LECTURE 4: AUTHENTICATION AND ACCESS CONTROL

Authentication
*Password
*Biometric

Access control
*Matrix
*List
*Unix access control

-Verification of identity of someone who generated some data
-Relates to identity verification
-classifications of identity verification:
+by something known e.g. password
+by something possessed e.g. smart card, passport
+by physical characteristics (biometrics) e.g. finger prints, palm prints, retina, voice
+by a result of involuntary action : signature

Password

Protection of passwords

Don’t keep your password to anybody
Don’t write or login your password at everywhere
Etc.

Choosing a good password
Criteria:
-Hard to guess and easy to remember

Characteristics of a good password
-Not shorter than six characters
-Not patterns from the keyboard
Etc.

Calculations on password
*Password population, N =rs
*Probability of guessing a password = 1/N
*Probability of success, P=nt/N

Techniques for guessing passwords
*Try default passwords.8
*Try all short words, 1 to 3 characters long.
*Try all the words in an electronic dictionary(60,000).
*Collect information about the user’s hobbies, family names, birthday, etc.
*Try user’s phone number, social security number, street address, etc.
*Try all license plate numbers
*Use a Trojan horse
*Tap the line between a remote user and the host system.

What is Biometric?

*The term is derived from the Greek words bio (= life) and metric (= to measure)
*Biometrics is the measurement and statistical analysis of biological data
*In IT, biometrics refers to technologies for measuring and analysing human body characteristics for authentication purposes
*Definition by Biometrics Consortium – automatically recognising a person using distinguishing traits

Verification vs Identification

*Verification (one-to-one comparison) –confirms a claimed identity
-Claim identity using name, user id, …
*Identification (one-to-many comparison) – establishes the identity of a subject from a set of enrolled persons
-Employee of a company?
-Member of a club?
-Criminal in forensics database?

Static vs. dynamic biometric methods

*Static (also called physiological) biometric methods – authentication based on a feature that is always present
*Dynamic (also called behavioural) biometric methods – authentication based on a certain behaviour pattern

Classification of biometric methods

Static
Fingerprint recognition
Retinal scan
Iris scan
Hand geometry

Dynamic
Signature recognition
Speaker recognition
Keystroke dynamics

Posted by aziekotani

LAB 3 - Classic cryptography

During this lab, we will implement the Caesar Cipher and Vigenere Cipher for Symmetric Cryptography.

As in the previous lecture, we already know that cryptography is divided into 2 main categories which is symmetric and asymmetric. In symmetric encipherment, plaintext is encrypted and decrypts using the same key whereas asymmetric encipherment is using different keys to encrypt and decrypt a plaintext.


Below is an example of symmetric encipherment using Caesar Cipher

The Caesar Cipher is formed by shifting the letters of the original alphabet. For example by replacing each letter of the alphabet with the letter three places down the alphabet. It is monoalphabetic as only one letter in plaintext is exchanged for one letter of ciphertext.

Plaintext alphabet A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Ciphertext key D E F G H I J KLM NO P Q RS T U V W X Y Z A B C

A caesar cipher with a key 3

For an example the plain text below can be encrypted using key 3 to get the cipher text

THE ATTACK TONIGHT START AT EIGHT, REGROUP AT STATION A

Plaintext

WKHDWWDFNWRQLJKWVWDUWDWHLJKWUHJURXSDWVWDWLRQD

Ciphertext

Example of symmetric cryptography using Vigenere Cipher

Vigenere table

The cipher text encrypted using Caesar cipher method is easily broken by using a brute force attack. An attacker can easily try every combinations of character to break the code as the number of possibility is just 26. In order to improve the deciphering process we can used the vigeneré cipher method. The Vigenère cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. It is a simple form of polyalphabetic substitution. You can refer to the Vigenere table for making it easier to encrypt a plaintext using this method.

A key is needed to encrypt a plaintext; a key can be a word or a phrase. To have a strong cipher text it is advised to use different key on each encryption. This will prevent from a brute force attack on a second message if the first message has been intercepted.

Vigenere Cipher

Posted by aziekotani

LECTURE 3: Modern cryptography

The topic covered in this lecture are:

• Modern cryptography algorithm
• Block and stream
• DES
• AES
• MAC
• Digital Signature, RSA

DES
* Provides a high level of security
* The security depends on keys, not the secrecy of the algorithm
* The security is capable of being evaluated
* The algorithm is completely specified and easy to understand
* It is efficient to use and adaptable
* Must be available to all users
* Must be exportable

Posted by aziekotani