Provably secure browser-based user-aware mutual authentication over TLS

ABSTRACT

The standard solution for user authentication on the Web is to establish a TLS-based secure channel in server authenticated mode and run a protocol on top of TLS where the user enters a password in an HTML form. However, as many studies point out, the average Internet user is unable to identify the server based on a X.509 certificate so that impersonation attacks (e.g., phishing) are feasible. We tackle this problem by proposing a protocol that allows the user to identify the server based on human perceptible authenticators (e.g., picture, voice). We prove the security of this protocol by refining the game-based security model of Bellare and Rogaway and present a proof of concept implementation.

REFERENCES

• 1: Michel Abdalla , Emmanuel Bresson , Olivier Chevassut , Bodo Möller , David Pointcheval, Provably secure password-based authentication in TLS, Proceedings of the 2006 ACM Symposium on Information, computer and communications security, March 21-24, 2006, Taipei, Taiwan [doi>10.1145/1128817.1128827]
• 2: M. Abdalla, O. Chevassut, and D. Pointcheval. One-time verifier-based encrypted key exchange. In Public Key Cryptography, volume 3386 of LNCS, pages 47--64. Springer, 2005.
• 3: M. Abdalla and D. Pointcheval. Simple password-based encrypted key exchange protocols. In CT-RSA, volume 3376 of LNCS, pages 191--208. Springer, 2005.
• 4: C. Allen and T. Dierks. The TLS protocol --- version 1.1. Internet proposed standard RFC 4346, 2006.
• 5: Mihir Bellare , Chanathip Namprempre, Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm, Proceedings of the 6th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology, p.531-545, December 03-07, 2000
• 6: M. Bellare, D. Pointcheval, and P. Rogaway. Authenticated key exchange secure against dictionary attacks. In EUROCRYPT, volume 1807 of LNCS, pages 139--155. Springer, 2000.
• 7: Mihir Bellare , Phillip Rogaway, Entity authentication and key distribution, Proceedings of the 13th annual international cryptology conference on Advances in cryptology, p.232-249, January 1994, Santa Barbara, California, United States
• 8: Mihir Bellare , Phillip Rogaway, Random oracles are practical: a paradigm for designing efficient protocols, Proceedings of the 1st ACM conference on Computer and communications security, p.62-73, November 03-05, 1993, Fairfax, Virginia, United States [doi>10.1145/168588.168596]
• 9: M. Bellare and P. Rogaway. The AuthA protocol for password-based authenticated key exchange. contributions to ieee p1363, 2000. http://grouper.ieee.org/groups/1363/passwdPK/contributions.html.
• 10: Steven M. Bellovin , Michael Merritt, Augmented encrypted key exchange: a password-based protocol secure against dictionary attacks and password file compromise, Proceedings of the 1st ACM conference on Computer and communications security, p.244-250, November 03-05, 1993, Fairfax, Virginia, United States [doi>10.1145/168588.168618]
• 11: V. Boyko, P. D. MacKenzie, and S. Patel. Provably secure password-authenticated key exchange using diffie-hellman. In EUROCRYPT, volume 1807 of LNCS, pages 156--171. Springer, 2000.
• 12: Emmanuel Bresson , Olivier Chevassut , David Pointcheval, Security proofs for an efficient password-based key exchange, Proceedings of the 10th ACM conference on Computer and communications security, October 27-30, 2003, Washington D.C., USA [doi>10.1145/948109.948142]
• 13: E. Bresson, O. Chevassut, and D. Pointcheval. New security results on encrypted key exchange. In Public Key Cryptography, volume 2947 of LNCS, pages 145--158. Springer, 2004.
• 14: R. Canetti, S. Halevi, and M. Steiner. Mitigating dictionary attacks on password-protected local storage. In CRYPTO, volume 4117 of LNCS, pages 160--179. Springer, 2006.
• 15: S. Chiasson, P. C. van Oorschot, and R. Biddle. Graphical password authentication using cued click points. In ESORICS, volume 4734 of LNCS, pages 359--374. Springer, 2007.
• 16: Rachna Dhamija , J. D. Tygar, The battle against phishing: Dynamic Security Skins, Proceedings of the 2005 symposium on Usable privacy and security, p.77-88, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073009]
• 17: Rachna Dhamija , J. D. Tygar , Marti Hearst, Why phishing works, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada [doi>10.1145/1124772.1124861]
• 18: T. Dierks and E. Rescorla. The transport layer security (TLS) protocol, version 1.1. RFC 4346, IETF, 2006. Proposed Standard.
• 19: C. Ellison. Ceremony design and analysis. Cryptology ePrint Archive, Report 2007/399, 2007.
• 20: R. Fielding , J. Gettys , J. Mogul , H. Frystyk , L. Masinter , P. Leach , T. Berners-Lee, Hypertext Transfer Protocol -- HTTP/1.1, RFC Editor, 1999
• 21: I. Giang. SSL Phishing, Microsoft Moves to Brand, and Nyms. Financial Cryptography, 14 February 2006. https://www.financialcryptography.com/mt/archives/000654.html.
• 22: Thomas Groβ, Security Analysis of the SAML Single Sign-on Browser/Artifact Profile, Proceedings of the 19th Annual Computer Security Applications Conference, p.298, December 08-12, 2003
• 23: T. Groß, B. Pfitzmann, and A.-R. Sadeghi. Browser model for security analysis of browser-based protocols. In ESORICS, volume 3679 of LNCS, pages 489--508. Springer, 2005.
• 24: Thomas Groβ , Birgit Pfitzmann , Ahmad-Reza Sadeghi, Proving a WS-federation passive requestor profile with a browser model, Proceedings of the 2005 workshop on Secure web services, November 11-11, 2005, Fairfax, VA, USA [doi>10.1145/1103022.1103034]
• 25: A. Herzberg. Why Johnny can't surf (safely)?, 2007. (Work in Progress).
• 26: Markus Jakobsson , Steven Myers, Delayed password disclosure, Proceedings of the 2007 ACM workshop on Digital identity management, November 02-02, 2007, Fairfax, Virginia, USA [doi>10.1145/1314403.1314407]
• 27: Jonathan Katz , Rafail Ostrovsky , Moti Yung, Efficient Password-Authenticated Key Exchange Using Human-Memorable Passwords, Proceedings of the International Conference on the Theory and Application of Cryptographic Techniques: Advances in Cryptology, p.475-494, May 06-10, 2001
• 28: J. Katz, R. Ostrovsky, and M. Yung. Forward secrecy in password-only key exchange protocols. In SCN, volume 2576 of LNCS, pages 29--44. Springer, 2002.
• 29: David P. Kormann , Aviel D. Rubin, Risks of the passport single signon protocol, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.33 n.1-6, p.51-58, June 2000
• 30: P. MacKenzie. The PAK suite: Protocols for password-authenticated key exchange. Technical Report 2002-46, DIMACS, 2002.
• 31: Birgit Pfitzmann , Michael Waidner, A Model for Asynchronous Reactive Systems and its Application to Secure Message Transmission, Proceedings of the 2001 IEEE Symposium on Security and Privacy, p.184, May 14-16, 2001
• 32: Proof of Concept Implementation of BBMA, 2007. http://www.demo.nds.rub.de/bbma.
• 33: V. Shoup. OAEP reconsidered. J. Cryptology, 15(4):223--249, 2002.
• 34: V. Shoup. Sequences of Games: A Tool for Taming Complexity in Security Proofs. Cryptology ePrint Archive, Report 2004/332, 2006.
• 35: C. Soghoian and M. Jakobsson. A deceit-augmented man in the middle attack against bank of america's sitekey service, 2007. http://paranoia.dubfire.net/2007/04/deceit-augmented-man-in-middle-attack.html.
• 36: Secure password-based cipher suite for TLS, ACM Transactions on Information and System Security (TISSEC), v.4 n.2, p.134-157, May 2001 [doi>10.1145/501963.501965]
• 37: Stuart E. Schechter , Rachna Dhamija , Andy Ozment , Ian Fischer, The Emperor's New Security Indicators, Proceedings of the 2007 IEEE Symposium on Security and Privacy, p.51-65, May 20-23, 2007 [doi>10.1109/SP.2007.35]
• 38: Xiaoyuan Suo , Ying Zhu , G. Scott. Owen, Graphical Passwords: A Survey, Proceedings of the 21st Annual Computer Security Applications Conference, p.463-472, December 05-09, 2005 [doi>10.1109/CSAC.2005.27]
• 39: W3C. Document object model (DOM), 2005. http://www.w3.org/DOM.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.2 Network Protocols

Additional Classification:
  E. Data
  E.3 DATA ENCRYPTION

General Terms:
Security

Keywords:
TLS, browser-based protocols, phishing, user authentication