Expansions of CHAP - Modificationless on Its Structures of Packet and Data Exchange

Masaki Inamura

2015

Abstract

I propose new authentication protocols using/unmodifying the structures of packet and data exchange on CHAP (Challenge Handshake Authentication Protocol). CHAP is one of the most popular authentication protocols because of very simple scheme and no vulnerability of its structures of packet and data exchange. Therefore, this protocol is used a lot of services over the Internet as de facto standard. However, unlawful access often happens caused by users’ mistakes of password setting, e.g. password-list-attacks, and proposing/ implementation of other authentication methods without using password are urgent. To solve the problem, I propose new scheme which can send many type of authentication codes using intact CHAP. By using my proposal, other authentication method using password authentication together can be realized with a minimum cost burden.

References

  1. Acharya, S., Polawar, A., and Pawar, P. Y. (2013). Two factor authentication using smartphone generated one time password. IOSR J. Computer Engineering, 11(2):85-90.
  2. Aloul, F. A., Zahidi, S., and El-Hajj, W. (2009). Two factor authentication using mobile phones. In IEEE/ACS International Conference on Computer Systems and Applications - AICCSA 2009, pages 641-644. IEEE press.
  3. Ateniese, G. and Tsudik, G. (1999). Some open issues and new directions in group signatures. In International Conference on Financial Cryptography - FC 7899, volume LNCS 1648, pages 196-211. Springer.
  4. Au, M. H., Susilo, W., Mu, Y., and Chow, S. S. M. (2013). Constant-size dynamic k-times anonymous authentication. IEEE Systems J., 7(2):249-261.
  5. Bellare, M., Desai, A., Jokipii, E., and Rogaway, P. (1997). A concrete security treatment of symmetric encryption. In Annual Symposium on Foundations of Computer Science - FOCS 7897, pages 394-403. IEEE Press.
  6. Boneh, D. and Franklin, M. K. (1999). Anonymous authentication with subset queries (extended abstract). In ACM Conference on Computer and Communications Security - CCS 7899, pages 113-119. ACM.
  7. Camenisch, J., Hohenberger, S., Kohlweiss, M., Lysyanskaya, A., and Meyerovich, M. (2006). How to win the clone wars: Efficient periodic n-times anonymous authentication. IACR Cryptology ePrint Archive, Report 2006/454.
  8. Eldefrawy, M. H., Alghathbar, K., and Khan, M. K. (2011). Otp-based two-factor authentication using mobile phones. In International Conference on Information Technology: New Generations - ITNG 2011, pages 327-331. IEEE press.
  9. Fan, C., Ho, P., and Hsu, R. (2010). Provably secure nested one-time secret mechanisms for fast mutual authentication and key exchange in mobile communications. IEEE/ACM Trans. Networking, 18(3):996-1009.
  10. Hagalisletto, A. M. and Riiber, A. (2007). Using the mobile phone in two-factor authentication. In International Workshop on Security for Spontaneous Interaction - IWSSI 2007.
  11. Hwang, T. and Gope, P. (2014). Provably secure mutual authentication and key exchange scheme for expeditious mobile communication through synchronously one-time secrets. Wireless Personal Communications, 77(1):197-224.
  12. Kilian, J. and Petrank, E. (1998). Identity escrow. In Advances in Cryptology - CRYPTO 7898, volume LNCS 1462, pages 169-185. Springer.
  13. Krawczyk, H., Bellare, M., and Canetti, R. (1997). Hmac: Keyed-hashing for message authentication. Request for Comments, RFC 2104.
  14. Rathgeb, C. and Uhl, A. (2010). Two-factor authentication or how to potentially counterfeit experimental results in biometric systems. In International Conference on Image Analysis and Recognition - ICIAR 2010, volume LNCS 6112, pages 296-305. Springer.
  15. Rogaway, P. and Shrimpton, T. (2004). Cryptographic hashfunction basics: Definitions, implications, and separations for preimage resistance, second-preimage resistance, and collision resistance. In International Workshop on Fast Software Encryption - FSE 2004, volume LNCS 3017, pages 371-388. Springer.
  16. Schneier, B. (2005). Two-factor authentication: Too little, too late. Communications of the ACM, 48(4):136.
  17. Simpson, W. A. (1994). The point-to-point protocol (ppp). Request for Comments, RFC 1661.
  18. Simpson, W. A. (1996). Ppp challenge handshake authentication protocol (chap). Request for Comments, RFC 1994.
  19. Sklavos, N. and Zhang, X. (2007). Wireless Security and Cryptography: Specifications and Implementations. CRC-Press.
  20. Wachsmann, C., Chen, L., Dietrich, K., L öhr, H., Sadeghi, A., and Winter, J. (2010). Lightweight anonymous authentication with tls and daa for embedded mobile devices. In International Conference on Information Security - ISC 2010, volume LNCS 6531, pages 84- 98. Springer.
Download


Paper Citation


in Harvard Style

Inamura M. (2015). Expansions of CHAP - Modificationless on Its Structures of Packet and Data Exchange . In Proceedings of the 1st International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-081-9, pages 213-220. DOI: 10.5220/0005228002130220


in Bibtex Style

@conference{icissp15,
author={Masaki Inamura},
title={Expansions of CHAP - Modificationless on Its Structures of Packet and Data Exchange},
booktitle={Proceedings of the 1st International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2015},
pages={213-220},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0005228002130220},
isbn={978-989-758-081-9},
}


in EndNote Style

TY - CONF
JO - Proceedings of the 1st International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Expansions of CHAP - Modificationless on Its Structures of Packet and Data Exchange
SN - 978-989-758-081-9
AU - Inamura M.
PY - 2015
SP - 213
EP - 220
DO - 10.5220/0005228002130220