Tag Info

I believe this is done to illustrate two things. (i) The small probability, that $P$eggy ($P$rover) might be lying. If she really does not know the magic word and $V$ictor ($V$erifier) sees her taking Path $A$, he would always ask her to come back via path $B$, thus the probability of $P$ succeeding when cheating is $0$. However, $ZKP$s usually involve a ...

well, you don't really explain what happens in each step, and how the authentication procedure works, but your first suggestion is at the right direction. However, the impersonator wishes to authenticate himself, so the attack should actually be $1. A \rightarrow E(B) : A, K_{AB}${$N_A$} $2. E(A) \rightarrow B : E(A), K_{AB}${$N_A$} $3. B \rightarrow E(A) : ...

The article tries to illustrate the property that a zero knowledge proof is only convincing to the observer. In other words, the observer would not be able to convince someone else later. It does so by considering the presence of a coin and a video camera: Further notice that if Victor chooses his A's and B's by flipping a coin on-camera, this protocol ...

Keystroke dynamics is indeed a form of biometric recognition that has been studied for a long time. It was already known in the telegraph era: skilled operators could recognize each other's “fist”, similar to recognizing someone's handwriting. As far as I know, this is not precise enough to authenticate someone. A 2005 study by Araújo et al. results in a 96....

There are several protocols actually: SPF Sender Policy Framework is used to verify that the e-mail address used to send the message is valid e.g. if the sender had rights to use the given domain. Recipients can verify this by checking the ips of the agent dropping the mail against the allowed ips listed in the domain DNS records. DKIM DomainKeys Identified ...

Actually, storing an unencrypted password can be OK in certain circumstances, depending on what the password is used for and the threat model you are trying to defend against. In any case, if you are authenticating to a remote system, you probably should be using public-key cryptography instead of a password if you possibly can. Some relevant readings: ...

First, note that a way to perform password authentication, or any kind of user authentication, over a connection is only useful if you assume that the attacker can see the data exchanged over the connection, but not modify the data. If the attacker is a man-in-the-middle who can suppress data between the client and the server or send packets that the ...

If you don't use a secure connection, it is vulnerable to man-in-the-middle attacks, so not secure. If you do use a secure connection, then it is no better than sending the password directly.

The number of digits in such a one-time password is determined by the acceptable risk that an attacker who doesn't receive the verification code will be able to guess it (lucky guess). This risk takes into account several factors: the probability that an attacker will be able to guess; the negative consequences of an correct guess by an attacker; the ...