Beyond Authentication Don’t Trust, Just Verify

9
1 Beyond Authentication Don’t Trust, Just Verify Eran Tromer BRCMF Inaguration Ceremony 21 Nov

TAGS:

description

Beyond Authentication Don’t Trust, Just Verify. Eran Tromer. BRCMF Inaguration Ceremony 21 Nov 2013. Talking about…. Chinese counterfeit chips causing military hardware crashes […] - PowerPoint PPT Presentation

Transcript of Beyond Authentication Don’t Trust, Just Verify

Page 1: Beyond Authentication Don’t Trust, Just Verify

1

Beyond AuthenticationDon’t Trust, Just Verify

Eran Tromer

BRCMF Inaguration Ceremony 21 Nov 2013

Page 2: Beyond Authentication Don’t Trust, Just Verify

2

Talking about…

• Principles

authenticating users

trusting devices

Chinese counterfeit chips causing

military hardware crashes

[…]

Component failure reports from

defense contractors worldwide,

including Boeing, Raytheon, BAE,

Northrop Grumman, and Lockheed

[…] and investigations have turned up

a significant number of counterfeit

parts, sometimes installed in mission-

critical systems.

• People

• Things

Page 3: Beyond Authentication Don’t Trust, Just Verify

3

Side-channel leakageEven if the software and hardware function correctly…

electromagnetic acoustic

probing

microarchitecture

optical

power

Page 4: Beyond Authentication Don’t Trust, Just Verify

4

Talking about…

policies and algorithms

authenticating users

trusting devices

• People

• Things

• Principles

Page 5: Beyond Authentication Don’t Trust, Just Verify

5

The challenge

Create general techniques toensure integrity and confidentiality

in computation done bycomponents and parties that are

untrustworthy,faulty, leaky

&malicious.

The approach: modern cryptography

Page 6: Beyond Authentication Don’t Trust, Just Verify

6

Integrity of computation: SNARKs(Succint Noninteractive Arguments of Knowledge)

v=DB[x];w=func(v,y);return z;x

zproof

Current prototype:The correct execution of arbitrary C programs can be

verified in 5 milliseconds using 230-byte proofs.

Verify

DB,y

Page 7: Beyond Authentication Don’t Trust, Just Verify

7

Integrity via Proof-Carrying Data

m1

m2

m5

m6

• Diverse network, containing untrustworthy parties and unreliable components.

• Impractical to verify internals of each node, so give up.• Enforce only correctness of the messages and ultimate

results.

m3

m 4

m 7

mout

Page 8: Beyond Authentication Don’t Trust, Just Verify

8

Integrity via Proof-Carrying Data (cont.)

m1

1

m2

2

m 4

4

m5

5

m6

6

m 7

7

mout

out

m3

3

• Every message is augmented with a proof attesting to its compliance” with a prescribed policy.

• Compliance can express any property that can be verified by locally checking every node.

• Proofs can be verified efficiently and retroactively.

Page 9: Beyond Authentication Don’t Trust, Just Verify

9

Proof-Carrying DataIntegrity for distributed computation

Implementation underway.

Seeking practical impact.


Login to the Clinical Portal Using Multi-Factor Authentication · Multi-Factor Authentication (MFA) adds another layer of security to verify a user’s identity by combining two factors

Login to the Clinical Portal Using Multi-Factor Authentication · Multi-Factor Authentication (MFA) adds another layer of security to verify a user’s identity by combining two factors

eID Security - OECD.org - OECD › mena › governance › 41842762.pdf · 2016-03-29 · with eID Authentication certificate “Challenge” to verify Client Identity (3) Encrypt

eID Security - OECD.org - OECD › mena › governance › 41842762.pdf · 2016-03-29 · with eID Authentication certificate “Challenge” to verify Client Identity (3) Encrypt

SRV314 securing serverless · Amazon API Gateway AWS Lambda Amazon RDS (Aurora MySQL) 3rdparty Client Amazon Cognito authentication AWS Lambda (Custom authorizer) Verify access token

SRV314 securing serverless · Amazon API Gateway AWS Lambda Amazon RDS (Aurora MySQL) 3rdparty Client Amazon Cognito authentication AWS Lambda (Custom authorizer) Verify access token

A Collaborative Framework: for Privacy Protection in Online Social … · 2020. 7. 10. · Authentication, OSN can verify the validity of the user's access permission for a private

A Collaborative Framework: for Privacy Protection in Online Social … · 2020. 7. 10. · Authentication, OSN can verify the validity of the user's access permission for a private

SUMMIT CHAIRS’ MESSAGE FOR ATTENDEES...When choosing new authentication methods, first, carefully evaluate the authentication strength — don’t just count authentication factors!

SUMMIT CHAIRS’ MESSAGE FOR ATTENDEES...When choosing new authentication methods, first, carefully evaluate the authentication strength — don’t just count authentication factors!

Software-Optimized Universal Hashing and Message Authentication …fastcrypto.org/umac/umac_thesis.pdf · 2013-06-21 · and authentication tag can verify the message up to a level

Software-Optimized Universal Hashing and Message Authentication …fastcrypto.org/umac/umac_thesis.pdf · 2013-06-21 · and authentication tag can verify the message up to a level

LAW AND PUBLIC SAFETY  · Web view"Game Authentication Terminal" or "GAT" means an external application that is used to verify Division approved software. ... loss of power, ...

LAW AND PUBLIC SAFETY  · Web view"Game Authentication Terminal" or "GAT" means an external application that is used to verify Division approved software. ... loss of power, ...

FACT SHEET Promoting Caller ID Authentication to Combat ... · Caller ID authentication technology enables voice service providers to verify that the caller ID information transmitted

FACT SHEET Promoting Caller ID Authentication to Combat ... · Caller ID authentication technology enables voice service providers to verify that the caller ID information transmitted

Information Security Branch Office of the CIO, Province of BC · • Testing of network access controls to verify correct implementation; and, ... identification and authentication

Information Security Branch Office of the CIO, Province of BC · • Testing of network access controls to verify correct implementation; and, ... identification and authentication

Blockchains Regtech for Security Token Offerings and · Authentication Provide a login using a PASS Verify™ crypto-account Use-cases for PASS Verify™ Security If you are a developer

Blockchains Regtech for Security Token Offerings and · Authentication Provide a login using a PASS Verify™ crypto-account Use-cases for PASS Verify™ Security If you are a developer

Outline User authentication –Password authentication, salt –Challenge-response authentication protocols –Biometrics –Token-based authentication Authentication.

Outline User authentication –Password authentication, salt –Challenge-response authentication protocols –Biometrics –Token-based authentication Authentication.

How to Verify Your Softwaresuccessfully verify highly concurrent code (100KLOC, mostly from products) • if you don’t know , you should (especially if you want to build tools) •

How to Verify Your Softwaresuccessfully verify highly concurrent code (100KLOC, mostly from products) • if you don’t know , you should (especially if you want to build tools) •

Public-Key Cryptosystems...Public Key Cryptography •PKC also solves the message source authentication problem: •Only Alice can “sign” a message, using K. •Anyone can verify

Public-Key Cryptosystems...Public Key Cryptography •PKC also solves the message source authentication problem: •Only Alice can “sign” a message, using K. •Anyone can verify

Authentication On-Boarding. Aadhaar Authentication Enrolment Aadhaar Generation Update Secure Aadhaar Authentication Framework Aadhaar Authentication.

Authentication On-Boarding. Aadhaar Authentication Enrolment Aadhaar Generation Update Secure Aadhaar Authentication Framework Aadhaar Authentication.

UNIX Authentication and Pluggable-authentication Modules ... · UNIX Authentication and Pluggable-authentication Modules (PAMs) Russell Bateman Description of UNIX authentication,

UNIX Authentication and Pluggable-authentication Modules ... · UNIX Authentication and Pluggable-authentication Modules (PAMs) Russell Bateman Description of UNIX authentication,

Don’t Be A Phish – Deep Dive Into E-mail Authentication ... · Don’t Be A Phish – Deep Dive Into E-mail Authentication Techniques BRKSEC-3770 Hrvoje Dogan, Security Solutions

Don’t Be A Phish – Deep Dive Into E-mail Authentication ... · Don’t Be A Phish – Deep Dive Into E-mail Authentication Techniques BRKSEC-3770 Hrvoje Dogan, Security Solutions

RESEARCH ARTICLE Evaluation of Authentication …Authentication Center (AUC): Authentication Center where all authentication algorithms are defined. The Authentication Centre (AUC)

RESEARCH ARTICLE Evaluation of Authentication …Authentication Center (AUC): Authentication Center where all authentication algorithms are defined. The Authentication Centre (AUC)

David Piper - How to never use WebDriver againaadays.pl/wp-content/uploads/2017/10/David-Piper-How-to...Authentication No support intended for authentication. You don’t want to bake

David Piper - How to never use WebDriver againaadays.pl/wp-content/uploads/2017/10/David-Piper-How-to...Authentication No support intended for authentication. You don’t want to bake

. Define authentication Authentication credentials Authentication models Authentication servers Extended authentication protocols Virtual.

. Define authentication Authentication credentials Authentication models Authentication servers Extended authentication protocols Virtual.

CCNP - Routing and SwitchingPage 5 CCNP – Routing and Switching Describe, configure, and verify BGP peer relationships and authentication o Peer group o Active, passive o States

CCNP - Routing and SwitchingPage 5 CCNP – Routing and Switching Describe, configure, and verify BGP peer relationships and authentication o Peer group o Active, passive o States