IMPLEMENTING KERBROS WITH IMAGE BASED AUTHENTICATION TO PROTECT IT FROM "DICTIONARY ATTACK" .

(implementing image as user password rather than textual based pwd.) DICTIONARY ATTACK Dictionary attack is the name for a category of cryptanalysis techniques for recovering user passwords. It is a known fact that the Kerberos protocol is vulnerable to off-line dictionary attacks. A dictionary attack uses a targeted technique of successively trying all the words in an exhaustive list called a dictionary (from a pre-arranged list of values). In contrast with a brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words for example a dictionary (hence the phrase dictionary attack) or a bible etc.

IBA ABSTRACT

Secure environments protect their resources against unauthorized access by enforcing access control mechanisms. So when increasing security is an issue text based passwords are not enough to counter such problems. The need for something more secure along with being user friendly is required. This is where Image Based Authentication (IBA) comes into play. IBA encapsulates Kerberos Protocol, Version 5, and provides clients a completely unique and secured authentication tool to work on. This tool provides a secure channel of communication between the communicating entities. The assortment of image set as client's password aims at thwarting Brute Force attacks, Shoulder attack, and Tempest attack at the client side while the attacks at the server side can be averted by putting into practice Kerberos protocol.

When a user registers on site for the first time, they choose from various categories of images. Each time the user logs in they are presented with a randomly generated grid of images and the user looks for the images that fit their chosen categories and enters the corresponding letters or numbers that appear in the images to form a one-time pass code.

The specific images, their location on the grid and the corresponding alphanumeric characters are different every time, creating a unique pass code for each authentication. All this, while the user only needs to remember a few simple categories of images

WHY IBAThe human brain is naturally better at remembering categories and recognizing images than remembering long strings of random alphanumeric characters.

KERBEROSWikipedia.

DICTIONARY ATTACK :-

Dictionary attack is the name for a category of cryptanalysis techniques for recovering user passwords. It is a known fact that the Kerberos protocol is vulnerable to off-line dictionary attacks. .

The Kerberos AS exchange

The Kerberos AS exchange allows a client C to obtain a Ticket Granting Ticket (TGT) from the Kerberos Key Distribution Center (KDC). The TGT is then used to obtain authentication materials for accessing different services in the network.

The AS exchange consists of the two following messages (simplified):

(1) C -> KDC : C, "krbtgt", Nonce

(2) KDC -> C : K(C, "krbtgt", K1, Nonce ...), TGT K is a cryptographic key derived from the client password P using a well known function that we will call P2K. We have thus K = P2K(P). K(X) denotes the cipher-text encrypted using the key K. The key K is used the encrypt the first component of As reply (message 2) that accompanies the TGT.

The dictionary attack

Dictionary attack is the name for a category of cryptanalysis techniques for recovering user passwords by actively interacting with other entities in the network or by processing a pre-captured data. The most common form of dictionary attack occurs when three conditions are met.

First, when the subject protocol being attacked derives keys directly from passwords, using a known function. Second, when at a certain phase of the subject protocol, a known text message is encrypted using a key directly generated from a password. Finally, when the attacker is able to obtain a copy of the encrypted known text message. Such as by eavesdropping or by provoking the issuance of this message. When these three conditions are met, the attacker can use a list of possible passwords (dictionary) and iteratively create keys using the password-to-key function, then attempt to decrypt the captured message. In order to verify if the guessed password is correct, the attacker checks the result of the decryption. If the known text appears, it indicates that the decryption was successful using the guessed password.

Dictionary attack on Kerberos

The vulnerability of the Kerberos protocol to dictionary attacks has beeing initially documented in in [1] and experimentally proven in [2]. In short, if an attacker can intercept the AS reply message from the KDC to the client, he can perform a dictionary attack that eventually yields to the disclosure of the password of the user to whom the TGT was issued.

Kerberos in deed shows the three characteristics, discussed in the previous section, which indicates vulnerability to dictionary attacks. The first condition is verified since Kerberos derives encryption keys from passwords using a known function (K=P2K(P)). The second condition is also verified since the first component of the AS reply message, K(C, krbtgt, K1, ), is encrypted using a key derived directly from client's password, and contains the know plain text krbtgt. Finally, as Kerberos is an authentication protocol for open systems, it was designed with the assumption that any entity can eavesdrop Kerberos exchanges. Which makes the third condition applicable to Kerberos.

We have thus the three conditions for vulnerability to dictionary attack that we described above satisfied. The attacker can use a dictionary, compute the key from a chosen password using the P2K function, then use the guessed key to decrypt the first component of the AS reply message. In order to verify whether the guess was correct, the attacker checks the decryption output for the string krbtgt.

confient technologies