Authenticity
Authenticity is another security property which means communicated information is what it purports to be, including communicating parties being who they purport to be.
Link to original
Thinking adversarially: people might lie about who they are, and the software might lie about what it is. Authentication is about establishing trust in identity. Trust goes both ways: does the system trust a user’s claimed identity and vice-versa?
Three common mechanisms for authenticating a user are:
- a thing you know (i.e. password)
- a thing you have (i.e. key, smartcard)
- a thing you are (i.e. biometrics, Shibboleth-speaking)
Or a combination of these (‘multi-factor authentication’).
Improving password authentication
Passwords are popular despite their security and usability problems. They can be forgotten, guessed or leaked.
If you are forced to implement password auth, you can mitigate some attacks:
- Brute-force attacks: rate-limit attackers or even lock accounts out for some time
- Dictionary attack: forbid ‘dictionary’ words
- Don’t store secrets, hash all passwords.
There are also less obvious attacks:
- Offline dictionary: leaked information can be brute forced offline; strong hash functions can make this unaffordable to attack
- Timing channel: measure # microseconds it takes for the login program to say no. A naive login program may linearly scale how long it takes depending on characters matched, therefore you can insert a randomised delay.
Alternatives to passwords
Current popular ‘two-factor’ at the moment is ‘password + something else’. Usually something you have such as a phone on a fixed number (tied to a SIM). We could use software / hardware to help us:
- simplest: ‘password manager’ (centralises risk)
- better: cryptographic methods, challenge / response protocols (bad usability)
- keep secrets in specialised hardware
Authenticating the system to the user
Before logging into a system, it might be necessary to gain trust that you aren’t, for example, entering credentials into a fake login screen. One approach here is to provide an untrappable key combination, i.e. ‘press Ctrl+Alt+Delete to log in’. The OS guarantees that applications cannot intercept this key combination so the login screen that appears must be genuine if the system is running the OS you think it is.
Websites use a different approach: cryptographic certificate verification, your browser gains assurance you’re really talking to the claimed site by cryptographically checking a certificate that is signed by a chain of well-known authorities. However, you need to trust the OS + browser + ‘chain of trust’.
The OS is an early link in most chains of trust: we rely on its assurances about the contents of a trusted certificates file and for any high-level assurances that certificate checks are done by the browser when visiting a website.