Authentication: From Passwords to Public Keys
暫譯: 身份驗證：從密碼到公鑰

Richard E. Smith

Authentication: From Passwords to Public Keys
  • 出版商: Addison Wesley
  • 出版日期: 2001-10-11
  • 售價: $2,220
  • 貴賓價: 9.5 折 $2,109
  • 語言: 英文
  • 頁數: 576
  • 裝訂: Paperback
  • ISBN: 0201615991
  • ISBN-13: 9780201615999

    • 已過版

買這商品的人也買了...

商品描述

Table of Contents

Preface.

What This Book Is About.
Who This Book Is For.
Acknowledgments.


1. The Authentication Landscape.

A Very Old Story.
Elements of an Authentication System.
Revised Attacks and Revised Defenses.
Security Strategies.

Authentication in Timesharing Systems.
Passwords Under Attack.
Hashed Passwords.

Attacking the Secret.
Guessing Attacks.
Social Engineering.

Sniffing Attacks.
Sniffing in Software.
Trojan Login.
Van Eck Sniffing.

Authentication Factors.
Judging Attack Prevalence.
Summary Tables.


2. Evolution of Reusable Passwords.

Passwords: Something You Know.
Authentication and Base Secrets.
Cultural Authentication.
Random Secrets.

The Unix Password System .
Attacking the Unix Password File .
The M-209 Hash.
The DES Hash.

Dictionary Attacks.
The Internet WorM.
Resisting Guessing Attacks.
Randomness and Bit Spaces.
Biases in Base Secrets.
Average Attack Space.

Summary Tables.


3. Integrating People.

Roles People Play.
Insiders and Outsiders.
Users and Administrators.
Carriers and Crackers.

Enrolling Users.
Self-Authentication.
Enrollment in Person.

Assigning an Initial Secret.
Random Secret.
Cultural Secret.
Changing the Initial Password.

Entropy and User Password Selection.
Statistical Bias in Text.
Dictionary Attacks.
Estimating Bias in Password Selection.

Restricting Password Selection.
Therapeutic Password Cracking.
Automatic Password Generation.
Proactive Password Checking.
Limitations on Password Strength.

Summary Tables.


4. Design Patterns.

Patterns in Authentication Systems.
The Role of Physical Security.
Protecting Software Authentication.
Protecting Workstations.
Hardware Protection of Authentication.

Administrative Requirements.
Physical Protection.
Ease of Authentication.
Efficient Administration.

Local Authentication.
Direct Authentication.
Indirect Authentication.
Authentication Protocols.
Indirect Authentication Protocols.

Off-Line Authentication.
Applying the Patterns.
Summary Tables.


5. Local Authentication.

Laptops and Workstations.
Workstation Encryption.
File Encryption.
Volume Encryption.

Encryption for Data Protection.
Shortcut Attacks on Encryption.
Trial-and-Error Attacks on Encryption.
Theoretical Guess-Rate Limitations.

Key-Handling Issues.
Memorized Keys.
Key-Handling Policies.
Key Escrow and Crypto Politics.

Summary Tables.


6. Picking PINs and Passwords.

Password Complexity.
Passwords and Usability.
Forcing Functions and Mouse Pads.

Different Secrets for Different Uses.
Sniffable Passwords.
PIN Applications.
Internal Passwords.
External Passwords.

Improving Internal Password Entry.
Operator-Controlled Password Display.
Report Incorrect User Names.
Allow Many Password Guesses.
Report Incorrect Password Attempts.
Avoid Periodic Password Changes.

Password Selection.
Internal Passwords.
External and Administrative Passwords.

Shared Passwords.
Multiple-Use Passwords.
Password Delegation.

Storing Written Passwords.
Physical Custody.
Locked Storage.
Electronic Storage.

Sequences and Groups of Passwords.
Password Sequences.
Forward Secrecy With Theme Words.
Passwords From Songs and Poems.

Summary Tables.


7. Biometrics.

Biometrics: Something You Are.
Promise and Reality.
Uses of Biometrics.

Biometric Techniques.
Measuring Physical Traits.
Measuring Behavioral Traits.

How Biometrics Work.
Taking a Biometric Reading.
Feedback During Biometric Input.
Forging a Physical Trait.

Building and Matching Patterns.
Example: A Trivial Hand Geometry Biometric.
Enrolling a User.

Biometric Accuracy.
Trading Off Usability and Security.
Average Attack Space.

Biometric Encryption.
Preserving Secrecy.
Authenticity of Biometric Data.
The Problem of Biometric Exploitation.

Summary Tables.


8. Authentication by Address.

Who Versus Where.
Telephone Numbers as Addresses.
Identification via Dial-Back.
Dial-Up Identification: Caller ID.

Network Addresses.
Addressing on the ARPANET.
Internet Protocol Addresses.

Attacks on Internet Addresses.
IP Address Theft.
Denial of Service Attacks.

Effective Source Authentication.
Unix Local Network Authentication.
The “Commands” .
Remote Procedure Calls, NFS, and NIS.

Authenticating a Geographical Location.
Summary Tables.


9. Authentication Tokens.

Tokens: Something You Have.
Passive Tokens.
Active Tokens.

Network Password Sniffing.
One-Time Passwords.
Counter-Based One-Time Passwords.
Clock-Based One-Time Passwords.

Attacks on One-Time Passwords.
Man in the Middle Attack.
IP Hijacking.

Incorporating a PIN.
PIN Appended to an External Password.
PIN as an Internal Password.
PIN as Part of the Base Secret.

Enrolling Users.
Summary Tables.


10. Challenge Response Passwords.

Challenge Response.
Challenge Response and X.
S/Key Authentication.

Challenge Response Issues.
User Interaction.
Known Ciphertext Attack on ANSI X9.9.

Password Token Deployment.
Soft Tokens.
Handling Multiple Servers.
Proprietary Implementations.

Evolving Windows Authentication.
LANMAN Hashing.
Attacking the LANMAN Hash.
Plaintext Passwords on Windows.

Windows Challenge Response.
Attacking Windows Challenge Response.

Windows NTLM Authentication.
Attacking the NT Password Database.
Attacking NTLM Challenge Response.

Summary Tables.


11. Indirect Authentication.

Indirect Authentication.
Network Boundary Control.
One-Time Password Products.
LAN Resource Control.

RADIUS Protocol.
A RADIUS Logon.
Protecting RADIUS Messages.
RADIUS Challenge Response.

Encrypted Connections and Windows NT.
Encrypted Connections.
Integrity Protection.
Politics, Encryption, and Technical Choices.

Windows NT Secure Channels.
Secure Channel Keying.
Attacks on Secure Channels.

Computers' Authentication Secrets.
Summary Tables.


12. Kerberos and Windows 2000.

The Key Distribution Center.
Tickets.
Needham-Schroeder.

Kerberos.
The Authentication Server.
Authenticating to a Server.
Ticket-Granting Service.

User and Workstation Authentication.
Workstation Authentication.
Preauthentication.

Ticket Delegation.
Proxiable TGT.
Forwardable TGT.
Realms and Referral Tickets.

Attacking a Kerberos Network.
Intrusion Tolerance.
Clock Synchronization.

Kerberos in Windows 2000.
Master Keys and Workstation Authentication.
Service and Proocol Support.

Summary Tables.


13. Public Keys and Off-Line Authentication.

Public Key Cryptography.
The RSA Public Key Algorithm.
Attacking RSA.
Attacking RSA Keys.
Attacking Digital Signatures.

The Digital Signature Standard.
Challenge Response Revisited.
LOCKOut Fortezza Authentication Protocol.
FIPS 196 Authentication.

Secure Sockets Layer.
Establishing Keys with SSL.
Authentication with Typical SSL.
SSL Client Authentication.

Public Keys and Biometrics.
Summary Tables.


14. Public Key Certificates.

Tying Names to Public Keys.
Certificate Authorities.
Using the Right Certificate.

Creating Certificates.
Certificate Standards.
Certificates and Access Control.

Certificate Authorities.
Proprietors as Certificate Authorities.
Commercial Certificate Authorities.

Public Key Infrastructure.
Centralized Hierarchy.
Authority Lists.
Cross-Certification.

Personal Certification.
Certified by Reputation.
Certified by a Web of Trust.

Certificate Revocation.
Certificate Revocation List.
On-line Revocation.
Timely Certification.

Certificates with Kerberos.
Summary Tables.


15. Private Key Security.

Generating Private Keys.
The Private Key Storage Problem.
Smart Cards and Private Keys.
Off-Card Key Generation.
On-Card Key Generation.

Smart Card Access Control.
PINs.
Biometrics.

Private Keys on Servers.
Novell NetWare: Key Downloading.
Safeword Virtual Smart Card: Data Uploading.

Passwords Revisited.
Summary Tables.


Notes.
Bibliography.
Web and Vendor Resources.
Glossary.

商品描述(中文翻譯)

目錄

前言
本書的內容
本書的讀者
致謝

1. 認證的現狀
一個非常古老的故事
認證系統的要素
修訂的攻擊與修訂的防禦
安全策略
時分系統中的認證
密碼受到攻擊
雜湊密碼
攻擊秘密
猜測攻擊
社會工程
嗅探攻擊
軟體中的嗅探
木馬登錄
范艾克嗅探
認證因素
評估攻擊的普遍性
摘要表

2. 可重用密碼的演變
密碼：你所知道的東西
認證與基本秘密
文化認證
隨機秘密
Unix 密碼系統
攻擊 Unix 密碼檔
M-209 雜湊
DES 雜湊
字典攻擊
網際網路蠕蟲
抵抗猜測攻擊
隨機性與位元空間
基本秘密中的偏差
平均攻擊空間
摘要表

3. 整合人員
人員所扮演的角色
內部人與外部人
使用者與管理員
攜帶者與破解者
註冊使用者
自我認證
親自註冊
分配初始秘密
隨機秘密
文化秘密
更改初始密碼
熵與使用者密碼選擇
文本中的統計偏差
字典攻擊
估算密碼選擇中的偏差
限制密碼選擇
治療性密碼破解
自動密碼生成
主動密碼檢查
密碼強度的限制
摘要表

4. 設計模式
認證系統中的模式
物理安全的角色
保護軟體認證
保護工作站
認證的硬體保護
管理要求
物理保護
認證的便利性
高效的管理
本地認證
直接認證
間接認證
認證協議
間接認證協議
離線認證
應用模式
摘要表

5. 本地認證
筆記型電腦與工作站
工作站加密
檔案加密
磁碟區加密
數據保護的加密
對加密的捷徑攻擊
對加密的試錯攻擊
理論猜測率的限制
密鑰處理問題
記憶密鑰
密鑰處理政策
密鑰保管與加密政治
摘要表

6. 選擇 PIN 碼與密碼
密碼的複雜性
密碼與可用性
強制功能與滑鼠墊
不同用途的不同秘密
可嗅探的密碼
PIN 應用
內部密碼
外部密碼
改善內部密碼輸入
操作員控制的密碼顯示
報告不正確的使用者名稱
允許多次密碼猜測
報告不正確的密碼嘗試
避免定期更改密碼
密碼選擇
內部密碼
外部與管理密碼
共享密碼
多用途密碼
密碼委派
存儲書面密碼
實體保管
鎖定存儲
電子存儲
密碼的序列與組合
密碼序列
主題詞的前向保密
來自歌曲與詩的密碼
摘要表

7. 生物識別
生物識別：你所擁有的東西
承諾與現實
生物識別的用途
生物識別技術
測量物理特徵
測量行為特徵
生物識別的工作原理
進行生物識別讀取
生物識別輸入過程中的反饋
偽造物理特徵
建立與匹配模式
範例：一個微不足道的手部幾何生物識別
註冊使用者
生物識別的準確性
可用性與安全性的權衡
平均攻擊空間
生物識別加密
保護秘密
生物識別數據的真實性
生物識別利用的問題
摘要表

8. 通過地址進行認證
誰與哪裡
電話號碼作為地址
通過回撥進行識別
撥號識別：來電顯示
網路地址
ARPANET 上的地址
網際網路協議地址
對網際網路地址的攻擊
IP 地址盜竊
拒絕服務攻擊
有效的來源認證
Unix 本地網路認證
“命令”
遠程過程調用、NFS 和 NIS
認證地理位置
摘要表

9. 認證令牌
令牌：你所擁有的東西
被動令牌
主動令牌
網路密碼嗅探
一次性密碼
基於計數器的一次性密碼
基於時鐘的一次性密碼
對一次性密碼的攻擊
中間人攻擊
IP 劫持
加入 PIN
附加到外部密碼的 PIN
作為內部密碼的 PIN
作為基本秘密的一部分的 PIN
註冊使用者
摘要表

10. 挑戰響應密碼
挑戰響應
挑戰響應與 X
S/Key 認證
挑戰響應問題
使用者互動
對 ANSI X9.9 的已知密文攻擊
密碼令牌部署
軟體令牌
處理多個伺服器
專有實現
演變中的 Windows 認證
LANMAN 雜湊
攻擊 LANMAN 雜湊
Windows 上的明文密碼
Windows 挑戰響應
攻擊 Windows 挑戰響應
Windows NTLM 認證
攻擊 NT 密碼數據庫
攻擊 NTLM 挑戰響應
摘要表

11. 間接認證
間接認證
網路邊界控制
一次性密碼產品
LAN 資源控制
RADIUS 協議
RADIUS 登錄
保護 RADIUS 訊息
RADIUS 挑戰響應
加密連接與 Windows NT
加密連接
完整性保護
政治、加密與技術選擇
Windows NT 安全通道
安全通道密鑰管理
對安全通道的攻擊
計算機的認證秘密
摘要表

12. Kerberos 與 Windows 2000
密鑰分發中心
票據
Needham-Schroeder
Kerberos
認證伺服器
對伺服器的認證
票據授予服務
使用者與工作站認證
工作站認證
預認證
票據委派
可代理的 TGT
可轉發的 TGT
領域與轉介票據
攻擊 Kerberos 網路
入侵容忍
時鐘同步
Windows 2000 中的 Kerberos
主密鑰與工作站認證
服務與協議支持
摘要表

13. 公開密鑰與離線認證
公開密鑰加密
RSA 公開密鑰算法
攻擊 RSA
攻擊 RSA 密鑰
攻擊數位簽名
數位簽名標準
重新檢視挑戰響應
LOCKOut Fortezza 認證協議
FIPS 196 認證
安全套接字層
通過 SSL 建立密鑰
使用典型 SSL 進行認證
SSL 客戶端認證
公開密鑰與生物識別
摘要表

14. 公開密鑰證書
將名稱與公開密鑰綁定
證書授權機構
使用正確的證書
創建證書
證書標準
證書與存取控制
證書授權機構
作為證書授權機構的擁有者
商業證書授權機構
公開密鑰基礎設施
集中式層級
授權列表
交叉認證
個人認證
以聲譽認證

類似商品

最後瀏覽商品 (11)