Electronic authentication guideline

Burr, W E; Dodson, D F; Newton, E M; Perlner, R A; Polk, W T; Gupta, S; Nabbus, E A

doi:10.6028/nist.sp.800-63-1

Cited by 83 publications

(135 citation statements)

References 2 publications

(2 reference statements)

Supporting

Mentioning

135

Contrasting

Order By: Relevance

“…In such case, the search space is narrowed to 5 8 ∼ = 2 18 . However, an eight character password has entropy of 18-30 bits [3]. So, the overall system entropy is about 36-48 bits.…”

Section: Security Analysismentioning

confidence: 98%

A bio-cryptographic system based on offline signature images

Eskander

Sabourin

Granger

2014

Information Sciences

View full text Add to dashboard Cite

“…In such case, the search space is narrowed to 5 8 ∼ = 2 18 . However, an eight character password has entropy of 18-30 bits [3]. So, the overall system entropy is about 36-48 bits.…”

Section: Security Analysismentioning

confidence: 98%

A bio-cryptographic system based on offline signature images

Eskander

Sabourin

Granger

2014

Information Sciences

View full text Add to dashboard Cite

“…1) Attack 1: The attacker managed to steal the RFID tag from user U but does not know his password. If the password has 8 randomly generated characters, it may have up to 52 bits of entropy [48]. Therefore, P W = P W with high probability and as a result the decrypted sequences from the database will be different than those used in the enrollment phase of user U for the generation of the shuffled iris pseudo-code I Sh , that is to say SC = SC, SS = SS e K X1 = K X1 .…”

Section: B Estimation Of the Entropy Of The Keymentioning

confidence: 98%

Biometrics-Based Secret Key Agreement by Public Discussion with RFID System

Rodrigues¹,

Masculo

Assis

et al. 2014

2014 International Conference on Cyberworlds

View full text Add to dashboard Cite

Cryptographic keys based on biometrics, besides offering information security and privacy, have the advantage of being strongly linked to the user. Three main techniques use biometric data to obtain cryptographic keys: cryptographic key release, cryptographic key generation and cryptographic key regeneration. The main objectives of these schemes are to ensure revocability and produce keys with high entropy. In this work, we propose a new technique for secret key agreement based on biometrics. Three security factors are used, represented by an iris code, an RFID tag and a password. The use of the protocol for reconciliation between the RFID reader and tag enables the agreement of a symmetric key with high entropy by discarding all the mismatching bits present in genuine samples, while it fails to do so for impostors that are therefore rejected. A new secret key is agreed after every positive authentication, increasing the security of the system. The system was evaluated on the public database ICE2005 and obtained a 270 binary digit cryptographic key with estimated entropy of about 156 bits at 0% False Acceptance Rate (FAR) and 3.68% False Rejection Rate (FRR).

show abstract

“…[8] defines authentication level of assurance (LoA) as the strength of authentication required for a relying party to be assured that an entity is indeed the claimed entity. It is influenced by all the factors directly or indirectly associated to the process, including the method used for identity proofing, the authentication protocol/method used by the underlying authentication service and the environment under which the authentication is performed [4,8,9]. Furthermore, LoA is also influenced by how credentials are managed.…”

Section: Related Workmentioning

confidence: 99%

“…On the other hand, if we choose a more stringent authentication method to match with the authentication requirements related to more sensitive resources, accesses to less sensitive resources will experience unnecessary higher costs in performance and usability. To overcome this limitation, there is a need for the design and development of an adaptive authentication solution that allows the selection of different authentication methods with varying levels of assurance (LoA) [4,6] as matched with resource sensitivity levels at run-time. For doing so, we need to investigate all the authentication models and examine their LoA-effecting attributes to study and quantify their individual LoA impacts to an authentication instance (or event), analyse their inter-relationships and composite effect on the overall LoA (i.e.…”

Section: Introductionmentioning

confidence: 99%

Quantifying authentication Levels of Assurance in grid environments

Yao

Zhang

2010

2010 Sixth International Conference on Information Assurance and Security

View full text Add to dashboard Cite

We envisage a fine-grained access control solution that allows a user's access privilege to be linked to the assurance level in identifying the user. Such a solution would be particularly attractive to a large-scale distributed resourcesharing environment, where resources are likely to be more diversified and may have varying levels of sensitivity and resource providers may wish to adjust security protection levels in adaptation to resource sensitivity levels or the risk levels in the underlying environment. However, existing electronic authentication systems largely identify users through the verification of their electronic identity (ID) credentials. They take into account neither assurance levels of the credentials, nor any other factors that may affect the assurance level of an authentication process. This binary approach to access control may not provide cost-effective protection to resources with varying sensitivity levels. To realise the vision of assurance level linked access control, there is a need for an authentication algorithm that is able to capture the assurance level in identifying a user, expressed as an authentication Level of Assurance (LoA), and link this LoA value to authorisation decision-making. This paper investigates the feasibility of estimating a user's LoA at run-time by designing and evaluating an authentication algorithm that derives a LoA value, based upon not only users' ID credentials, but also other factors such as access location, system environment and authentication protocol used.

show abstract

Electronic authentication guideline

Cited by 83 publications

References 2 publications

A bio-cryptographic system based on offline signature images

A bio-cryptographic system based on offline signature images

Biometrics-Based Secret Key Agreement by Public Discussion with RFID System

Quantifying authentication Levels of Assurance in grid environments

Contact Info

Product

Resources

About