3 ms·
This does not do cryptography at all. It authenticates that you know a "password" that the system already has to have to do the auth process. As a result anyone
by anologwintermut 13y ago
This does not do cryptography at all. It authenticates that you know a "password" that the system already has to have to do the auth process. As a result anyone how has your system either has your private keys or can derive them trivially.
- wfn 13y agoIf by 'system' you mean the one the user is authenticating to, then yes, afaik. For one to have data encryption, it'd have to be coupled together with a data encryption solution. If 'system' (in your last sentence) means 'user system' ('has' -> keylogger etc), it's not that simple afaik. There's no way for any eavesdropper (between client and server) to know (from the auth game data the server sends) which parts of the data/exchange signify the password. I think they partly addressed possible password/data correlation attacks over multiple logins -> sets of data, but not sure if in this paper, it's been a while. It's not that trivial as far as I take it.
- anologwintermut 13y agoI meant the former. As far as I recall, the latter may have been possible. Their security model required someone physically authenticate it was a human logging into the system. This was to prevent someone from attaching a computer and using it to fake the responses to the challenges. I assume they were in fact worried it would do so by "learning" the real answer, but I can't recall.