Reference : A Critical Security Analysis of the Password-Based Authentication Honeywords System U...
Scientific congresses, symposiums and conference proceedings : Paper published in a book
Engineering, computing & technology : Computer science
Security, Reliability and Trust
http://hdl.handle.net/10993/40158
A Critical Security Analysis of the Password-Based Authentication Honeywords System Under Code-Corruption Attack
English
Genç, Ziya Alper mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) >]
Lenzini, Gabriele mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) >]
Ryan, Peter mailto [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC)]
Vazquez Sandoval, Itzel mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) >]
Jul-2019
Information Systems Security and Privacy
Springer International Publishing
Communications in Computer and Information Science, Volume 977
125-151
Yes
International
978-3-030-25109-3
Cham
4th International Conference, ICISSP 2018, Revised Selected Papers
January 22-24, 2018
Funchal - Madeira
Portugal
[en] honeywords ; password-based authentication ; secure protocols design ; formal security analysis
[en] Password-based authentication is a widespread method to access into systems, thus password files are a valuable resource often target of attacks. To detect when a password file has been stolen, Juels and Rivest introduced the Honeywords System in 2013. The core idea is to store the password with a list of decoy words that are ``indistinguishable'' from the password, called honeywords. An adversary that obtains the password file and, by dictionary attack, retrieves the honeywords can only guess the password when attempting to log in: but any incorrect guess will set off an alarm, warning that file has been compromised. In a recent conference paper, we studied the security of the Honeywords System in a scenario where the intruder also manages to corrupt the server's code (with certain limiting assumptions); we proposed an authentication protocol and proved it secure despite the corruption. In this extended journal version, we detail the analysis and we extend it, under the same attacker model, to the other two protocols of the original Honeywords System, the setup and change of password. We formally verify the security of both of them; further, we discuss that our design suggests a completely new approach that diverges from the original idea of the Honeywords System but indicates an alternative way to authenticate users which is robust to server's code-corruption.
http://hdl.handle.net/10993/40158
10.1007/978-3-030-25109-3_7
The original publication is part of the Communications in Computer and Information Science (CCIS) book series published by Springer and it is available at https://doi.org/10.1007/978-3-030-25109-3_7

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Open access
document.pdfAuthor postprint270.35 kBView/Open

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.