FIT3031 Lecture Notes - Lecture 4: Session Key, Scalability, Public-Key Cryptography
19 Jun 2018
School
Department
Course
Professor
L4: Authentication Applications
Organisaons mostly use open distributed architecture which consists of
●Workstaons (clients); cannot be trusted for access control purposes
●Distributed/Centralized servers
Due to using such things these threats exist:
●User pretends to be another user
●User alters the network address of a workstaon
●User eavesdrops on exchanges and uses it to replay aack
Security approaches:
●Rely on client workstations to assure users identy and rely on server to enforce a security
policy based on user id - good for small environments
●Require that client systems authenticate themselves to servers, but trust the client systems
to assure users identy - good for small environments
●Require the user to prove identity for each service on the server and also the server to
prove its identy to clients - good for large environments
Kerberos
●Authencaon protocol
●Provides a centralized authencaon server to authencate users to servers and servers to
users
●Sasfies the following requirements:
○Security : secure enough to prevent an eavesdropper to gaining informaon to
impersonate a user
○Reliability : Ensure availability of service
○Transparency : user should not be aware of authencaon taking place except
entering a password
○Scalability : should be capable of supporng large number of clients and servers
●Requires that:
○You have KDC on your network
○Have kerberised applicaons running on all parcipang systems
Overview
●Employs an Authencaon Server (AS)
○Provides a non-corrupble authencaon credenal (cket granng cket TGT)
●Employs a Ticket Granng server ( TGS)
○Users request access to other services from TGS using TGT
Authentication Operations:
1. User logs on to workstaon and requests service on host
2. AS verifies user's credenals in database
● Creates a TGT and a session key
●Results are encrypted using key derived from users password
3. Workstaon prompts user for password
●Uses password to decrypt incoming message
Document Summary
O(cid:396)ga(cid:374)isa(cid:415)o(cid:374)s (cid:373)ostl(cid:455) use ope(cid:374) dist(cid:396)i(cid:271)uted a(cid:396)(cid:272)hite(cid:272)tu(cid:396)e (cid:449)hi(cid:272)h (cid:272)o(cid:374)sists of. Wo(cid:396)ksta(cid:415)o(cid:374)s (cid:894)(cid:272)lie(cid:374)ts(cid:895); (cid:272)a(cid:374)(cid:374)ot (cid:271)e t(cid:396)usted fo(cid:396) a(cid:272)(cid:272)ess (cid:272)o(cid:374)t(cid:396)ol pu(cid:396)poses. Due to usi(cid:374)g su(cid:272)h thi(cid:374)gs these th(cid:396)eats e(cid:454)ist: Use(cid:396) alte(cid:396)s the (cid:374)et(cid:449)o(cid:396)k add(cid:396)ess of a (cid:449)o(cid:396)ksta(cid:415)o(cid:374) Use(cid:396) ea(cid:448)esd(cid:396)ops o(cid:374) e(cid:454)(cid:272)ha(cid:374)ges a(cid:374)d uses it to (cid:396)epla(cid:455) a(cid:425)a(cid:272)k. Rely on client workstations to assu(cid:396)e use(cid:396)s ide(cid:374)(cid:415)t(cid:455) a(cid:374)d (cid:396)el(cid:455) o(cid:374) se(cid:396)(cid:448)e(cid:396) to e(cid:374)fo(cid:396)(cid:272)e a se(cid:272)u(cid:396)it(cid:455) poli(cid:272)(cid:455) (cid:271)ased o(cid:374) use(cid:396) id - good fo(cid:396) s(cid:373)all e(cid:374)(cid:448)i(cid:396)o(cid:374)(cid:373)e(cid:374)ts. Require that client systems authenticate the(cid:373)sel(cid:448)es to se(cid:396)(cid:448)e(cid:396)s, (cid:271)ut t(cid:396)ust the (cid:272)lie(cid:374)t s(cid:455)ste(cid:373)s to assu(cid:396)e use(cid:396)s ide(cid:374)(cid:415)t(cid:455) - good fo(cid:396) s(cid:373)all e(cid:374)(cid:448)i(cid:396)o(cid:374)(cid:373)e(cid:374)ts. Require the user to prove identity for each service o(cid:374) the se(cid:396)(cid:448)e(cid:396) a(cid:374)d also the se(cid:396)(cid:448)e(cid:396) to p(cid:396)o(cid:448)e its ide(cid:374)(cid:415)t(cid:455) to (cid:272)lie(cid:374)ts - good fo(cid:396) la(cid:396)ge e(cid:374)(cid:448)i(cid:396)o(cid:374)(cid:373)e(cid:374)ts. P(cid:396)o(cid:448)ides a (cid:272)e(cid:374)t(cid:396)alized authe(cid:374)(cid:415)(cid:272)a(cid:415)o(cid:374) se(cid:396)(cid:448)e(cid:396) to authe(cid:374)(cid:415)(cid:272)ate use(cid:396)s to se(cid:396)(cid:448)e(cid:396)s a(cid:374)d se(cid:396)(cid:448)e(cid:396)s to use(cid:396)s. Security : se(cid:272)u(cid:396)e e(cid:374)ough to p(cid:396)e(cid:448)e(cid:374)t a(cid:374) ea(cid:448)esd(cid:396)oppe(cid:396) to gai(cid:374)i(cid:374)g i(cid:374)fo(cid:396)(cid:373)a(cid:415)o(cid:374) to i(cid:373)pe(cid:396)so(cid:374)ate a use(cid:396)
