TWC: Small: Noisy Secrets as Alternatives to Passwords and PKI

为了建立一条安全的通信通道，通信双方需要某种方法来验证对方的身份，以免它在无意中与对手建立通道。当前的认证技术通常依赖于密码和/或公钥基础设施(PKI)。这两种方法都有相当大的缺点，因为密码经常被攻破，而PKI依赖已被证明不太可靠的中央当局。因此，需要使用用于通信方的其他信息源来相互认证。这类信息至少应部分不为敌手所掌握，因为敌手可以假装是当事人之一。许多这类信息的自然来源，如视觉密码或物理令牌，都是嘈杂的，每次访问它们时都不会产生相同的结果。本项目研究在身份验证中使用真实噪声源的新技术，而不必协调这些值。它结合了各种相关研究领域的想法，包括信息协调、安全计算、基于密码的密钥协商、程序混淆和位置敏感散列。如果成功，它将带来比目前部署的更好的身份验证解决方案。调查人员为IEEE和ITEF等专业组织的标准化工作做出了贡献，并与业界进行了合作。

In order to establish a secure communication channel, each communicating party needs some method to authenticate the other, lest it unwittingly establish a channel with the adversary instead. Current techniques for authentication often rely on passwords and/or the public-key infrastructure (PKI). Both of these methods have considerable drawbacks since passwords are frequently breached, and PKI relies on central authorities which have proven to be less than reliable. Thus there is a need to use other sources of information for the communicating parties to authenticate each other. Such information should be at least partially unavailable to the adversary since the adversary can pretend to be one of the parties. Many natural sources of such information such as visual passwords or physical tokens are noisy, and don't give the same result each time they are accessed. This project investigates new techniques for using realistic noisy sources in authentication, without necessarily reconciling the values. It combines ideas from a variety of related lines of research, including information reconciliation, secure computation, password-based key agreement, program obfuscation, and locality-sensitive hashing. If successful, it will lead to better authentication solutions than are currently deployed. The investigators have contributed to standardization work in professional organizations like IEEE and ITEF, and have collaborated with industry.