SSL/TLS session-aware user authentication revisited

Computers and Security

Volumn 27, Issue 3-4, 2008, Pages 64-70

  Oppliger, Rolf ^a   Hauser, Ralf ^b   Basin, David ^c  

^a eSECURITY Technologies   (Switzerland)

^b PrivaSphere AG   (Switzerland)

^c ETH ZURICH   (Switzerland)

Author keywords

Electronic commerce; Man in the middle attack; Phishing; Security; SSL TLS protocol; SSL TLS session aware user authentication

Indexed keywords

ACCESS CONTROL; AUTHENTICATION; COMMERCE; ELECTRONIC COMMERCE; METROPOLITAN AREA NETWORKS;

BASIC IDEA; COMPUTER COMMUNICATIONS; E-COMMERCE APPLICATIONS; MAN-IN-THE-MIDDLE ATTACK; MITM ATTACKS; PHISHING; SECURITY; SSL/TLS; SSL/TLS PROTOCOL; SSL/TLS SESSION-AWARE USER AUTHENTICATION; USER AUTHENTICATION; USER AUTHENTICATION SYSTEMS;

MOBILE TELECOMMUNICATION SYSTEMS;

EID: 49849096978     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2008.04.005     Document Type: Article

References (15)

1. Burkholder P. SSL man-in-the-middle attacks (February 2002), SANS Reading Room
2. Dierks T, Rescorla E. The TLS protocol version 1.1. RFC 4346; April 2006.
3. Haller N. The S/KEY one-time password system. Request for comments 1760; February 1995.
4. Haller N, Metz C. A one-time password system. Request for comments 1938; May 1996.
5. Jakobsson M., and Myers S. Delayed password disclosure. International Journal of Applied Cryptography 1 1 (2008) 47-59
6. In: Josefsson S. (Ed). The Base16, base32, and base64 data encodings. Request for comments 3548 (July 2003)
7. Krawczyk H, Bellare M, Canetti R. HMAC: keyed-hashing for message authentication. Request for comments 2104; February 1997.
8. Lamport L. Password Authentication with Insecure Communication. Communications of the ACM 24 (1981) 770-772
9. Morris R., and Thompson K. Password security: a case history. Communications of the ACM 22 11 (November 1979) 594-597
10. Molva R., and Tsudik G. Authentication method with impersonal token cards. Proceedings of IEEE symposium on research in security and privacy (May 1993), IEEE Press 56-65
11. Oppliger R., Hauser R., and Basin D. SSL/TLS session-aware user authentication - or how to effectively thwart the man-in-the-middle. Computer Communications 29 12 (August 2006) 2238-2246
12. Oppliger R., Hauser R., Basin D., Rodenhaeuser A., and Kaiser B. A proof of concept implementation of SSL/TLS session-aware user authentication. Proceedings of the 15th GI/ITG conference on "Kommunikation in Verteilten Systemen". KiVS '07, Berne, Switzerland. LNCS (February 26-March 2, 2007), Springer-Verlag, Berlin 225-236
13. Oppliger R., Hauser R., and Basin D. SSL/TLS session-aware user authentication. IEEE Computer 41 3 (March 2008) 59-65
14. Oppliger R., and Hauser R. Protecting TLS-SA implementations for the challenge-response feature of EMV-CAP against challenge collision attacks. Security and Communication Networks 1 2 (2008) 125-134
15. RSA Laboratories. PKCS #11 v2.20: cryptographic token interface standard; June 28, 2004.