HTTP PAKE-based mutual HTTP authentication for preventing phishing attacks

Size: px

Start display at page:

Download "HTTP PAKE-based mutual HTTP authentication for preventing phishing attacks"

Olivia Chambers
7 years ago
Views:

1 All rights are reserved and copyright of this manuscript belongs to the authors. This manuscript have been published without reviewing and editing as received from the authors: posting the manuscript to SCIS 2008 does not prevent future submissions to any journals or conferences with proceedings. SCIS 2008 The 2008 Symposium on Cryptography and Information Security Miyazaki, Japan, Jan , 2008 The Institute of Electronics, Information and Communication Engineers HTTP PAKE-based mutual HTTP authentication for preventing phishing attacks * Hirofumi Suzuki Yutaka Oiwa Hiromitsu Takagi Hajime Watanabe HTTP Mutual Web 1 HTTP Mutual Web Web * Yahoo, ,, Yahoo Japan Corp, Auction division, Roppongi Hills Mori Tower, Roppongi, Minato-ku, Tokyo , JAPAN (hirsuzuk@yahoo-corp.jp) , Research Center for Information Security, National Institute of Advanced Industrial Science and Technology, 1102 Akihabara Daibiru, Sotokanda, Chiyoda-ku, Tokyo JAPAN. 2 (0) (1). ID (2). [7] (3). (0) (1) (4). (0) (1) (0) (2) (1) (2) 1

with proceedings. SCIS 2008 The 2008 Symposium on Cryptography and Information Security Miyazaki, Japan, Jan.

2 (3) (4) [8] Extended Validation SSL (EV SSL ) [4] CA/Browser EV SSL SSL Microsoft Internet Explorer 7 EV SSL EV SSL CA/Browser 3.2 Microsoft Internet Explorer 7 Mozilla Firefox 2 URL Mozilla Microsoft 2006 [9] [10] 66% 81% Firefox petname tool [6] untrusted 3.5 PwdHash PwdHash [5] FQDN (1) (3) (4) (2) 2

3 NIST [12, Appendix A] TLS TLS (1) (3) (4) TLS (2) (2) 4 HTTP (a) (b) (c) (d) (e) (f) Web Web (1) (4) (0) 5 HTTP 5.1 PAKE Web ISO/IEC [1] PAKE (Password Authenticated Key Exchange) Key Agreement Mechanism 3 (KAM3) Web Internet Draft [3] 5.2 3

6 (2) 4 HTTP (a) (b) (c) (d) (e) (f) Web Web (1) (4) (0) 5 HTTP 5.

4 PAKE HTTP Web TLS PAKE HTTP PAKE PAKE (1) HTTP401 GET / HTTP/1.1 Host: HTTP/ Authentication required WWW-Authenticate: Mutual validation=host, realm="protected Contents", stale=0 Content-Type: text/html; charset="iso " Content-Length: xxx <html> (2) realm Hash PAKE weak secret ISO/IEO wa 2 v wb ID sid HTTP401 GET / HTTP/1.1 Host: Authorization: Mutual validation=host, user= foobar, wa=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 4 HTTP/ Authentication required WWW-Authenticate: Mutual sid=yyyyyyyy, wb=zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz, nc-max=1024, nc-window=64, time=300, path= / Content-Length: 0 (3) wb oa3 oa ob ob HTTP200 ob GET / HTTP/1.1 Host: Authorization: Mutual validation=host, user= foobar, sid=yyyyyyyy, nc=0, oa=wwwwwwwwwwwwwwww HTTP/ OK Authentication-Info: Mutual sid=yyyyyyyy, ob=vvvvvvvvvvvvvvvv Content-Type: text/html; charset="iso " Content-Length: xxx <html> 5.4 Web Web HTTP [2] Web Basic Digest Form Basic Digest URL Web URL Form

PAKE weak secret ISO/IEO1770-4 wa 2 v wb ID sid HTTP401 GET / HTTP/1.1 Host: www.example.com Authorization: Mutual validation=host, user= foobar, wa=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 4 HTTP/1.

5 Mutual Mutual HTTP 1 HTTP 200 Optional-WWW-Authenticate HTTP/ OK Optional-WWW-Authenticate: Mutual validation=host, realm="protected Contents", stale=0 Content-Type: text/html; charset="iso " Content-Length: xxx <html> Mutual Optional-WWW-Authenticate 5.5 Web Yahoo! JAPAN HTTP Mutual Mutual Mutual 1 2 Mutual Web Mutual Web Mutual Mutual 1: Form Cookie 5 2:

Content-Type: text/html; charset="iso-8859-1" Content-Length: xxx <html> Mutual

6 Yahoo Japan! HTTP 8.2 Firefox ) Apache) RFCIETF (Internet Engineering Task Force) Internet Draft [3] [1] International Organization for Standardization, "ISO/IEC :2006: Information technology Security techniques Key management Part 4: Mechanisms based on weak secrets", [2] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., and L. Stewart, "HTTP Authentication: Basic and Digest Access Authentication", RFC 2617, June [3] Oiwa, Y., Watanabe, H., Takagi, H., Suzuki, H., "Mutual Authentication Protocol for HTTP", November [4] CA/Browser Forum, "About EV SSL Certificates", [5] Ross,B., Jackson, C., Miyake, N., Boneh, D., C. Mitchell, J., Stronger Password Authentication Using Browser Extensions., Proceedings of the 14th Usenix Security Symposium, [6] Close, T. Petname Tool: Enabling web site recognition using the existing SSL infrastructure, W3C Workshop on Transparency and Usability of Web Authentication, 2006 [7], UFJ,, , 03/15/006.html [8] Brian Krebs, Citibank Phish Spoofs 2-Factor Authentication, , citibank_phish_spoofs_2factor_1.html [9] Mozilla Foundation, "Firefox 2 Phishing Protection Effectiveness Testing," November 14, 2006, [10] Tony Chor, "Anti-Phishing Accuracy Study," IEBlog, Microsoft Cooperation, September 28, /28/ aspx. National Institute of Standards and Technology, "Electronic Authentication Guideline," NIST Special Publication , April csrc.nist.gov/publications/nistpubs/800-63/ SP800-63V1_0_2.pdf. [12] Taylor, D., Wu, T., Mavrogiannopoulos, N., Perrin, T., "Using the Secure Remote Password (SRP) Protocol for TLS Authentication", RFC 5054, 2007.

management Part 4: Mechanisms based on weak secrets", 2006. [2] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., and L.

HTTP Mutual authentication and Web security

HTTP Mutual authentication and Web security Yutaka OIWA SAAG, IETF 80 Prague Web security Its importance no need to say Transaction security (credit card, PayPal etc.) User data privacy Most online consumer