords. Tom Chothia Computer Security Lecture 5
Hashes, MACs & Passwords Tom Chothia Computer Security Lecture 5 Today s Lecture Hash functions: Generates a unique short code from a large file Uses of hashes MD5, SHA1, SHA2, SHA3 Message Authentication
COSC 301 Network Management. Lecture 15: SSL/TLS and HTTPS
COSC 301 Network Management Lecture 15: SSL/TLS and HTTPS Zhiyi Huang Computer Science, University of Otago COSC301 Lecture 15: SSL/TLS and HTTPS 1 Today s Focus WWW WWW How to secure web applications?
Kurose & Ross, Chapters (5 th ed.)
Kurose & Ross, Chapters 8.2-8.3 (5 th ed.) Slides adapted from: J. Kurose & K. Ross \ Computer Networking: A Top Down Approach (5 th ed.) Addison-Wesley, April 2009. Copyright 1996-2010, J.F Kurose and
Test 2 Review. 1. (10 points) Timestamps and nonces are both used in security protocols to prevent replay attacks.
Test 2 Review Name Student ID number Notation: {X} Bob Apply Bob s public key to X [Y ] Bob Apply Bob s private key to Y E(P, K) Encrypt P with symmetric key K D(C, K) Decrypt C with symmetric key K h(x)
Authentication in real world: Kerberos, SSH and SSL. Zheng Ma Apr 19, 2005
Authentication in real world: Kerberos, SSH and SSL Zheng Ma Apr 19, 2005 Where are we? After learning all the foundation of modern cryptography, we are ready to see some real world applications based
Cristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment.
CS355: Cryptography Lecture 17: X509. PGP. Authentication protocols. Key establishment. Public Keys and Trust Public Key:P A Secret key: S A Public Key:P B Secret key: S B How are public keys stored How
Securely backing up GPG private keys
Securely backing up GPG private keys... to the cloud Joey Hess Linux.Conf.Au 2017 Imagine if everyone used GPG In a world where everyone has a GPG key... In a world where everyone has a GPG key... Everyone
ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification
ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification Hossen Asiful Mustafa Introduction Entity Authentication is a technique designed to let one party prove the identity of another
ConnectUPS-X / -BD /-E How to use and install SSL, SSH
ConnectUPS-X /-BD /-E product family Root CA Certificate installation Rev. B Page 1/16 Index 1. How to use and install SSL (Secure Socket Layer)...3 1.1. General Certificate warning message if not installed...3
UNIT - IV Cryptographic Hash Function 31.1
UNIT - IV Cryptographic Hash Function 31.1 31-11 SECURITY SERVICES Network security can provide five services. Four of these services are related to the message exchanged using the network. The fifth service
Information Security. message M. fingerprint f = H(M) one-way hash. 4/19/2006 Information Security 1
Information Security message M one-way hash fingerprint f = H(M) 4/19/2006 Information Security 1 Outline and Reading Digital signatures Definition RSA signature and verification One-way hash functions
The question paper contains 40 multiple choice questions with four choices and students will have to pick the correct one (each carrying ½ marks.).
Time: 3hrs BCA III Network security and Cryptography Examination-2016 Model Paper 2 M.M:50 The question paper contains 40 multiple choice questions with four choices and students will have to pick the
PRACTICAL PASSWORD AUTHENTICATION ACCORDING TO NIST DRAFT B
PRACTICAL PASSWORD AUTHENTICATION ACCORDING TO NIST DRAFT 800-63B MOTIVATION DATABASE LEAKAGE ADOBE 152,982,479 Encrypted with 3DES ECB Same password == same ciphertext https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/
Encryption. INST 346, Section 0201 April 3, 2018
Encryption INST 346, Section 0201 April 3, 2018 Goals for Today Symmetric Key Encryption Public Key Encryption Certificate Authorities Secure Sockets Layer Simple encryption scheme substitution cipher:
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ Chapter 8 Network Security Computer Networking: A Top Down Approach, 5 th edition. Jim Kurose, Keith Ross Addison-Wesley, April 2009.
Authenticating People and Machines over Insecure Networks
Authenticating People and Machines over Insecure Networks EECE 571B Computer Security Konstantin Beznosov authenticating people objective Alice The Internet Bob Password= sesame Password= sesame! authenticate
User Authentication. Modified By: Dr. Ramzi Saifan
User Authentication Modified By: Dr. Ramzi Saifan Authentication Verifying the identity of another entity Computer authenticating to another computer Person authenticating to a local/remote computer Important
Identification Schemes
Identification Schemes Lecture Outline Identification schemes passwords one-time passwords challenge-response zero knowledge proof protocols Authentication Data source authentication (message authentication):
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 14: Folklore, Course summary, Exam requirements Ion Petre Department of IT, Åbo Akademi University 1 Folklore on
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
Microsoft Exam Security fundamentals Version: 9.0 [ Total Questions: 123 ]
![Microsoft Exam Security fundamentals Version: 9.0 [ Total Questions: 123 ]](/thumbs/96/126527464.jpg "Microsoft Exam Security fundamentals Version: 9.0 [ Total Questions: 123 ]")
s@lm@n Microsoft Exam 98-367 Security fundamentals Version: 9.0 [ Total Questions: 123 ] Question No : 1 The Active Directory controls, enforces, and assigns security policies and access rights for all
ח'/סיון/תשע "א. RSA: getting ready. Public Key Cryptography. Public key cryptography. Public key encryption algorithms
Public Key Cryptography Kurose & Ross, Chapters 8.28.3 (5 th ed.) Slides adapted from: J. Kurose & K. Ross \ Computer Networking: A Top Down Approach (5 th ed.) AddisonWesley, April 2009. Copyright 19962010,
Security: Focus of Control. Authentication
Security: Focus of Control Three approaches for protection against security threats a) Protection against invalid operations b) Protection against unauthorized invocations c) Protection against unauthorized
PASSWORDS TREES AND HIERARCHIES. CS121: Relational Databases Fall 2017 Lecture 24
PASSWORDS TREES AND HIERARCHIES CS121: Relational Databases Fall 2017 Lecture 24 Account Password Management 2 Mentioned a retailer with an online website Need a database to store user account details
Framework Database Connectivity Guide. PostgreSQL Databases
Framework Database Connectivity Guide PostgreSQL Databases 6/6/2018 Contents 1 PostgreSQL Databases 1.1 Using PostgreSQL Client Software 1.2 Secure Connections with PostgreSQL DBMS 1.3 Advanced Authentication
Message authentication codes
Message authentication codes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Introduction security of MAC Constructions block cipher
Overview. CSC 580 Cryptography and Computer Security. Hash Function Basics and Terminology. March 28, Cryptographic Hash Functions (Chapter 11)
CSC 580 Cryptography and Computer Security Cryptographic Hash Functions (Chapter 11) March 28, 2017 Overview Today: Review Homework 8 solutions Discuss cryptographic hash functions Next: Study for quiz
GoPrint Server Migration
GoPrint Server Migration The following steps walks you through migrating a current GoPrint system to a new Windows server focusing on migrating the current database as well as keeping the same server name.
Operating Systems Design Exam 3 Review: Spring 2011
Operating Systems Design Exam 3 Review: Spring 2011 Paul Krzyzanowski pxk@cs.rutgers.edu 1 1. Why does an IP driver need to use ARP, the address resolution protocol? IP is a logical network. An IP address
Test 2 Review. (b) Give one significant advantage of a nonce over a timestamp.
Test 2 Review Name Student ID number Notation: {X} Bob Apply Bob s public key to X [Y ] Bob Apply Bob s private key to Y E(P, K) Encrypt P with symmetric key K D(C, K) Decrypt C with symmetric key K h(x)
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Proving who you are. Passwords and TLS
Proving who you are Passwords and TLS Basic, fundamental problem Client ( user ) How do you prove to someone that you are who you claim to be? Any system with access control must solve this Users and servers
secure communications
Jabber security Peter Saint-Andre stpeter@jabber.org secure communications with Jabber Jabber is... open technologies real-time messaging presence multimedia negotiation and more invented by Jeremie Miller
Wireless LAN Security. Gabriel Clothier
Wireless LAN Security Gabriel Clothier Timeline 1997: 802.11 standard released 1999: 802.11b released, WEP proposed [1] 2003: WiFi alliance certifies for WPA 2004: 802.11i released 2005: 802.11w task group
Concrete cryptographic security in F*
Concrete cryptographic security in F* crypto hash (SHA3) INT-CMA encrypt then-mac Auth. encryption Secure RPC some some some adversary attack attack symmetric encryption (AES). IND-CMA, CCA2 secure channels
Overview. Cryptographic key infrastructure Certificates. May 13, 2004 ECS 235 Slide #1. Notation
Overview Key exchange Session vs. interchange keys Classical, public key methods Key generation Cryptographic key infrastructure Certificates Key storage Key escrow Key revocation Digital signatures May
What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource.
P1L4 Authentication What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource. Authentication: Who are you? Prove it.
10/1/2015. Authentication. Outline. Authentication. Authentication Mechanisms. Authentication Mechanisms. Authentication Mechanisms
Authentication IT443 Network Security Administration Instructor: Bo Sheng Authentication Mechanisms Key Distribution Center and Certificate Authorities Session Key 1 2 Authentication Authentication is
Authentication. Steven M. Bellovin January 31,
Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to do Identification is whom you claim to be be Authentication
Outline. Login w/ Shared Secret: Variant 1. Login With Shared Secret: Variant 2. Login Only Authentication (One Way) Mutual Authentication
Outline Security Handshake Pitfalls (Chapter 11 & 12.2) Login Only Authentication (One Way) Login i w/ Shared Secret One-way Public Key Lamport s Hash Mutual Authentication Shared Secret Public Keys Timestamps
More Attacks on Cryptography 3/12/2010
More Attacks on Cryptography 3/12/2010 MS Point-to-Point Encryption (MPPE) If both endpoints support 128-bit crypto: I support 128-bit crypto So do I. Here s a nonce: R M RC4(K) where K = hash(password
Kerberos and Public-Key Infrastructure. Key Points. Trust model. Goal of Kerberos
Kerberos and Public-Key Infrastructure Key Points Kerberos is an authentication service designed for use in a distributed environment. Kerberos makes use of a thrusted third-part authentication service
Operating systems and security - Overview
Operating systems and security - Overview Protection in Operating systems Protected objects Protecting memory, files User authentication, especially passwords Trusted operating systems, security kernels,
Operating systems and security - Overview
Operating systems and security - Overview Protection in Operating systems Protected objects Protecting memory, files User authentication, especially passwords Trusted operating systems, security kernels,
CSC 580 Cryptography and Computer Security
CSC 580 Cryptography and Computer Security Cryptographic Hash Functions (Chapter 11) March 22 and 27, 2018 Overview Today: Quiz (based on HW 6) Graded HW 2 due Grad/honors students: Project topic selection
Computer Security. 10. Exam 2 Review. Paul Krzyzanowski. Rutgers University. Spring 2017
Computer Security 10. Exam 2 Review Paul Krzyzanowski Rutgers University Spring 2017 March 23, 2018 CS 419 2017 Paul Krzyzanowski 1 Question 1(a) Suppose you come across some old text in the form GEPPQ
Authentication. Steven M. Bellovin September 26,
Authentication Steven M. Bellovin September 26, 2009 1 Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to
HW #7: Security Design Principles/Threat Modeling. CS 392/6813: Computer Security Fall 2008 Due 11/30/08. [100pts]
![HW #7: Security Design Principles/Threat Modeling. CS 392/6813: Computer Security Fall 2008 Due 11/30/08. [100pts]](/thumbs/82/85617232.jpg "HW #7: Security Design Principles/Threat Modeling. CS 392/6813: Computer Security Fall 2008 Due 11/30/08. [100pts]")
HW 7: Security Design Principles/Threat Modeling CS 392/6813: Computer Security Fall 2008 Due 11/30/08 [100pts] Note: For this HW, you are free to work in teams of no more than two people! Each team needs
CNIT 124: Advanced Ethical Hacking. Ch 9: Password Attacks
CNIT 124: Advanced Ethical Hacking Ch 9: Password Attacks Topics Password Management Online Password Attacks Offline Password Attacks Dumping Passwords from RAM Password Management Password Alternatives
Chapter 3: Hashing. Prof Bill Buchanan OBE
Chapter 3: Hashing Hashing Types. Hashing Methods. Salting. Collisions. LM and NTLM Hashes (Windows). Hash Benchmarks. Message Authentication Codes (MACs). OTP/HOTP. Prof Bill Buchanan OBE http://asecuritysite.com/crypto03
Managing External Identity Sources
CHAPTER 5 The Cisco Identity Services Engine (Cisco ISE) integrates with external identity sources to validate credentials in user authentication functions, and to retrieve group information and other
PASSWORDS & ENCRYPTION
PASSWORDS & ENCRYPTION Villanova University Department of Computing Sciences D. Justin Price Fall 2014 CRYPTOGRAPHY Hiding the meaning of a message from unintended recipients. Open source algorithms are
Offline dictionary attack on TCG TPM weak authorisation data, and solution
Offline dictionary attack on TCG TPM weak authorisation data, and solution Liqun Chen HP Labs, UK Mark Ryan HP Labs, UK, and University of Birmingham Abstract The Trusted Platform Module (TPM) is a hardware
LDAP Servers for AAA
This chapter describes how to configure LDAP servers used in AAA. About LDAP and the ASA, page 1 Guidelines for, page 5 Configure, page 5 Test LDAP Server Authentication and Authorization, page 9 Monitoring,
Integrated Key Exchange Protocol Capable of Revealing Spoofing and Resisting Dictionary Attacks
Integrated Key Exchange Protocol Capable of Revealing Spoofing and Resisting Dictionary Attacks David Lai and Zhongwei Zhang Department of Mathematics and Computing, University of Southern Queensland,
Major Features: Postgres 10
Major Features: Postgres 10 BRUCE MOMJIAN POSTGRESQL is an open-source, full-featured relational database. This presentation gives an overview of the Postgres 10 release. Creative Commons Attribution License
Securely backing up GPG private keys... to the cloud. Joey Hess LibrePlanet 2017
Securely backing up GPG private keys... to the cloud Joey Hess LibrePlanet 2017 Imagine if everyone used GPG In a world where everyone has a GPG key... In a world where everyone has a GPG key... Everyone
Introduction to Cryptography. Ramki Thurimella
Introduction to Cryptography Ramki Thurimella Encryption & Decryption 2 Generic Setting 3 Kerckhoff s Principle Security of the encryption scheme must depend only on The secret key NOT on the secrecy of
Digital it Signatures. Message Authentication Codes. Message Hash. Security. COMP755 Advanced OS 1
Digital Signatures Digital it Signatures Offer similar protections as handwritten signatures in the real world. 1. Difficult to forge. 2. Easily verifiable. 3. Not deniable. 4. Easy to implement. 5. Differs
BTEC Level 3. Unit 32 Network System Security Password Authentication and Protection. Level 3 Unit 32 Network System Security
BTEC Level 3 Unit 32 Network System Security Password Authentication and Protection Passwords Why are they important? Passwords are cheap to deploy, but also act as the first line of defense in a security
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Authentication Applications We cannot enter into alliance with neighbouring princes until