Password Authentication Protocol Using Local Secret Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security mechanisms fail to effectively prevent offline dictionary attacks on passwords, and users often reuse weak passwords across multiple online services, making them vulnerable to hacking.
Innovation Solution
A password-based authentication protocol that uses a data storage device, such as a mobile phone, to generate and store cryptographically strong random secrets, allowing users to authenticate without revealing their passwords, thereby protecting against dictionary attacks and password reuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users choose simple, easily remembered passwords, then ease of operation is improved, but security is worsened making users vulnerable to dictionary attacks
Solution Approach 1:
The authentication system is segmented into multiple components: the user retains their simple password, a cryptographic secret is stored separately in a data storage device, and during authentication these components are combined through cryptographic operations to generate proof of identity. This segmentation allows users to keep simple passwords while the system provides strong security through the combined use of the password and the stored secret.
2Ease of operation
If users reuse the same password across multiple online services, then ease of operation is improved, but security is worsened as a single breach compromises all accounts
Solution Approach 1:
The data storage device acts as an intermediary that holds a cryptographic secret unique to each online service. During authentication, this secret is combined with the user's password through cryptographic operations to generate service-specific authentication proofs. This intermediary mechanism enables users to securely reuse the same password across multiple services while each service maintains its own unique cryptographic secret, preventing cross-service compromise.
3Reliability
If strong passwords with numbers, letters and symbols are used, then security is improved, but ease of operation is worsened as users cannot remember them
Solution Approach 1:
The system enables self-service authentication where the user's simple password serves as a seed for generating cryptographic proofs. The data storage device automatically performs the cryptographic operations combining the password with stored secrets to generate authentication credentials. This self-service mechanism eliminates the need for users to remember complex passwords while maintaining strong security through cryptographic operations.
4Device complexity
If the online service stores the user's password, then authentication is simplified, but security is worsened enabling offline dictionary attacks
Solution Approach 1:
The password is extracted from the authentication exchange entirely. Instead of storing or transmitting the password, the system extracts only a cryptographic proof of identity. The data storage device holds the secret and performs cryptographic operations locally to generate this proof, which is then transmitted to the online service for verification. This extraction eliminates the security vulnerability of storing passwords while maintaining authentication functionality.
Data Source
AI summary
Described herein are various technologies pertaining to constructions of a password-based authentication protocol that are configured to allow a user to register with and authenticate to an online service without the online service receiving a password or a deterministic function of the password of the user. When registering with an online service, a client computing device establishes a cryptographically strong random secret and stores an encryption of such secret with a data storage device. The storage device also never receives the password or a deterministic function of the password. When the user wishes to authenticate to the online service, the user employs her password to retrieve the encrypted secret from the storage device, decrypts such secret, and utilizes the decrypted secret to answer a cryptographically strong challenge provided to the user by the online service upon the online service receiving a username pertaining to such user.