Scribd
Upload
58 views10 pages

Entity Authentication

Entity authentication is a technique where one party proves their identity to another. It involves a claimant proving their identity to a verifier. Common methods of authentication include something the claimant knows (like a password), possesses (like an ID card), or is (like fingerprints). Password authentication involves the claimant demonstrating they know a secret password. Challenge-response authentication avoids sending the secret by having the verifier send a challenge that the claimant responds to using the secret. Digital signatures using public/private key cryptography allow for authentication without shared secrets.

Uploaded by

kishorerajan777
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
58 views10 pages

Entity Authentication

Entity authentication is a technique where one party proves their identity to another. It involves a claimant proving their identity to a verifier. Common methods of authentication include something the claimant knows (like a password), possesses (like an ID card), or is (like fingerprints). Password authentication involves the claimant demonstrating they know a secret password. Challenge-response authentication avoids sending the secret by having the verifier send a challenge that the claimant responds to using the secret. Digital signatures using public/private key cryptography allow for authentication without shared secrets.

Uploaded by

kishorerajan777
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 10

ENTITY AUTHENTICATION

Kishore Rajan R
INTRODUCTION
 ENTITY AUTHENTICATION IS A TECHNIQUE DESIGNED TO
LET ONE PARTY PROVE THE IDENTITY OF ANOTHER PARTY.
 AN ENTITY CAN BE A PERSON, A PROCESS, A CLIENT, OR A
SERVER
 THE ENTITY WHOSE IDENTITY NEEDS TO BE PROVED IS
CALLED THE CLAIMANT; THE PARTY THAT TRIES TO PROVE
THE IDENTITY OF THE CLAIMANT IS CALLED THE VERIFIER.
MESSAGE AUTHENTICATION (DATA ORIGIN)
VERSUS ENTITY AUTHENTICATION
• THERE ARE TWO DIFFERENCES BETWEEN MESSAGE AUTHENTICATION
(DATAORIGIN AUTHENTICATION), AND ENTITY AUTHENTICATION –
MESSAGE AUTHENTICATION MIGHT NOT HAPPEN IN REAL TIME; ENTITY
AUTHENTICATION DOES.
• MESSAGE AUTHENTICATION: WHEN BOB VERIFIES THE MESSAGE THAT
ALICE SENT, ALICE MAY OR MAY NOT BE PRESENT IN THE VERIFICATION
PROCESS.
EG. AUTHENTICATE THAT ALICE SENT AN EMAIL TO BOB • ENTITY
AUTHENTICATION: NO REAL MESSAGE COMMUNICATION INVOLVED UNTIL
ALICE IS AUTHENTICATED BY BOB.
VERIFICATION CATEGORIES
• • SOMETHING KNOWN – A SECRET KNOWN ONLY BY THE CLAIMANT THAT CAN
BE CHECKED BY THE VERIFIER
• EG. PASSWORD, PIN, SECRET KEY, PRIVATE KEY
• SOMETHING POSSESSED – SOMETHING THAT CAN PROVE THE CLAIMANT’S
IDENTITY PASSPORT.
DRIVER’S LICENSE, IDENTIFICATION CARD, CREDIT CARD • SOMETHING INHERENT
– INHERENT CHARACTERISTICS OF THE CLAIMANT • CONVENTIONAL SIGNATURE,
FINGERPRINTS, FACIAL CHARACTERISTICS
PASSWORDS
• • THE SIMPLEST AND OLDEST METHOD OF ENTITY AUTHENTICATION IS THE PASSWORD-
BASED AUTHENTICATION, WHERE THE PASSWORD IS SOMETHING THAT THE CLAIMANT
KNOWS. – FIXED PASSWORD – ONE-TIME PASSWORD
• FIXED PASSWORD: POSSIBLE ATTACKS – EAVESDROPPING – STEALING A PASSWORD • WHEN
ALICE WRITE A PASSWORD SOMEWHERE – ACCESSING A PASSWORD FILE – GUESSING
• ONE-TIME PASSWORD :• FIRST APPROACH – USER AND THE SYSTEM AGREE UPON A LIST OF
PASSWORDS.
• • SECOND APPROACH – USER AND THE SYSTEM AGREE TO SEQUENTIALLY UPDATE THE
PASSWORD.
• • THIRD APPROACH - LAMPORT – USER AND THE SYSTEM CREATE A SEQUENTIALLY
UPDATED PASSWORD USING A HASH FUNCTION
CHALLENGE RESPONSE
• IN PASSWORD AUTHENTICATION, THE CLAIMANT PROVES HER IDENTITY BY
DEMONSTRATING THAT SHE KNOWS A SECRET, THE PASSWORD. – USER NEEDS TO
SEND THE PASSWORD AND THUS IT IS SUSCEPTIBLE TO ADVERSARY
• IN CHALLENGE-RESPONSE AUTHENTICATION, THE CLAIMANT PROVES THAT SHE
KNOWS A SECRET WITHOUT SENDING THE SECRET TO THE VERIFIER.
• THE CHALLENGE IS A TIME-VARYING VALUE SUCH AS A RANDOM NUMBER OR A
TIMESTAMP THAT IS SENT BY THE VERIFIER .
• THE CLAIMANT APPLIES A FUNCTION TO THE CHALLENGE AND SENDS A
RESPONSE TO THE VERIFIER.
SYMMETRIC-KEY : NONCE
CHALLENGE
A TIME-VARYING VALUE IS A NONCE – A RANDOM NUMBER
USED ONLY ONCE, RB

NONCE IS A RANDOM BIT-STRING USED ONLY ONCE: ALICE


 BOB: E(KPUB, (N, A, KAB)) • BOB MUST CHECK THAT HE
HAS NOT RECEIVED THAT N BEFORE
SYMMETRIC-KEY

TIMESTAMP
NONCE CHALLENGE CHALLENGE BIDIRECTIONAL
AUTHENTICATION
A TIME-VARYING VALUE IS A NONCE • A TIME-VARYING VALUE IS A ALICE IS AUTHENTICATED TO BOB
– A RANDOM NUMBER USED ONLY TIMESTAMP, T AND BOB IS AUTHENTICATED TO
ONCE, RB ALICE
KEYED HASH FUNCTION
(MAC)
• THE METHOD PRESERVES THE INTEGRITY OF
CHALLENGE AND RESPONSE MESSAGES AND
ALSO USES A SECRET, KEY.

• WHEN BOB RECEIVES THE MESSAGE, HE TAKES


PLAINTEXT AND APPLIES THE KEYED HASH
FUNCTION AND THEN COMPARES HIS CALCULATION
WITH WHAT HE RECEIVED TO DETERMINE
AUTHENTICITY OF ALICE.
ASYMMETRIC KEY CIPHER – DIGITAL
SIGNATURE

BIDIRECTIONAL UNIDIRECTIONAL
ALICE  BOB: ALICE BOB  ALICE: RB ALICE  BOB: ALICE BOB  ALICE: RB ALICE 
ALICE  BOB: BOB; E(H(RB ||BOB),KPRA) BOB: RA ; BOB; E(H(RB ||BOB),KPRIA) B: D(E(H(RB ||
BOB: D(E(H(RB ||BOB),KPRA), KPUA) = BOB),KPRIA), KPUBA) = H(RB ||BOB), VERIFY THE
H(RB ||BOB); VERIFY SIGNATURE
SIGNATURE BOB  ALICE: ALICE; E(H(RA ||
ALICE),KPRIB)

You might also like