CSEC3616Cybersecurity Engineering

    Authentication, factors and one-time passwords

    The Menezes et al. definition of authentication, the three categories of corroborative evidence and how each one fails, and why multi-factor authentication and one-time passwords only help under the right conditions.

    • State the Menezes et al. definition of authentication and name its three required elements.
    • Classify a given authenticator into possession, inherence or knowledge, and state a lecture-cited weakness of that category.
    • Explain why multi-factor authentication needs factors from different categories, and state two of its limitations.
    • Distinguish static from dynamic one-time passwords, and console login from network login.

    15 min read

    Intuition

    Access control decides what a principal may do, but that decision only means something if the system actually knows who is asking. This page examines authentication itself, properly, for the first time: what evidence counts, and why each kind of evidence has its own way of failing.

    Mechanism

    Per Menezes et al.: authentication is the process whereby one party is assured, through the acquisition of corroborative evidence, of the identity of a second party involved in a protocol, and that the second has actually participated. Three elements are load-bearing here: corroborative evidence, a process between at least two parties, and the second party’s actual involvement and participation, not merely a correct-looking claim of identity. That last element is what rules out a bare replay of stolen credentials counting as successful authentication, a distinction the rest of this week builds directly on.

    Mechanism

    Corroborative evidence falls into three categories:

    • Possession, something the entity has. A physical key, or a phone that receives SMS codes. The obvious failure is loss of the device; a subtler one is that SMS is routed through SS7, the global signalling network, which has known vulnerabilities that let messages be rerouted, so merely possessing a phone number is not as solid a guarantee as it looks.
    • Inherence, something the entity is. Fingerprints, iris, face or voice. Biometric data was once assumed secure because it generally cannot be changed, but that permanence is also the weakness: a standard camera can capture a fingerprint, and forgery via recordings is only getting easier as generative AI and 3D printing improve. Unlike a password, a compromised fingerprint cannot simply be reset.
    • Knowledge, something the entity knows. Passwords and security questions. Databases of cracked passwords already exist, and security questions (“mother’s maiden name,” “first car”) tend to have a small, predictable set of likely answers that vary by culture, and social networks often supply the rest.

    EXTRACTION DEFECT: Figure 15 (an example of capturing a fingerprint with a standard camera) did not survive extraction; the point it illustrated, that fingerprints are not as hard to obtain as their permanence suggests, is stated directly in the text above.

    Threat

    Each category has a specific way it is undermined, on its own: possession by device loss or SS7 rerouting, inherence by capture or forgery of biometric data that can never be reset once compromised, and knowledge by cracked-password databases and predictable security questions. An attacker only has to find the weak point in whichever single category a system relies on.

    Control

    Multi-factor authentication (MFA) raises the bar by requiring evidence from more than one category at once, e.g. two-factor authentication (2FA): a password plus a phone code. This needs a considerably more motivated attacker and stops most broad, untargeted attacks. It does not stop a targeted one: MFA places a bigger onus on the user (psychological acceptability has to be respected, or people route around it), factors from the same category are not guaranteed to add anything (two passwords can both be weak), and social engineering, a phone scam talking someone into reading out both their password and their SMS code, can defeat multiple factors at once regardless of category.

    Mechanism

    MFA is often paired with plausibility checks: a login from a country the user has never used before, a run of failed attempts, or an IP address already flagged for other attacks can trigger a requirement for additional factors, e.g. password, phone code and an emailed access token together. High-value services such as webmail and social networks now treat 2FA as standard.

    Mechanism

    One-time passwords (OTPs) are valid for a single login, which defeats an attacker who has simply captured a password and wants to reuse it. There are two kinds:

    • Static OTP, an indexed list of OTPs handed to the user in advance.
    • Dynamic OTP, generated on a challenge-response basis, so the value depends on the specific challenge presented. Google Authenticator, Microsoft OTP and Yubikey are the lecture’s examples.

    An OTP is itself a possession factor (something the device produces), and combining it with a password gives MFA. A bank requiring an OTP before a high-value transaction is the notes’ own example, often generated in response to a challenge the website itself presents, making the OTP specific to that one transaction.

    Compare

    Participation is guaranteed structurally: someone or something must physically type the password, typically at a keyboard. Even a device built to try passwords automatically over USB is slowed by the deliberate delay UNIX systems insert between login attempts, which limits how fast such an attack can run.

    No physical presence to rely on. Credentials sent over the network can be captured and replayed later, and the system on its own cannot distinguish a real user logging in from malware replaying stored credentials, or an attacker replaying a captured login. This gap is exactly why network authentication needs its own protocols, covered on the next page.

    Exam detail

    When asked to classify an authenticator, name the category and the specific weakness the lecture attaches to it: “possession, but SMS can be rerouted via SS7” earns more than “possession” alone. The same applies to MFA questions: state that the factors must come from different categories, and that social engineering defeats MFA regardless of which categories are combined.

    Recall

    • Authentication (Menezes et al.) requires corroborative evidence, a process between two parties, and the second party’s actual participation, not just a correct-looking claim.
    • Possession, inherence and knowledge each have a specific, lecture-named weakness; none is safe alone.
    • MFA needs different categories combined to add real security, and is still defeated by social engineering.
    • Static OTPs are pre-issued lists; dynamic OTPs are generated per challenge.
    • Console login proves participation physically; network login cannot, which motivates the next page’s challenge-response protocols.

    Source

    Week 7 Notes PDF