The Experts below are selected from a list of 6828 Experts worldwide ranked by ideXlab platform

Simon Meier - One of the best experts on this subject based on the ideXlab platform.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Journal of Computer Security, 2013
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyze the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of their correctness. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for the falsification and certified verification of security standards. Based on our findings, the ISO working group responsible for the ISO/IEC 9798 standard has released an updated version of the standard.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Journal of Computer Security, 2013
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyze the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of their correctness. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for the falsification and certified verification of security standards. Based on our findings, the ISO working group responsible for the ISO/IEC 9798 standard has released an updated version of the standard.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Principles of Security and Trust, 2012
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyse the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of the correctness of the resulting protocols. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for falsification and certified verification of security standards. The relevance of our findings and recommendations has been acknowledged by the responsible ISO working group and an updated version of the standard will be released.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Principles of Security and Trust, 2012
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyse the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of the correctness of the resulting protocols. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for falsification and certified verification of security standards. The relevance of our findings and recommendations has been acknowledged by the responsible ISO working group and an updated version of the standard will be released.

David Basin - One of the best experts on this subject based on the ideXlab platform.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Journal of Computer Security, 2013
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyze the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of their correctness. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for the falsification and certified verification of security standards. Based on our findings, the ISO working group responsible for the ISO/IEC 9798 standard has released an updated version of the standard.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Journal of Computer Security, 2013
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyze the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of their correctness. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for the falsification and certified verification of security standards. Based on our findings, the ISO working group responsible for the ISO/IEC 9798 standard has released an updated version of the standard.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Principles of Security and Trust, 2012
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyse the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of the correctness of the resulting protocols. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for falsification and certified verification of security standards. The relevance of our findings and recommendations has been acknowledged by the responsible ISO working group and an updated version of the standard will be released.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Principles of Security and Trust, 2012
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyse the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of the correctness of the resulting protocols. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for falsification and certified verification of security standards. The relevance of our findings and recommendations has been acknowledged by the responsible ISO working group and an updated version of the standard will be released.

Prabath Siriwardena - One of the best experts on this subject based on the ideXlab platform.

  • Basic digest Authentication
    2020
    Co-Authors: Prabath Siriwardena
    Abstract:

    HTTP Basic Authentication and Digest Authentication are two Authentication schemes, used for protecting resources on the Web. Both are based on username- and password-based credentials. When trying to log in to a web site, if the browser presents you a dialog box asking your username and password, then most probably this web site is protected with HTTP Basic or digest Authentication. Asking the browser to challenge the user to authenticate is one of the quick and dirty ways of protecting a web site. None or at least very few web sites on the Internet today use HTTP Basic or digest Authentication. Instead, they use a nice form-based Authentication or their own custom Authentication schemes. But still some use HTTP Basic/digest Authentication to secure direct API-level access to resources on the Web.

  • http Basic digest Authentication
    2014
    Co-Authors: Prabath Siriwardena
    Abstract:

    HTTP Basic Authentication and Digest Authentication are popular for protecting resources on the web. Both are based on usernames and passwords. HTTP/1.0 includes the specification for the Basic Access Authentication scheme, which takes the username and password over the network in cleartext. Hence it isn’t considered to be a secured way of authenticating users, unless it’s used over an externally secured system such as Transport Level Security (TLS). RFC 2617 defines the specification for HTTP’s Authentication framework (the original Basic Access Authentication scheme) and Digest Access Authentication, which is based on cryptographic hashes. Unlike Basic Authentication, Digest Authentication doesn’t take the user’s password over the wire in cleartext.

Cas Cremers - One of the best experts on this subject based on the ideXlab platform.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Journal of Computer Security, 2013
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyze the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of their correctness. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for the falsification and certified verification of security standards. Based on our findings, the ISO working group responsible for the ISO/IEC 9798 standard has released an updated version of the standard.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Journal of Computer Security, 2013
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyze the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of their correctness. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for the falsification and certified verification of security standards. Based on our findings, the ISO working group responsible for the ISO/IEC 9798 standard has released an updated version of the standard.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Principles of Security and Trust, 2012
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyse the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of the correctness of the resulting protocols. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for falsification and certified verification of security standards. The relevance of our findings and recommendations has been acknowledged by the responsible ISO working group and an updated version of the standard will be released.

  • provably repairing the iso iec 9798 standard for entity Authentication
    Principles of Security and Trust, 2012
    Co-Authors: David Basin, Cas Cremers, Simon Meier
    Abstract:

    We formally analyze the family of entity Authentication protocols defined by the ISO/IEC 9798 standard and find numerous weaknesses, both old and new, including some that violate even the most Basic Authentication guarantees. We analyse the cause of these weaknesses, propose repaired versions of the protocols, and provide automated, machine-checked proofs of the correctness of the resulting protocols. From an engineering perspective, we propose two design principles for security protocols that suffice to prevent all the weaknesses. Moreover, we show how modern verification tools can be used for falsification and certified verification of security standards. The relevance of our findings and recommendations has been acknowledged by the responsible ISO working group and an updated version of the standard will be released.

Renata Myskova - One of the best experts on this subject based on the ideXlab platform.

  • petri nets based models for Basic Authentication procedure
    COMATIA'10 Proceedings of the 2010 international conference on Communication and management in technological innovation and academic globalization, 2010
    Co-Authors: Jan Capek, Miloslav Hub, Renata Myskova, R Roudny
    Abstract:

    This paper presents results of user name, passwords and keystroke dynamics Authentication research. In this study as a tool was Petri net technique chosen. Experiments were made with two groups of models. One consists of combination of the User name and password with and/or without repeating. The second group consist of the user name, password and keystroke dynamics with and/or without repeating. The goal of this paper is to demonstrate that possibility to repeating leads to decreasing security.

  • Basic Authentication procedure modelled by petri nets
    2010
    Co-Authors: Jan Capek, Miloslav Hub, Renata Myskova
    Abstract:

    This paper presents modelling of the Basic Authentication procedure. The Petri net technique as a tool was chosen in this study. Experiments were made with two groups of models according the quantity of used attributes. One consists of combination of the User name and Password with and/or without repeating. The second group consist of the user name, password and biometrics with and/or without repeating. The goal of this paper is to demonstrate that security increasing with attributes quantity and decreasing with possibility to repeating wrong sequence of symbols.