Attacks on Quantum Cryptography

As recently reported in an IEEE On-line magazine, practical implementations of quantum cryptographic systems are exposed to attack. The weakness arises from the need to authenticate the communicating parties. The laws of physic determine that the proverbial eavesdropper Eve will reveal her presence when snooping from a quantum channel.
However, to avoid a trivial man-in-the-middle attack, quantum encryption protocols need to exchange information over a classic channel for authentication purposes. Authentication over a classic channel is subjected to classic attacks targeting the weaknesses of the underlying protocol.
My two comments on this:
Authentication is still ‘the’ problem for many cryptographic systems and;
Prof. Lomonaco’s dictum* is applicable also to quantum encryption.

[*] To be able to communicate in secret one must first communicate in secret

related post

Online anonymity a thing of the past / Is privacy Dead?

ID theft is making news as the costs of this type of crime increases day by day. The National Post run recently a special section on Security (one of the articles is linked below).
Coincidentally, the same day Steve Gibson his well listened Security Now Podcast episode with the tittle Is Privacy Dead?.
As in the case of DRM, these problems don’t seem to be amenable to a technological solution. Digital technologies are changing the world in such a way that we will have to make changes to the way we handle personal information. Again, everything boils down to the necessity of reviewing the authentication protocols we use in our relations with business and institutions.


Online anonymity a thing of the past

National Post
06 Dec 2007

?On the Internet, nobody knows you?re a dog,? said one canine Web surfer to another in a 1993 New Yorker cartoon. The implication was that your Internet browser offered you a comforting anonymity. You could go about your business without fear of… read more…

Security of Password Protocols

In an article titled Password-Based Authentication: Preventing Dictionary Attacks published in the June issue of Computer magazine, S. Chakrabarti and M. Singhal describe a series of password protocols often used to authenticate users over the Internet.
The authors describe and analyze several heuristic measures developed to prevent man in the middle, on-line and off-line dictionary attacks. Their conclusion is that there is no proof that these password protocols are provably secure (not even computationally) in the standard model. That means, there is not even guarantee of (computational) security such as the one provided by the widely accepted assumptions that:

  1. factoring the product of two large primes is hard;
  2. computing the discrete logarithm is hard;
  3. there exists a good pseudo-random permutation such as the AES cipher.

The authors also analyze external measures designed to prevent or make computationally very expensive the large number of trials necessary for a dictionary attack. They conclude that measures such as account locking and Reverse Turing Test (colorful images with distorted text or Captchas) need to be carefully used to offer a good balance between security and convenience for the user.

Password-based authentication is susceptible to attack is used on insecure communication channels like the Internet. Researchers have engineered several protocols to prevent attacks, but we still need formal models to analyze and aid in the effective design of acceptable password protocols geared to prevent dictionary attacks.

Two Reviews for the AMS

After a hiatus due to travel and heavy work loads, I finally got around to put two of my reviews on-line. For those interested in authentication and secret sharing they can click on the links below:
* Enhanced Security Models and a Generic Construction Approach for Linkable Ring Signature
* Enforcing the security of a time-bound hierarchical key assignment scheme.

Security and Economics

I suggest the reader to visit the Financial Cryptography blog (click on the link in the right column, under Security). In particular those interested in the economics behind the security market will appreciate the material being posted there by Ian Grigg.

Identification

I am reading Jim Harper’s book Identity Crisis and got the inspiration to draw this simple chart of identifiers that can be used for multi-factor authentication.
Identifiers -Copyright - c. 2007 Surengineering.com
Copyright – c. 2007 Surengineering.com

Combinations of these identifiers can be used to increase the certainty in any authentication scheme (computer based or not).
As an example, if the probability of identifying someone using the hair color (something you are, biometric) is 1 in 10 (I_1 = {{1} \over {10}}) and the probability to identify him based on his name (something assigned, name) is 1 in 100,000 (I_2={{1} \over {100,000}}) The probability for the combined use is I_{1 + 2}=I_1 \times I_2={{1} \over {1,000,000}})