SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Authentication protocol</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Authentication protocol</span></span>

</h1>

</header>

<p>An <b>authentication protocol</b> is a type of computer <a href="Communications_protocol" class="mw-redirect" title="Communications protocol">communications protocol</a> or <a href="Cryptographic_protocol" title="Cryptographic protocol">cryptographic protocol</a> specifically designed for transfer of <a href="Authentication" title="Authentication">authentication</a> data between two entities. It allows the receiving entity to authenticate the connecting entity (e.g. Client connecting to a Server) as well as authenticate itself to the connecting entity (Server to a client) by declaring the type of information needed for authentication as well as syntax.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> It is the most important layer of protection needed for secure communication within computer networks.

</p>

<div class="mw-heading mw-heading2"><h2 id="Purpose">Purpose</h2></div>

<p>With the increasing amount of trustworthy information being accessible over the network, the need for keeping unauthorized persons from access to this data emerged. Stealing someone's identity is easy in the computing world - special verification methods had to be invented to find out whether the person/computer requesting data is really who he says he is.<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> The task of the authentication protocol is to specify the exact series of steps needed for execution of the authentication. It has to comply with the main protocol principles:

</p>

<ol><li>A Protocol has to involve two or more parties and everyone involved in the protocol must know the protocol in advance.</li>

<li>All the included parties have to follow the protocol.</li>

<li>A protocol has to be unambiguous - each step must be defined precisely.</li>

<li>A protocol must be complete - must include a specified action for every possible situation.</li></ol>

<p>An illustration of password-based authentication using simple authentication protocol:

</p><p>Alice (an entity wishing to be verified) and Bob (an entity verifying Alice's identity) are both aware of the protocol they agreed on using. Bob has Alice's password stored in a database for comparison.

</p>

<ol><li>Alice sends Bob her password in a packet complying with the protocol rules.</li>

<li>Bob checks the received password against the one stored in his database. Then he sends a packet saying "Authentication successful" or "Authentication failed" based on the result.<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup></li></ol>

<p>This is an example of a very basic authentication protocol vulnerable to many threats such as <a href="Eavesdropping" title="Eavesdropping">eavesdropping</a>, <a href="Replay_attack" title="Replay attack">replay attack</a>, <a href="Man-in-the-middle" class="mw-redirect" title="Man-in-the-middle">man-in-the-middle</a> attacks, <a href="Dictionary_attack" title="Dictionary attack">dictionary attacks</a> or <a href="Brute-force_attack" title="Brute-force attack">brute-force attacks</a>. Most authentication protocols are more complicated in order to be resilient against these attacks.<sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Types">Types</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Authentication_protocols_developed_for_PPP_Point-to-Point_Protocol">Authentication protocols developed for PPP <a href="Point-to-Point_Protocol" title="Point-to-Point Protocol">Point-to-Point Protocol</a></h3></div>

<p>Protocols are used mainly by <a href="Point-to-Point_Protocol" title="Point-to-Point Protocol">Point-to-Point Protocol</a> (PPP) servers to validate the identity of remote clients before granting them access to server data. Most of them use a password as the cornerstone of the authentication. In most cases, the password has to be shared between the communicating entities in advance.<sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading4"><h4 id="PAP_-_Password_Authentication_Protocol">PAP - Password Authentication Protocol</h4></div>

<p><a href="Password_Authentication_Protocol" title="Password Authentication Protocol">Password Authentication Protocol</a> is one of the oldest authentication protocols. Authentication is initialized by the client sending a packet with <a href="Credentials" class="mw-redirect" title="Credentials">credentials</a> (username and password) at the beginning of the connection, with the client repeating the authentication request until acknowledgement is received.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup> It is highly insecure because credentials are sent "<a href="Plaintext" title="Plaintext">in the clear</a>" and repeatedly, making it vulnerable even to the most simple attacks like <a href="Eavesdropping" title="Eavesdropping">eavesdropping</a> and <a href="Man-in-the-middle" class="mw-redirect" title="Man-in-the-middle">man-in-the-middle</a> based attacks. Although widely supported, it is specified that if an implementation offers a stronger authentication method, that method <i>must</i> be offered before PAP. Mixed authentication (e.g. the same client alternately using both PAP and CHAP) is also not expected, as the CHAP authentication would be compromised by PAP sending the password in plain-text.

</p>

<div class="mw-heading mw-heading4"><h4 id="CHAP_-_Challenge-handshake_authentication_protocol">CHAP - <a href="Challenge-handshake_authentication_protocol" class="mw-redirect" title="Challenge-handshake authentication protocol">Challenge-handshake authentication protocol</a></h4></div>

<p>The authentication process in this protocol is always initiated by the server/host and can be performed anytime during the session, even repeatedly. The server sends a random string (usually 128B long). The client uses the password and the string received as input to a hash function and then sends the result together with username in plain text. The server uses the username to apply the same function and compares the calculated and received hash. An authentication is successful when the calculated and received hashes match.

</p>

<div class="mw-heading mw-heading4"><h4 id="EAP_-_Extensible_Authentication_Protocol"><a href="Extensible_Authentication_Protocol" title="Extensible Authentication Protocol">EAP - Extensible Authentication Protocol</a></h4></div>

<p>EAP was originally developed for PPP(Point-to-Point Protocol) but today is widely used in <a href="IEEE_802.3" title="IEEE 802.3">IEEE 802.3</a>, <a href="IEEE_802.11" title="IEEE 802.11">IEEE 802.11</a>(WiFi) or <a href="IEEE_802.16" title="IEEE 802.16">IEEE 802.16</a> as a part of <a href="IEEE_802.1x" class="mw-redirect" title="IEEE 802.1x">IEEE 802.1x</a> authentication framework. The latest version is standardized in RFC 5247. The advantage of EAP is that it is only a general authentication framework for client-server authentication - the specific way of authentication is defined in its many versions called EAP-methods. More than 40 EAP-methods exist, the most common are:

</p>

<div class="mw-heading mw-heading3"><h3 id="AAA_architecture_protocols_(Authentication,_Authorization,_Accounting)">AAA architecture protocols (Authentication, Authorization, Accounting)</h3></div>

<p>Complex protocols used in larger networks for verifying the user (Authentication), controlling access to server data (Authorization) and monitoring network resources and information needed for billing of services (Accounting).

</p>

<div class="mw-heading mw-heading4"><h4 id="TACACS,_XTACACS_and_TACACS+"><a href="TACACS" title="TACACS">TACACS</a>, <a href="XTACACS" class="mw-redirect" title="XTACACS">XTACACS</a> and <a href="TACACS%2B" class="mw-redirect" title="TACACS+">TACACS+</a></h4></div>

<p>The oldest AAA protocol using IP based authentication without any encryption (usernames and passwords were transported as plain text). Later version XTACACS (Extended TACACS) added authorization and accounting. Both of these protocols were later replaced by TACACS+. TACACS+ separates the AAA components thus they can be segregated and handled on separate servers (It can even use another protocol for e.g. Authorization). It uses <a href="Transmission_Control_Protocol" title="Transmission Control Protocol">TCP</a> (Transmission Control Protocol) for transport and encrypts the whole packet. TACACS+ is Cisco proprietary.

</p>

<div class="mw-heading mw-heading4"><h4 id="RADIUS"><a href="RADIUS" title="RADIUS">RADIUS</a></h4></div>

<p><a href="Remote_Authentication_Dial-In_User_Service" class="mw-redirect" title="Remote Authentication Dial-In User Service">Remote Authentication Dial-In User Service</a> (RADIUS) is a full <a href="AAA_(computer_security)" class="mw-redirect" title="AAA (computer security)">AAA protocol

</a> commonly used by <a href="ISP" class="mw-redirect" title="ISP">ISPs</a>. Credentials are mostly username-password combination based, and it uses <a href="Network_access_server" title="Network access server">NAS</a> and <a href="User_Datagram_Protocol" title="User Datagram Protocol">UDP</a> protocol for transport.<sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading4"><h4 id="DIAMETER"><a href="DIAMETER" class="mw-redirect" title="DIAMETER">DIAMETER</a></h4></div>

<p><a href="Diameter_(protocol)" title="Diameter (protocol)">Diameter (protocol)</a> evolved from RADIUS and involves many improvements such as usage of more reliable TCP or <a href="SCTP" class="mw-redirect" title="SCTP">SCTP</a> transport protocol and higher security thanks to <a href="Transport_Layer_Security" title="Transport Layer Security">TLS</a>.<sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading3"><h3 id="Other">Other</h3></div>

<div class="mw-heading mw-heading4"><h4 id="Kerberos_(protocol)"><a href="Kerberos_(protocol)" title="Kerberos (protocol)">Kerberos (protocol)</a></h4></div>

<p>Kerberos is a centralized network authentication system developed at <a href="MIT" class="mw-redirect" title="MIT">MIT</a> and available as a free implementation from MIT but also in many commercial products. It is the default authentication method in <a href="Windows_2000" title="Windows 2000">Windows 2000</a> and later. The authentication process itself is much more complicated than in the previous protocols - Kerberos uses <a href="Symmetric_key_cryptography" class="mw-redirect" title="Symmetric key cryptography">symmetric key cryptography</a>, requires a <a href="Trusted_third_party" title="Trusted third party">trusted third party</a> and can use <a href="Public-key_cryptography" title="Public-key cryptography">public-key cryptography</a> during certain phases of authentication if need be.<sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-10" class="reference"><a href="#cite_note-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-11" class="reference"><a href="#cite_note-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="List_of_various_other_authentication_protocols">List of various other authentication protocols</h2></div>

<li><a href="Basic_access_authentication" title="Basic access authentication">Basic access authentication</a></li>

<li><a href="CAVE-based_authentication" title="CAVE-based authentication">CAVE-based authentication</a></li>

<li><a href="Digest_authentication" class="mw-redirect" title="Digest authentication">Digest</a></li>

<li><a href="Host_Identity_Protocol" title="Host Identity Protocol">Host Identity Protocol</a> (HIP)</li>

<li><a href="LAN_Manager" title="LAN Manager">LAN Manager</a></li>

<li><a href="NTLM" title="NTLM">NTLM</a>, also known as NT LAN Manager</li>

<li><a href="OpenID" title="OpenID">OpenID</a> protocol</li>

<li><a href="Password-authenticated_key_agreement" title="Password-authenticated key agreement">Password-authenticated key agreement</a> protocols</li>

<li><a href="Protocol_for_Carrying_Authentication_for_Network_Access" title="Protocol for Carrying Authentication for Network Access">Protocol for Carrying Authentication for Network Access</a> (PANA)</li>

<li><a href="Secure_Remote_Password_protocol" title="Secure Remote Password protocol">Secure Remote Password protocol</a> (SRP)</li>

<li>RFID-Authentication Protocols</li>

<li><a href="Woo_Lam_92_(protocol)" class="mw-redirect" title="Woo Lam 92 (protocol)">Woo Lam 92 (protocol)</a></li>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFDuncan2001" class="citation web cs1">Duncan, Richard (23 October 2001). <a rel="nofollow" class="external text" href="https://www.sans.org/reading-room/whitepapers/authentication/overview-authentication-methods-protocols-118">"An Overview of Different Authentication Methods and Protocols"</a>. <i>www.sans.org</i>. SANS Institute<span class="reference-accessdate">. Retrieved <span class="nowrap">31 October</span> 2015</span>.</cite></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite id="CITEREFShinder2001" class="citation web cs1">Shinder, Deb (28 August 2001). <a rel="nofollow" class="external text" href="https://www.techrepublic.com/article/understanding-and-selecting-authentication-methods/">"Understanding and selecting authentication methods"</a>. <i>www.techrepublic.com</i><span class="reference-accessdate">. Retrieved <span class="nowrap">30 October</span> 2015</span>.</cite></span>

</li>

<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><cite id="CITEREFvan_Tilborg2000" class="citation book cs1">van Tilborg, Henk C.A. (2000). <i>Fundamentals of Cryptology</i>. Massachusetts: Kluwer Academic Publishers. pp. <span class="nowrap">66–</span>67. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>0-7923-8675-2</bdi>.</cite></span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite id="CITEREFSmith1997" class="citation book cs1">Smith, Richard E. (1997). <a rel="nofollow" class="external text" href="https://archive.org/details/internetcryptogr0000smit/page/1"><i>Internet Cryptography</i></a>. Massachusetts: Addison Wesley Longman. pp. <a rel="nofollow" class="external text" href="https://archive.org/details/internetcryptogr0000smit/page/1">1–27</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>0-201-92480-3</bdi>.</cite></span>

</li>

<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text"><cite id="CITEREFHalevi1998" class="citation citeseerx cs1">Halevi, Shai (1998). "Public-key cryptography and password protocols". pp. <span class="nowrap">230–</span>268. <a href="CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.45.6423">10.1.1.45.6423</a></span>.</cite></span>

</li>

<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite id="CITEREFVanek" class="citation web cs1">Vanek, Tomas. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20160304080620/http://data.cedupoint.cz/oppa_e-learning/2_KME/044.pdf">"Autentizacní telekomunikacních a datových sítích"</a> <span class="cs1-format">(PDF)</span>. CVUT Prague. Archived from <a rel="nofollow" class="external text" href="http://data.cedupoint.cz/oppa_e-learning/2_KME/044.pdf">the original</a> <span class="cs1-format">(PDF)</span> on 4 March 2016<span class="reference-accessdate">. Retrieved <span class="nowrap">31 October</span> 2015</span>.</cite></span>

</li>

<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-1/user/guide/acsuserguide/rad_tac_phase.html">"AAA protocols"</a>. <i>www.cisco.com</i>. CISCO<span class="reference-accessdate">. Retrieved <span class="nowrap">31 October</span> 2015</span>.</cite></span>

</li>

<li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><cite id="CITEREFLiu2006" class="citation web cs1">Liu, Jeffrey (24 January 2006). <a rel="nofollow" class="external text" href="http://www.ibm.com/developerworks/wireless/library/wi-diameter/">"Introduction to Diameter"</a>. <i>www.ibm.com</i>. IBM<span class="reference-accessdate">. Retrieved <span class="nowrap">31 October</span> 2015</span>.</cite></span>

</li>

<li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://web.mit.edu/kerberos/">"Kerberos: The Network Authentication Protocol"</a>. <i>web.mit.edu</i>. MIT Kerberos. 10 September 2015<span class="reference-accessdate">. Retrieved <span class="nowrap">31 October</span> 2015</span>.</cite></span>

</li>

<li id="cite_note-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-10">^</a></b></span> <span class="reference-text"><cite id="CITEREFSchneier1997" class="citation book cs1">Schneier, Bruce (1997). <i>Applied Cryptography</i>. New York: John Wiley & Sons, Inc. pp. <span class="nowrap">52–</span>74. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>0-471-12845-7</bdi>.</cite></span>

</li>

<li id="cite_note-11"><span class="mw-cite-backlink"><b><a href="#cite_ref-11">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://srp.stanford.edu/history.html">"Protocols of the Past"</a>. <i>srp.stanford.edu</i>. Stanford University<span class="reference-accessdate">. Retrieved <span class="nowrap">31 October</span> 2015</span>.</cite></span>

</li>

</ol></div></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2024-07-10" href="https://en.wikipedia.org/wiki/?title=Authentication_protocol&oldid=1233799056">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>