User-aware provably secure protocols for browser-based mutual authentication

DOI10.1504/IJACT.2009.028028MaRDI QIDQ843365zbMATH OpenOpenAlexFDO

Authors Sebastian Gajek, Mark Manulis, Jörg Schwenk

Publication date 12 October 2009

Published in International Journal of Applied Cryptography (Search for Journal in Brave)

Full work available at URL https://doi.org/10.1504/ijact.2009.028028

zbMATH Keywords

cookie authenticationhuman perceptible authenticationimpersonation attacksmutual authenticationpassword authenticationprovably secure protocolssecurity modelsuser awarenessweb browsersweb servers

Mathematics Subject Classification ID

Cryptography (94A60)

Review text

Summary: The standard solution for mutual authentication between human users and servers on the internet is to execute a transport layer security (TLS) handshake during which the server authenticates using a X.509 certificate followed by the authentication of the user either with own password or with some cookie stored within the user's browser. However, poor ability of human users to validate X.509 certificates allows for various forms of (social) impersonation attacks. In this paper, we introduce human perceptible authentication (HPA) as a concept for the secure user-aware authentication of servers via recognisable authenticators such as images, video or audio sequences. We formally specify HPA within a security model for browser-based mutual authentication; for this, we extend the traditional Bellare-Rogaway model to deal with human users as inherent protocol participants. Using HPA and the classical TLS handshake, we furthermore design two efficient provably secure password- and cookie-authentication protocols.

Recommendations

• Enforcing User-Aware Browser-Based Mutual Authentication with Strong Locked Same Origin Policy
• HPAKE : Password Authentication Secure against Cross-Site User Impersonation
• scientific article; zbMATH DE number 1808213
• Efficient and secure authenticated key exchange using weak passwords
• scientific article; zbMATH DE number 6866300

Cited in

(5)

• Enforcing User-Aware Browser-Based Mutual Authentication with Strong Locked Same Origin Policy
• HPAKE : Password Authentication Secure against Cross-Site User Impersonation
• scientific article; zbMATH DE number 1955801 (Why is no real title available?)
• Applied Cryptography and Network Security
• A Universally Composable Framework for the Analysis of Browser-Based Security Protocols

This page was built for publication: User-aware provably secure protocols for browser-based mutual authentication

Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q843365)