Search

The article discusses protocols for preventing attacks on password-based computer authentication. The use of passwords on insecure communication channels such as the Internet can allow others to eavesdrop and learn passwords. Challenge-response protocols have been established to protect passwords by requiring users to answer a challenge prior to password verification. A password-based encrypted key exchange uses session keys to prevent password attacks. A secure remote password (SRP) combines zero-knowledge proofs and asymmetric key-exchange protocols. Though the standard model of key exchange is utilized in cryptography, alternative models use block ciphers in place of ideal ciphers. Reverse Turing tests (RTT) prevent automated programs from stealing passwords.

This article discusses the development of a new key management systems standard, the IEEE P1619, by the Institute of Electrical & Electronics Engineers Inc. Security in Storage Working Group (SISWG). This standard simplifies the data storage system used in key management software. The SISWG developed this system as a chain of custody and security management system for the keys that are used to decrypt the data shared across online networks. Compliance with this standard, which will entail the establishment of a key-management server that controls the relationship between key-management client machines and actual cryptographic units, is discussed.