Panoramic view across the Narrows and into St. John's harbour

Douglas Stebila

Secure modular password authentication for the web using channel bindings

User interface for Mozilla Firefox extension.
User interface for Mozilla Firefox extension.

Abstract

Secure protocols for password-based user authentication are well-studied in the cryptographic literature but have failed to see wide-spread adoption on the Internet; most proposals to date require extensive modifications to the Transport Layer Security (TLS) protocol, making deployment challenging. Recently, a few modular designs have been proposed in which a cryptographically secure password-based mutual authentication protocol is run inside a confidential (but not necessarily authenticated) channel such as TLS; the password protocol is bound to the established channel to prevent active attacks. Such protocols are useful in practice for a variety of reasons: security no longer relies on users' ability to validate server certificates and can potentially be implemented with no modifications to the secure channel protocol library.

We provide a systematic study of such authentication protocols. Building on recent advances in modelling TLS, we give a formal definition of the intended security goal, which we call mph{password-authenticated and confidential channel establishment} (PACCE). We show generically that combining a secure channel protocol, such as TLS, with a password authentication protocol, where the two protocols are bound together using either the transcript of the secure channel's handshake or the server's certificate, results in a secure PACCE protocol. Our prototype based on TLS is available as a cross-platform client-side Firefox browser extension and a server-side web application which can easily be installed on deployed web browsers and servers.

Keywords: password authentication, Transport Layer Security (TLS), channel binding

Reference

Mark Manulis, Douglas Stebila, Nick Denham. Secure modular password authentication for the web using channel bindings. In Liqun Chen, Chris J. Mitchell, editors, Proc. 1st International Conference on Security Standardisation Research (SSR) 2014, LNCS, vol. 8893, pp. 167-189. Springer, December 2014. Full version published in International Journal of Information Security. © Springer.

Download

Code

BibTeX

Funding

This research was supported by:
  • Australian Research Council (ARC) Discovery Project grant DP130104304
  • German Research Foundation (DFG), project PRIMAKE (MA 4957)