Improving the Security and Flexibility of One-Time Passwords by Signature Chains

Biçakci K., BAYKAL N.

Turkish Journal of Electrical Engineering and Computer Sciences, cilt.11, sa.3, ss.223-236, 2003 (SCI-Expanded) identifier

  • Yayın Türü: Makale / Tam Makale
  • Cilt numarası: 11 Sayı: 3
  • Basım Tarihi: 2003
  • Dergi Adı: Turkish Journal of Electrical Engineering and Computer Sciences
  • Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus, TR DİZİN (ULAKBİM)
  • Sayfa Sayıları: ss.223-236
  • Anahtar Kelimeler: Authentication, Hash chain, Network security, One-time password, Public-key authentication protocol, Signature chain
  • İstanbul Teknik Üniversitesi Adresli: Hayır

Özet

While the classical attack of "monitor the network and intercept the password" can be avoided by advanced protocols like SSH, one-time passwords are still considered a viable alternative or a supplement for software authentication since they are the only ones that safeguard against attacks on insecure client machines. In this paper by using public-key techniques we present a method called signature chain alternative to Lamport's hash chain to improve security and flexibility of one-time passwords. Our proposition improves the security because first, like other public-key authentication protocols, the server and the user do not share a secret, thereby eliminating attacks on the server side. Second, from any incorrectly revealed one-time password, unspent passwords cannot be calculated if a signature chain is preferred. Having an infinite length, the chain in our proposition is more flexible and facilitates using the protocol without the complexity of restarting. On the other hand, the disadvantage of signature chain is the longer verification time with respect to hash chain based approaches.