Panic Passwords Authenticating under duress Jeremy Clark Urs

Panic Passwords: Authenticating under duress Jeremy Clark Urs Hengartner

© Universal Pictures International 2007. Used under the fair dealings clause in the Canada Copyright Act.

Outline 1. Definitions 2. Threat Model: – Dimensions – Assumptions 3. Categories of Attacks 4. Concluding Remarks

Definitions Password Space

Definitions Regular Password Space

Definitions Regular Panic Password Space

Definitions Regular Panic Invalid Password Space

literature review

Literature Review No thorough attention from the academic community Off-the-shelf alarm systems have built in panic passwords Some patents have panic passwords as a component They use a basic scheme with limited applicability

a threat model

Participants Alice: subject entering her password Bob: entity receiving Alice’s password Oscar: adversary coercing Alice Assume Bob is trustworthy and not in collusion with Oscar

Assumptions 1. Kerckhoffs' principle: Oscar knows system 2. Observational principle: Oscar sees password entered 3. Iteration principle: Multiple authentications can be forced 4. Forced-randomization principle: Oscar can control the order of passwords to be entered

Parameter 1: Coercion Oscar threatens Alice with retribution if he can determine that Alice entered a panic password Called a screening attack or blackmail

Parameter 1: Coercion If Oscar cannot tell if Alice enters a panic password, then Alice cannot prove to him, for money, that she is entering a regular password Called signalling or bribery $

Parameter 2: Persistence Oscar could be persistent in his attack Oscar could have a limited timeframe in which to conduct his attack and thus be nonpersistent Persistent Non-persistent

Parameter 3: Bob’s Action Bob could take some server-side, unobserved reaction upon receiving a panic password Bob could respond differently to Alice—a difference that could be observed by Oscar B B Unobservable Reaction A Observable Response

Parameter 4: Oscar’s Goal Oscar may want to prevent a panic password from being entered at all " Oscar may not care if a panic password is entered, as long as a regular password is entered at some point $

some categories of attacks

Unrecoverable reactions " B $

Unrecoverable reactions Oscar wants to gain entry to a premise secured with an alarm Alice can deactivate the alarm with a password If Alice uses a panic password, the authorities are alerted " B $

2 P System Regular Panic Invalid Password Space

Unrecoverable reactions 2 P works because Oscar wants to prevent any panic password However due to force-randomization, the probability of Oscar’s success is 1/2 " B $

Non-Persistent Attacks $ B B A $

Non-Persistent Attacks An ATM issues marked bills if a panic PIN is entered Oscar can tell the difference after analysing the bills—thus he wants to escape with at least some unmarked bills $ B B A $

Non-Persistent Attacks 2 P doesn’t work because Oscar will force Alice to authenticate twice and get unmarked money on one of the two transactions Locking the account could work since Oscar is non-persistent, however cannot lock on panic $ B B A $

2 P-Lock System Regular Panic Invalid Password Space

2 P-Lock System Within a window of time: No Lock upon second password

2 P-Lock System Within a window of time: No Lock upon second password Different set of bills Same behaviour

Persistent Attacks $ $ B B A

Persistent Attacks An online voting system spoils any ballots that are cast using a panic password Oscar should not be able to coerce Alice’s vote, nor should Alice be able to verifiably sell her vote to Oscar $ $ B B A

Persistent Attacks 2 P doesn’t work because of iteration; locking (2 P -Lock) doesn’t work because Oscar is persistent Need an arbitrarily large number of panic passwords $ $ B B A

P-Compliment System Regular Panic Password Space

P-Compliment System Regular Panic Typo Password Space

Regular Panic Invalid Password Space

Regular Panic Invalid Typo Password Space

Regular Panic Invalid Alice knows: 1 regular and 1 rule for separating panic from invalid

A System 5 -Dictionary: a regular password is 5 words, all of which appear in a dictionary; a panic password is any other 5 words that appear in the dictionary; an invalid password is some other character combination on at least one word $ $ B B A

concluding remarks

Future Directions Expand the parameters for the threat model Find new rules for unlimited panic passwords A password exchange protocol that can distinguish regular, panic, and invalid passwords (given they will be hashed/MACed) Usability studies!

Concluding Remarks The 2 P system doesn’t cut it in more interesting scenarios We have established a criteria for new schemes (and a few schemes) Fun part: find the simplest scheme, with most available rule, that meets the criteria

Questions?

Title Body B B A $ $ "