Remote User Authentication Using Symmetric Encryption

Mutual Authentication

A two-level hierarchy of symmetric encryption keys can be used to provide confidentiality for communication in a distributed environment. In general, this strategy involves the use of a trusted key distribution center (KDC). Each party in the network shares a secret key, known as a master key, with the KDC. The KDC is responsible for generating keys to be used for a short time over a connection between two parties, known as session keys, and for distributing those keys using the master keys to protect the distribution. This approach is quite common.

Needham and Schroeder for secret key distribution using a KDC that includes authentication features. The protocol can be summarized as follows:

Secret keys K_a and K_b are shared between A and the KDC and B and the KDC, respectively. The purpose of the protocol is to distribute securely a session key K_s to A and B. Entity A securely acquires a new session key in step 2. The message in step 3 can be decrypted, and hence understood, only by B. Step 4 reflects B’s knowledge of K_s, and step 5 assures B of A’s knowledge of K_s and assures B that this is a fresh message because of the use of the nonce N_s. Recall from our discussion in Chapter 14 that the purpose of steps 4 and 5 is to prevent a certain type of replay attack. In particular, if an opponent is able to capture the message in step 3 and replay it, this might in some fashion disrupt operations at B.

Suppose that an opponent, X, has been able to compromise an old session key. Admittedly, this is a much more unlikely occurrence than that an opponent has simply observed and recorded step 3.  It is a potential security risk. X can impersonate A and trick B into using the old key by simply replaying step 3. Unless B remembers indefinitely all previous session keys used with A, B will be unable to determine that this is a replay. If X can intercept the handshake message in step 4, then it can impersonate A’s response in step 5. From this point on, X can send bogus messages to B that appear to B to come from A using an authenticated session key.

Denning [DENN81, DENN82] proposes to overcome this weakness by a modification to the Needham/Schroeder protocol that includes the addition of a timestamp to steps 2 and 3. Her proposal assumes that the master keys, K_a and K_b, are secure, and it consists of the following steps.

T is a timestamp that assures A and B that the session key has only just been generated. Thus, both A and B know that the key distribution is a fresh exchange. A and B can verify timeliness by checking that

|Clock – T| < ∆t₁ + ∆t₂

where ∆t₁ is the estimated normal discrepancy between the KDC’s clock and the local clock (at A or B) and ∆t₂ is the expected network delay time. Because the timestamp T is encrypted using the secure master keys, an opponent, even with knowledge of an old session key, cannot succeed because a replay of step 3 will be detected by B as untimely.

Suppress replay attack

• The Denning protocol requires reliance on clocks that are synchronized throughout the network
• A risk involved is based on the fact that the distributed clocks can become unsynchronized as a result of sabotage on or faults in the clocks or the synchronization mechanism
• The problem occurs when a sender’s clock is ahead of the intended recipient’s clock
  • An opponent can intercept a message from the sender and replay it later when the timestamp in the message becomes current at the recipient’s site
  • Such attacks are referred to as suppress-replay attacks

Coping with Suppress replay attack

One way to counter suppress-replay attacks is to enforce the requirement that parties regularly check their clocks against the KDC’s clock. The other alternative, which avoids the need for clock synchronization, is to rely on handshaking protocols using nonces.

One Way Authentication

Using symmetric encryption, the decentralized key distribution. This scheme requires the sender to issue a request to the intended recipient, await a response that includes a session key, and only then send the message.

 For a message with content M, the sequence is as follows

This approach guarantees that only the intended recipient of a message will be able to read it. It also provides a level of authentication that the sender is A. As specified, the protocol does not protect against replays. Some measure of defense could be provided by including a timestamp with the message. However, because of the potential delays in the email process, such timestamps may have limited usefulness.

Also Read: Overview of Remote User Authentication Principles