is it too late for pake
play

Is it too late for PAKE? John Engler (UC Berkeley) Chris Karlof - PowerPoint PPT Presentation

Is it too late for PAKE? John Engler (UC Berkeley) Chris Karlof Elaine Shi Dawn Song (Usable Security (PARC) (UC Berkeley) Systems) What is PAKE? Password Authenticated Key Exchange 1 Enter Password 2 Crypto


  1. Is it too late for PAKE? John Engler (UC Berkeley) Chris Karlof Elaine Shi Dawn Song (Usable Security (PARC) (UC Berkeley) Systems)

  2. What is PAKE? ● Password Authenticated Key Exchange 1 Enter Password 2 Crypto Protocol 3 Generate Session Key

  3. Why PAKE? ● Password not transmitted ● Mutual Authentication

  4. T wo Hurdles ● Secure password entry ● Branding and message

  5. Problem: Mimicry Attacks

  6. Possible Solution: Secure UI Rachna, et al. Dynamic Security Skin Login Oiwa, et al. MAP-HTTP's In-chrome Login

  7. Problem: Confusion Attacks

  8. Problem: Branding and Messaging

  9. Conclusion ● More issues remain: – User Training – Implementation – Deployment ● PAKE: Potential benefits but hurdles. ● Full Paper:Firefox implemenation: http://webblaze.cs.berkeley.edu/2009/pake/

Recommend


More recommend