Extended HTTP Digest Access Authentication

Abstract

Abstract. User authentication to a server is typically done by presenting a username and a password in some protected form to the server, and having the server verify that those credentials correspond to an identity previously registered and authorized for access. It is crucial that attackers never get access to operational passwords, which typically is achieved by encryption in transit, or through a challenge-response protocol between the client and server computer platforms. However, these mechanisms do not protect passwords at the moment when they are entered into the client computer, which leaves the password exposed to attacks by malware on the client. We present a method for protecting passwords from being exposed on client platforms. The method is an extension of the well-known HTTP Digest Access Authentication which is a challenge-response protocol specified as part of HTTP. The method relies on an external mostly offline personal authentication device called OffPAD which communicates with the client platform. We show how the presented authentication scheme increases security as well as enhances usability with regard to identity management. In addition to describing the OffPAD device, we argue that the HTTP Digest Access Authentication standard does not conform to today's best practices, and suggest improvements.

Local user-centric identity management

“…The OffPAD (Offline Personal Authentication Device) described by Klevjer et al [15] and Varmedal et al [16] is an enhanced version of the PAD, where an essential characteristic is to be offline, i.e. not connected to the Internet.…”

“…LastPass), the password is exposed in the computer's memory and is vulnerable to attacks such as key logging or memory inspection. A solution for password authentication using an OffPAD is proposed by Klevjer et al in [15], consisting of an extension to the original HTTP Digest Access Authentication scheme specified as a part of the HTTP standard in [27]. User credentials are stored in a hashed format on both the server and the OffPAD.…”

“…The advantage of our method is that it totally prevents exposure of passwords on potentially vulnerable client platforms, and thereby represents secure local user-centric identity management solution. A proof-ofconcept implementation of the method has been developed for the OffPAD prototype [28].…”

One-Time Biometrics for Online Banking and Electronic Payment Authentication

“…The PAD is the conceptual predecessor to the OffPAD. The OffPAD (Offline Personal Authentication Device) described by Klevjer et al [16] and Varmedal et al [26] is an enhanced version of the PAD, where an essential characteristic is to guarantee offline security (Machine to Machine communications). The OffPAD represents local user-centric identity management because it enables secure and user friendly management of digital identities and credentials locally on the user side.…”

The OffPAD: Requirements and Usage

“…In [17], Klevjer et al describe a more secure PAD, the physically decoupled OffPAD, which supports mutual authentication between user and server, as well as user-centric identity management, i.e. secure and usable management of digital identities and credentials on the OffPAD rather than in the user's brain.…”