TWC: Small: Noisy Secrets as Alternatives to Passwords and PKI

为了建立安全的通信通道，通信双方都需要某种方法来验证对方的身份，以免无意中与对手建立通道。 当前的身份验证技术通常依赖于密码和/或公钥基础设施 (PKI)。这两种方法都有相当大的缺点，因为密码经常被泄露，而且 PKI 依赖于中央机构，但事实证明这些机构不太可靠。因此，通信双方需要使用其他信息源来相互验证。由于对手可以假装是各方之一，因此对手至少应该无法获得部分此类信息。此类信息的许多自然来源（例如视觉密码或物理令牌）都是嘈杂的，并且每次访问时都不会给出相同的结果。该项目研究了在身份验证中使用真实噪声源的新技术，而无需协调值。它结合了各种相关研究领域的想法，包括信息协调、安全计算、基于密码的密钥协商、程序混淆和局部敏感哈希。如果成功，它将带来比当前部署更好的身份验证解决方案。研究人员为 IEEE 和 ITEF 等专业组织的标准化工作做出了贡献，并与业界进行了合作。

In order to establish a secure communication channel, each communicating party needs some method to authenticate the other, lest it unwittingly establish a channel with the adversary instead. Current techniques for authentication often rely on passwords and/or the public-key infrastructure (PKI). Both of these methods have considerable drawbacks since passwords are frequently breached, and PKI relies on central authorities which have proven to be less than reliable. Thus there is a need to use other sources of information for the communicating parties to authenticate each other. Such information should be at least partially unavailable to the adversary since the adversary can pretend to be one of the parties. Many natural sources of such information such as visual passwords or physical tokens are noisy, and don't give the same result each time they are accessed. This project investigates new techniques for using realistic noisy sources in authentication, without necessarily reconciling the values. It combines ideas from a variety of related lines of research, including information reconciliation, secure computation, password-based key agreement, program obfuscation, and locality-sensitive hashing. If successful, it will lead to better authentication solutions than are currently deployed. The investigators have contributed to standardization work in professional organizations like IEEE and ITEF, and have collaborated with industry.