Strengthening public key authentication against key theft

Strengthening public key authentication against key theft

Slides from my talk presented at the 9th International Conference on Passwords (Passwords15), Cambridge, UK, 9 December 2015.
Paper: http://martin.kleppmann.com/papers/mrsa-pass15.pdf
Conference website: http://www.cl.cam.ac.uk/events/passwords2015/

Abstract:

Authentication protocols based on an asymmetric keypair provide strong authentication as long as the private key remains secret, but may fail catastrophically if the private key is lost or stolen. Even when encrypted with a password, stolen key material is susceptible to offline brute-force attacks. In this paper we demonstrate a method for rate-limiting password guesses on stolen key material, without requiring special hardware or changes to servers. By slowing down offline attacks and enabling easy key revocation our algorithm reduces the risk of key compromise, even if a low-entropy password is used.

0d4ef9af8e4f0cf5c162b48ba24faea6?s=128

Martin Kleppmann

December 09, 2015
Tweet

Transcript

  1. None
  2. None
  3. None
  4. None
  5. None
  6. None
  7. None
  8. None
  9. None
  10. None
  11. None
  12. None
  13. None
  14. None
  15. None
  16. None
  17. None
  18. None
  19. None
  20. None
  21. None
  22. None
  23. None
  24. None
  25. None
  26. None
  27. None
  28. None
  29. None
  30. None
  31. None
  32. None
  33. None
  34. None
  35. None
  36. None
  37. None
  38. None
  39. None
  40. None
  41. None
  42. None
  43. None
  44. None
  45. None
  46. None
  47. None
  48. None
  49. None
  50. None
  51. None
  52. 1.  Dan Boneh, Xuhua Ding, Gene Tsudik, and Chi Ming

    Wong: “A Method for Fast Revocation of Public Key Certificates and Security Capabilities,” at 10th USENIX Security Symposium, August 2001. 2.  Mirosław Kutyłowski, Przemysław Kubiak, Michał Tabor, and Daniel Wachnik: “Mediated RSA cryptography specification for additive private key splitting (mRSAA),” IETF Internet Draft, November 2012. https://tools.ietf.org/html/draft-kutylowski-mrsa-algorithm-03 3.  J. Jonsson and B. Kaliski: “Public-Key Cryptography Standards (PKCS) #1: RSA cryptography specifications version 2.1”. Network Working Group RFC 3447, Feb 2003. 4.  Sampath Srinivas, Dirk Balfanz, Eric Tiffany, and Alexei Czeskis: “Universal 2nd factor (U2F) overview”. FIDO Alliance Proposed Standard, May 2015. https://fidoalliance.org/specs/fido-u2f-v1.0-nfc-bt- amendment-20150514/fido-u2f-overview.html 5.  T. Ylonen and C. Lonvick: “The Secure Shell (SSH) authentication protocol”. Network Working Group RFC 4252, Jan 2006.
  53. None