University of Surrey

Test tubes in the lab Research in the ATI Dance Research

Secure modular password authentication for the web using channel bindings

Manulis, M, Stebila, D, Kiefer, F and Denham, N (2016) Secure modular password authentication for the web using channel bindings International Journal of Information Security, 16 (6). pp. 597-620.

[img]
Preview
Text
Secure.pdf - Version of Record
Available under License : See the attached licence file.

Download (1MB) | Preview
[img]
Preview
Text (licence)
SRI_deposit_agreement.pdf
Available under License : See the attached licence file.

Download (33kB) | Preview
[img] Text
IJIS-D-15-00043R2.pdf - Accepted version Manuscript
Restricted to Repository staff only
Available under License : See the attached licence file.

Download (1MB)

Abstract

Secure protocols for password-based user authentication are well-studied in the cryptographic literature but have failed to see wide-spread adoption on the Internet; most proposals to date require extensive modifications to the Transport Layer Security (TLS) protocol, making deployment challenging. Recently, a few modular designs have been proposed in which a cryptographically secure password-based mutual authentication protocol is run inside a confidential (but not necessarily authenticated) channel such as TLS; the password protocol is bound to the established channel to prevent active attacks. Such protocols are useful in practice for a variety of reasons: security no longer relies on users’ ability to validate server certificates and can potentially be implemented with no modifications to the secure channel protocol library. We provide a systematic study of such authentication protocols. Building on recent advances in modelling TLS, we give a formal definition of the intended security goal, which we call password-authenticated and confidential channel establishment (PACCE). We show generically that combining a secure channel protocol, such as TLS, with a password authentication or password authenticated key exchange protocol, where the two protocols are bound together using the transcript of the secure channel’s handshake, the server’s certificate, or the server’s domain name, results in a secure PACCE protocol. Our prototypes based on TLS are available as a cross-platform client-side Firefox browser extension as well as an Android application and a server-side web application that can easily be installed on servers.

Item Type: Article
Subjects : Computing
Divisions : Faculty of Engineering and Physical Sciences > Computing Science
Authors :
AuthorsEmailORCID
Manulis, MUNSPECIFIEDUNSPECIFIED
Stebila, DUNSPECIFIEDUNSPECIFIED
Kiefer, FUNSPECIFIEDUNSPECIFIED
Denham, NUNSPECIFIEDUNSPECIFIED
Date : November 2016
Identification Number : 10.1007/s10207-016-0348-7
Copyright Disclaimer : © The Author(s) 2016. This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.
Depositing User : Symplectic Elements
Date Deposited : 25 Aug 2016 13:47
Last Modified : 29 Nov 2016 16:02
URI: http://epubs.surrey.ac.uk/id/eprint/811830

Actions (login required)

View Item View Item

Downloads

Downloads per month over past year


Information about this web site

© The University of Surrey, Guildford, Surrey, GU2 7XH, United Kingdom.
+44 (0)1483 300800