Getting web authentication right a best-case protocol for the remaining life of passwords

Joseph Bonneau

doi:10.1007/978-3-642-25867-1_8

Getting web authentication right a best-case protocol for the remaining life of passwords

Joseph Bonneau

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

We outline an end-to-end password authentication protocol for the web designed to be stateless and as secure as possible given legacy limitations of the web browser and performance constraints of commercial web servers. Our scheme is secure against very strong but passive attackers able to observe both network traffic and the server's database state. At the same time, our scheme is simple for web servers to implement and requires no changes to modern, HTML5-compliant browsers. We assume TLS is available for initial login and no other public-key cryptographic operations, but successfully defend against cookie-stealing and cookie-forging attackers and provide strong resistance to password guessing attacks.

Original language	English (US)
Title of host publication	Security Protocols XIX - 19th International Workshop, Revised Selected Papers
Pages	98-104
Number of pages	7
DOIs	https://doi.org/10.1007/978-3-642-25867-1_8
State	Published - 2011
Event	19th International Security Protocols Workshop - Cambridge, United Kingdom Duration: Mar 28 2011 → Mar 30 2011

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	7114 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Other

Other	19th International Security Protocols Workshop
Country/Territory	United Kingdom
City	Cambridge
Period	3/28/11 → 3/30/11

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-642-25867-1_8

Cite this

Bonneau, J. (2011). Getting web authentication right a best-case protocol for the remaining life of passwords. In Security Protocols XIX - 19th International Workshop, Revised Selected Papers (pp. 98-104). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7114 LNCS). https://doi.org/10.1007/978-3-642-25867-1_8

Getting web authentication right a best-case protocol for the remaining life of passwords. / Bonneau, Joseph.
Security Protocols XIX - 19th International Workshop, Revised Selected Papers. 2011. p. 98-104 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7114 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Bonneau, J 2011, Getting web authentication right a best-case protocol for the remaining life of passwords. in Security Protocols XIX - 19th International Workshop, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 7114 LNCS, pp. 98-104, 19th International Security Protocols Workshop, Cambridge, United Kingdom, 3/28/11. https://doi.org/10.1007/978-3-642-25867-1_8

@inproceedings{b3fa4a1b27ee4cb7bc13151f1aa46ca4,

title = "Getting web authentication right a best-case protocol for the remaining life of passwords",

abstract = "We outline an end-to-end password authentication protocol for the web designed to be stateless and as secure as possible given legacy limitations of the web browser and performance constraints of commercial web servers. Our scheme is secure against very strong but passive attackers able to observe both network traffic and the server's database state. At the same time, our scheme is simple for web servers to implement and requires no changes to modern, HTML5-compliant browsers. We assume TLS is available for initial login and no other public-key cryptographic operations, but successfully defend against cookie-stealing and cookie-forging attackers and provide strong resistance to password guessing attacks.",

author = "Joseph Bonneau",

year = "2011",

doi = "10.1007/978-3-642-25867-1_8",

language = "English (US)",

isbn = "9783642258664",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

pages = "98--104",

booktitle = "Security Protocols XIX - 19th International Workshop, Revised Selected Papers",

note = "19th International Security Protocols Workshop ; Conference date: 28-03-2011 Through 30-03-2011",

}

TY - GEN

T1 - Getting web authentication right a best-case protocol for the remaining life of passwords

AU - Bonneau, Joseph

PY - 2011

Y1 - 2011

N2 - We outline an end-to-end password authentication protocol for the web designed to be stateless and as secure as possible given legacy limitations of the web browser and performance constraints of commercial web servers. Our scheme is secure against very strong but passive attackers able to observe both network traffic and the server's database state. At the same time, our scheme is simple for web servers to implement and requires no changes to modern, HTML5-compliant browsers. We assume TLS is available for initial login and no other public-key cryptographic operations, but successfully defend against cookie-stealing and cookie-forging attackers and provide strong resistance to password guessing attacks.

AB - We outline an end-to-end password authentication protocol for the web designed to be stateless and as secure as possible given legacy limitations of the web browser and performance constraints of commercial web servers. Our scheme is secure against very strong but passive attackers able to observe both network traffic and the server's database state. At the same time, our scheme is simple for web servers to implement and requires no changes to modern, HTML5-compliant browsers. We assume TLS is available for initial login and no other public-key cryptographic operations, but successfully defend against cookie-stealing and cookie-forging attackers and provide strong resistance to password guessing attacks.

UR - http://www.scopus.com/inward/record.url?scp=84855772545&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84855772545&partnerID=8YFLogxK

U2 - 10.1007/978-3-642-25867-1_8

DO - 10.1007/978-3-642-25867-1_8

M3 - Conference contribution

AN - SCOPUS:84855772545

SN - 9783642258664

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 98

EP - 104

BT - Security Protocols XIX - 19th International Workshop, Revised Selected Papers

T2 - 19th International Security Protocols Workshop

Y2 - 28 March 2011 through 30 March 2011

ER -

Getting web authentication right a best-case protocol for the remaining life of passwords

Abstract

Publication series

Other

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this