Abstract

Can we secure user authentication against eavesdropping adversaries, relying on human cognitive functions alone, unassisted by any external computational device? To accomplish this goal, we propose challenge response protocols that rely on a shared secret set of pictures. Under the considered brute-force attack the protocols are safe against eavesdropping, in that a modestly powered adversary who fully records a series of successful interactions cannot compute the user’s secret. Moreover, the protocols can be tuned to any desired level of security against random guessing, where security can be traded-off with authentication time. The proposed protocols have two drawbacks: First, training is required to familiarize the user with the secret set of pictures. Second, depending on the level of security required, entry time can be significantly longer than with alternative methods. We describe user studies showing that people can use these protocols successfully, and quantify the time it takes for training and for successful authentication. We show evidence that the secret can be maintained for a long time (up to a year) with relatively low loss. 1.

Citations

121	Déjà Vu: User study using images for authentication - Dhamija, Perrig - 2000
69	Secure human identification protocols - Hopper, Blum
64	On user choice in graphical password schemes - Davis, Monrose, et al. - 2004
37	Graphical dictionaries and the memorable space of graphical passwords - Thorpe, Oorschot - 2004
34	Graphical Passwords: A Survey - Suo, Zhu, et al. - 2005
29	Human-computer cryptography: An attempt - Matsumoto - 1996
22	Passwords you’ll never forget, but can’t recall - Weinshall, Kirkpatrick - 2004
6	Secure humancomputer identification (interface) systems against peeping attacks: SecHCI. IACR’s Cryptology ePrint Archive: Report 2005/268 - Li, Shum - 2005
1	Cognitive authentication schemes for unassisted humans, safe against spyware - Weinshall