TWC: Small: Noisy Secrets as Alternatives to Passwords and PKI

TWC：小：嘈杂的秘密作为密码和 PKI 的替代品

• 批准号: 1422965
• 负责人: Leonid Reyzin
• 金额: $ 49.97万
• 依托单位: Trustees of Boston University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-07-01 至 2019-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1422965&HistoricalAwards=false
• 关键词: TWC; Small; Noisy; Secrets; Alternatives

In order to establish a secure communication channel, each communicating party needs some method to authenticate the other, lest it unwittingly establish a channel with the adversary instead. Current techniques for authentication often rely on passwords and/or the public-key infrastructure (PKI). Both of these methods have considerable drawbacks since passwords are frequently breached, and PKI relies on central authorities which have proven to be less than reliable. Thus there is a need to use other sources of information for the communicating parties to authenticate each other. Such information should be at least partially unavailable to the adversary since the adversary can pretend to be one of the parties. Many natural sources of such information such as visual passwords or physical tokens are noisy, and don't give the same result each time they are accessed. This project investigates new techniques for using realistic noisy sources in authentication, without necessarily reconciling the values. It combines ideas from a variety of related lines of research, including information reconciliation, secure computation, password-based key agreement, program obfuscation, and locality-sensitive hashing. If successful, it will lead to better authentication solutions than are currently deployed. The investigators have contributed to standardization work in professional organizations like IEEE and ITEF, and have collaborated with industry.

为了建立一个安全的通信信道，每一个通信方都需要某种方法来验证另一个，以免它无意中与对手建立一个信道。 目前的认证技术往往依赖于密码和/或公钥基础设施。这两种方法都有相当大的缺点，因为密码经常被破坏，公钥基础设施依赖于中央机构，而中央机构已被证明不太可靠。因此，需要使用其他信息源来使通信方相互认证。这种信息至少应部分不为对手所知，因为对手可以假装是当事方之一。这些信息的许多自然来源（如视觉密码或物理令牌）都是嘈杂的，并且每次访问时都不会给出相同的结果。这个项目研究了在认证中使用真实噪声源的新技术，而不必协调值。它结合了各种相关研究领域的思想，包括信息协调、安全计算、基于密码的密钥协商、程序混淆和位置敏感哈希。如果成功，它将带来比目前部署的更好的身份验证解决方案。研究人员为IEEE和ITEF等专业组织的标准化工作做出了贡献，并与行业合作。