Authentication

01 Introduction

Lesson 12.1 presented the security's principles and introduced the AAA model: the authentication, the authorization, and the accounting. The three pillars form the security's operational sequence: the subject is authenticated (who are you?), the subject is authorized (what can you do?), and the subject's actions are accounted (what did you do?). This lesson presents the first pillar in detail.

Authentication is the process of verifying a subject's identity. The subject — a user, a process, a device, a service — claims to be a particular entity, and the system verifies the claim. The verification's result is a yes or a no: the subject's claim is accepted, and the subject is granted the identity's privileges; or the claim is rejected, and the subject is denied the access. The authentication is the security's first line of defence, and its weaknesses are the attackers' first target.

The authentication is often confused with two related concepts, and the distinction is important:

• Identification is the subject's claim of an identity: the user types a username, the process presents a certificate, the device sends its address. The identification is the claim, and it is not verified; the authentication is the claim's verification. A system that relies on the identification alone — a system that trusts the username without checking the password — is a system with no authentication.
• Authorization is the determination of what an authenticated subject is allowed to do: the subject's identity is known, and the system determines the resources the subject can access and the operations the subject can perform. The authorization follows the authentication: the subject is authenticated first, and the subject's privileges are determined second. A system that conflates the two — a system that grants the access on the basis of the identity without a separate authorization's check — is a system with a coarse-grained security policy.

The authentication's design has three components: the factors (the evidence the subject presents), the mechanisms (the ways the evidence is verified), and the protocols (the ways the evidence is exchanged between the subject and the system). The factors are the classical three: the knowledge (something the subject knows), the possession (something the subject has), and the inherence (something the subject is). The mechanisms are the passwords, the tokens, the certificates, and the biometrics. The protocols are the challenge-response's exchanges, the Kerberos's tickets, the TLS's handshakes, and the SAML's assertions. The lesson presents the three components and the ways they combine.

The lesson is organized around the authentication's factors. It presents the identification and the authentication's distinction, and the three factors. It presents the passwords in detail: the storage's mechanisms (the hashing, the salting, the key derivation functions), the attacks (the brute force, the dictionary, the rainbow tables, the credential stuffing, the phishing), the password policies (the NIST's guidelines), and the password managers. It presents the possession-based mechanisms: the one-time passwords (the HOTP and the TOTP), the hardware tokens, the smart cards, and the FIDO2/WebAuthn's standards. It presents the inherence-based mechanisms: the biometrics, their metrics (the FAR, the FRR, the EER), and their trade-offs. It presents the multi-factor authentication, the single sign-on (the Kerberos, the RADIUS, the LDAP, the OAuth, the SAML, the OpenID Connect), and the Linux authentication stack (the PAM, the NSS, the /etc/passwd, the /etc/shadow, the sudo, the SSH keys). It closes with the authentication's design principles and the lesson's synthesis.

02 Learning objectives

This lesson contributes to U12.2 and U12.3, and to course learning outcomes CLO1, CLO7, and CLO8.

03 Required reading

• Operating System Concepts — Chapter 16, Security, Section 16.4, Implementing Security Defenses, and the section on the user authentication. The standard treatment of the authentication's mechanisms and the operating system's implementation.
• OSTEP — the Security chapters, particularly the discussion of the authentication and the cryptographic primitives. OSTEP's treatment of the challenge-response's protocols and the password's storage is the clearest available account, and it is the basis for the worked example in this lesson.
• Tanenbaum & Bos — Modern Operating Systems, Chapter 9, Security, Sections 9.4–9.6. The treatment of the authentication's mechanisms, the passwords, and the biometrics.
• Anderson, R. — Security Engineering, 2nd ed., Chapter 3, Passwords, and Chapter 4, Access Control. The comprehensive treatment of the passwords' weaknesses and the authentication's mechanisms.
• NIST SP 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management. The National Institute of Standards and Technology's guidelines for the authentication's mechanisms, including the password's policies, the multi-factor authentication, and the authenticators.
• Bonneau, J., Herley, C., van Oorschot, P. C., & Stajano, F. — The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes. IEEE Symposium on Security and Privacy, 2012. The systematic evaluation of the authentication's schemes and their trade-offs.
• Grassi, P. A., Garcia, M. E., & Fenton, J. L. — Digital Identity Guidelines. NIST SP 800-63-3, 2017. The framework for the digital identity's management.
• Linux man pages: man 5 passwd, man 5 shadow, man 5 group, man 5 pam.conf, man 8 pam_unix, man 8 pam_pwquality, man 8 pam_tally2 (or man 8 pam_faillock), man 8 su, man 8 sudo, man 5 sudoers, man 1 passwd, man 1 chage, man 1 ssh-keygen, man 5 sshd_config, man 8 sshd, man 1 ssh-copy-id, man 5 krb5.conf (if Kerberos is installed), man 8 kinit, man 8 klist, man 8 google-authenticator (if installed), man 1 oathtool, man 1 opiepasswd.

04 Core content

4.1 Identification, authentication, and authorization

The three concepts are the security's first conversation's sequence, and the distinction among them is the authentication's foundation:

Identification

The subject's claim of an identity: the user types a username, the process presents a certificate, the device sends its address. The identification is the claim's presentation, and it is not verified. A system that accepts the identification without the verification — a system that trusts the username — has no authentication, and it is trivially impersonated.

Authentication

The verification of the identification's claim: the system checks the evidence the subject presents (the password, the token, the biometric) against the stored's record (the password's hash, the token's seed, the biometric's template). The verification's result is the identity's acceptance or rejection, and the accepted identity is the subject's principal for the subsequent operations.

Authorization

The determination of what the authenticated principal is allowed to do: the principal's identity is known, and the system determines the resources the principal can access and the operations the principal can perform. The authorization is the subject of Lessons 12.3 and 12.4; the authentication is this lesson's subject.

The three concepts' distinction is the security's design's first decision: a system that confuses the identification with the authentication, or the authentication with the authorization, has a design's flaw that the attackers can exploit. The classical examples are the systems that trust the username's claim (the identification without the authentication), the systems that grant the administrator's privileges to any authenticated user (the authentication without the authorization's granularity), and the systems that use the same credential for the authentication and the authorization (the password's reuse across the services, which makes a single password's compromise the whole system's compromise).

4.2 The three authentication factors

The authentication's evidence is the authenticator, and the authenticators are classified into three factors:

Knowledge (something the subject knows)

The authenticator is the information the subject holds in memory: the password, the passphrase, the PIN, the answer to a security question. The knowledge's advantages are its simplicity and its cost (no hardware is required); its disadvantages are its weakness (the users choose the memorable but weak passwords, and they reuse them across the services), its exposure (the phishing, the shoulder surfing, the keyloggers, the memory's dump), and its burden (the users must remember many passwords, and the password's rotation makes the burden worse).

Possession (something the subject has)

The authenticator is the physical object the subject holds: the hardware token, the smart card, the phone (with the one-time password's application), the USB key (with the FIDO2's credential), the certificate (stored on the device). The possession's advantages are its strength (the object is difficult to duplicate, and its compromise requires the physical access), and its integration with the cryptography (the object can perform the cryptographic operations without revealing the secret); its disadvantages are its cost (the hardware's distribution, the management), its inconvenience (the object must be carried), and its exposure (the theft, the loss, the cloning for the weak's designs).

Inherence (something the subject is)

The authenticator is the subject's biological or behavioural characteristic: the fingerprint, the face, the iris, the voice, the gait, the signature's dynamics. The inherence's advantages are its convenience (nothing to remember, nothing to carry) and its difficulty's imposture (the biometric is difficult to forge without the sophisticated attacks); its disadvantages are its privacy (the biometric is personal, and it cannot be changed if compromised), its accuracy (the false acceptance and the false rejection are non-zero), and its liveness (the biometric's capture can be fooled by the replicas).

The three factors are the authentication's classical classification, and the multi-factor authentication (MFA) is the combination of two or more factors from the different categories. The combination's purpose is the separation of privilege's principle (Lesson 12.1): a single factor's compromise is not sufficient for the authentication, so the attacker must compromise two or more factors — the password and the token, the password and the biometric — which is much harder than the single factor's compromise.

The MFA's design has a subtlety: the factors must be from the different categories, not the same category's two instances. A system that requires two passwords (the two knowledge's factors) is not an MFA, because the attacker who learns the first password is likely to learn the second (the same phishing, the same keylogger, the same reuse). A system that requires the password and the token (the knowledge and the possession) is an MFA, because the token's compromise requires the physical access, which is a different attack's vector. The observation is the reason the MFA's design must classify the factors by their categories, not by the mechanisms' count.

4.3 Passwords: storage

The password is the most common authenticator, and its storage is the authentication's most important implementation's decision. The naive's approach — the password's storage in the clear (the plaintext) — is the worst: a single file's compromise (the server's breach, the backup's leak, the administrator's mistake) exposes every user's password, and the users' reuse of the passwords across the services makes the exposure the many services' compromise. The password's storage has therefore evolved through three generations:

• The plaintext's storage. The password is stored as the text the user typed. The verification is the string's comparison. The approach's flaw is the single file's compromise's catastrophic effect. It is obsolete, and its presence in a modern system is a critical vulnerability.
• The hash's storage. The password is hashed (with a cryptographic hash function), and the hash is stored. The verification is the hash's computation and comparison. The approach's advantage is the compromise's reduced effect: the attacker who obtains the hash file cannot recover the passwords directly, because the hash function is one-way. The approach's flaw is the dictionary attack and the rainbow tables: the attacker who has the hash can compute the hashes of the common passwords and compare them, and the rainbow tables (the precomputed hashes' tables) make the comparison fast. The approach is obsolete for the fast hash functions, and its presence is a vulnerability.
• The salted hash's storage. The password is combined with a salt (a random value, unique per user, stored alongside the hash), and the combination is hashed. The verification is the salt's retrieval, the combination's hashing, and the hash's comparison. The salt's advantages are the dictionary attack's defeat (the attacker must compute the hashes for each user's salt separately, so the precomputed tables are useless) and the identical passwords' different hashes (two users with the same password have different hashes, so the attacker cannot identify the shared passwords). The salted hash is the modern minimum, and it is the basis for the key derivation functions.

The key derivation function (KDF) is the modern password's storage's mechanism. The KDF is a deliberately slow hash function: it is designed to take a significant amount of time (tens to hundreds of milliseconds) and a significant amount of memory, so the brute force's cost is prohibitive. The KDF's parameters (cost, iterations, memory) are tunable, so the system's administrator can increase the cost as the hardware's speed increases. The modern KDFs are:

PBKDF2 (Password-Based Key Derivation Function 2)

The KDF that applies a hash function (typically the SHA-256) many times (the iterations' parameter, typically the 100,000 or more), so the computation's cost is the iterations' count multiplied by the hash's cost. The PBKDF2 is the NIST's approved KDF, and it is widely supported; its disadvantage is its weak resistance to the GPU's and the ASIC's attacks (the parallel hardware can compute the many hashes' combinations efficiently).

bcrypt

The KDF that is based on the Blowfish cipher's key schedule, with the cost's parameter (the work factor) that doubles the computation's time for each increment. The bcrypt's advantages are its memory's usage (the Blowfish's key schedule requires several kilobytes) and its resistance to the GPU's attacks (the memory's usage limits the parallelism's benefit); its disadvantage is its design's age (the Blowfish's 64-bit block size limits the password's length to 72 bytes, and the algorithm's design is the 1990s').

scrypt

The KDF that is designed to be memory-hard: its parameters include the memory's cost (the N's parameter) and the parallelism's cost (the p's parameter), and the computation's memory's usage is the large (typically the tens of megabytes). The scrypt's advantage is its resistance to the GPU's and the ASIC's attacks (the memory's requirement makes the parallel hardware's advantage smaller); its disadvantage is the memory's usage itself (the server must have the memory to verify the passwords, and the many concurrent authentications can exhaust the server's memory).

Argon2

The KDF that won the Password Hashing Competition (2015), with the three variants (the Argon2d, the Argon2i, and the Argon2id) that differ in their resistance to the side-channel's and the GPU's attacks. The Argon2's parameters include the memory's cost, the time's cost, and the parallelism's cost, and its design is the modern standard. The Argon2id is the recommended variant, and it is the modern systems' KDF of choice.

The KDF's parameters' selection is the security's trade-off: the higher the cost, the more the attacker's brute force's cost, but the more the server's authentication's cost. The modern guidance is the cost that makes the verification take the tens to hundreds of milliseconds on the server's hardware, so the legitimate users' authentication's delay is the imperceptible and the attacker's brute force's cost is the prohibitive. The observation is the reason the KDF's parameters must be the tunable and the periodically reviewed: the hardware's speed's increase (the Moore's law, the GPUs, the ASICs) reduces the attacker's cost, and the parameters must be increased to compensate.

4.4 Passwords: attacks

The passwords' attacks are the attackers' attempts to obtain the authenticators, and they are classified by the way the attacker obtains them:

Brute force

The attacker tries every possible password, in the systematic order. The attack's cost is the password's entropy (the number of the possible passwords): an 8-character password from the 62-character alphabet (the lowercase, the uppercase, the digits) has about 2.18 × 10¹⁴ possibilities, and at the billion guesses per second (a modern GPU's rate), the attack's expected time is the days to the years. The brute force's defence is the password's length (the entropy's logarithm) and the KDF's cost (the guesses' rate's reduction).

Dictionary attack

The attacker tries the words from the dictionaries (the natural languages, the leaked passwords' lists, the common patterns), rather than the random's strings. The attack exploits the users' tendency to choose the memorable passwords (the names, the birthdays, the dictionary's words, the keyboard's patterns), and its cost is much lower than the brute force's for the typical users' passwords. The dictionary attack's defence is the password's policy (the rejection of the common passwords and the patterns) and the KDF's cost.

Rainbow tables

The attacker precomputes the hashes of the candidate passwords and stores them in the rainbow table (the space-optimized table of the hash chains), so the attacker's online's work is the table's lookup. The attack's defence is the salt: the salted hashes cannot be looked up in the precomputed tables, because the tables would have to include the salt's combinations (the salt's space's multiplication makes the tables infeasible). The rainbow table is the reason the plain hashes (the unsalted) are the critical vulnerability, and the salt is the modern minimum.

Credential stuffing

The attacker uses the credentials (the username and the password's pairs) that were leaked from one service to authenticate to another service, exploiting the users' reuse of the passwords. The attack's cost is the low (the credentials' lists are the commodity), and its success is the high (the users' reuse is the common). The attack's defence is the users' education (the unique passwords per service), the password managers (the unique passwords' generation), the breached-credential's checking (the services' rejection of the known-compromised passwords), and the multi-factor authentication (the stolen password's insufficiency).

Phishing

The attacker deceives the user into revealing the credentials: the fake's login page, the deceptive's email, the look-alike's domain, the social engineering's call. The attack exploits the users' trust and their inability to distinguish the legitimate from the fraudulent. The attack's defence is the users' education, the email's filtering, the web's filtering, the domain's verification, and the FIDO2/WebAuthn's origin's binding (the phishing-resistant's authentication, which the credential is bound to the origin and cannot be replayed on the attacker's domain).

Shoulder surfing, keyloggers, and the malware

The attacker observes the password's entry (the shoulder surfing, the cameras), records the keystrokes (the keyloggers), or captures the password from the memory (the memory's dump, the process's inspection). The attack's defence is the two-factor's authentication (the password's capture is not sufficient), the trusted platform modules (the TPM), and the physical's security.

The attacks' classification reveals the passwords' fundamental weakness: the knowledge's authenticators are vulnerable to the observation, the guessing, and the reuse, and their defences (the strong passwords, the unique passwords, the policies, the KDFs) reduce the risk but do not eliminate it. The observation is the reason the modern security's guidance emphasizes the length over the complexity (a long passphrase is stronger and more memorable than a short, complex's password), the breached credentials' checking (the services should reject the known-compromised passwords), the rate limiting (the online's attempts' throttling), and the multi-factor authentication (the password's compromise's insufficiency).

4.5 Passwords: policies and managers

The password's policy is the system's rules for the passwords' selection, and it has evolved over the decades:

• The classical policy (the 1990s' and the 2000s'): the passwords must be the minimum's length (the 8 characters), the complexity (the lowercase, the uppercase, the digits, the special characters), and they must be rotated (the every 90 days), and the history must prevent the reuse (the last 5 or 10 passwords). The policy's rationale was the brute force's and the dictionary's attacks' defeat, and the rotation's rationale was the compromise's window's limitation.
• The modern policy (the NIST SP 800-63B, the 2017 and the updates): the passwords must be the minimum's length (the 8 characters, with the longer for the higher-assurance's systems), the blocklist's checking (the common passwords, the breached's passwords, the dictionary's words, the repetitive and the sequential's strings are rejected), and the rotation is not required (the rotation is required only when the compromise's evidence exists). The policy's rationale is the users' behaviour's reality: the rotation makes the users choose the weaker passwords (the incremental's changes, the predictable's patterns), and the complexity's rules make them choose the predictable's substitutions (the "P@ssw0rd" patterns). The length and the blocklist are the modern guidance's core.

The password manager is the tool that generates, stores, and fills the passwords for the users. The manager's advantages are the strong, unique passwords' generation (the users do not choose the passwords, so the dictionary's and the reuse's attacks are defeated), the convenience (the users remember one master's password), and the phishing's resistance (the manager's autofill is bound to the origin's domain, so the look-alike's domains are not filled). The manager's disadvantages are the single point's failure (the master's password's compromise exposes every password), the trust's requirement (the users must trust the manager's software and its sync's service), and the platform's support (the some systems' applications do not integrate with the managers). The modern guidance recommends the password managers, and the browsers' and the operating systems' built-in managers have made them the common.

4.6 Challenge-response protocols and replay attacks

The challenge-response protocol is the authentication's pattern in which the verifier sends the subject a challenge (a random value, the nonce), and the subject responds with the challenge's transformation (the hash, the encryption, the signature), so the verifier can check the response. The protocol's purpose is the secret's non-transmission: the subject's response proves the secret's possession without revealing the secret, so the eavesdropper cannot capture the credential.

The challenge-response's design has three variants:

• The symmetric's challenge-response. The subject and the verifier share a secret key, and the subject's response is the challenge's encryption (or the HMAC's computation) with the shared key. The verifier checks the response by the same computation. The variant's requirement is the shared key's distribution and its storage (the key's compromise compromises the authentication), and its advantage is the cryptographic strength (the response's computation is the secret's proof).
• The asymmetric's challenge-response. The subject holds a private key, and the verifier holds the corresponding public key. The subject's response is the challenge's digital signature with the private key, and the verifier checks the signature with the public key. The variant's advantage is the private key's non-transmission (the key never leaves the subject's device), and its requirement is the public key's distribution and its certification (the public key infrastructure, the PKI).
• The password-based's challenge-response. The subject and the verifier share the password, and the protocol transforms the password into the challenge's response (the hash, the KDF's output) without transmitting the password. The variant's advantage is the password's non-transmission (the eavesdropper cannot capture it), and its requirement is the protocol's design's correctness (the password-based's protocols are subtle, and the weak designs are vulnerable to the offline's dictionary's attacks).

The replay attack is the authentication's classical attack: the attacker captures the subject's response and replays it to the verifier, so the attacker impersonates the subject without knowing the secret. The attack's defence is the challenge's freshness: the verifier's challenge must be the unique per session (the random's nonce, the timestamp, the counter), so the captured response is valid only for the session in which it was produced. The observation is the reason the challenge-response's protocols must include the nonce's generation's design: the nonce must be the unpredictable (the cryptographic random's generation) and the unique (the reuse's prevention), and the verifier's check must include the nonce's correspondence to the current session.

The replay attack's subtler variants are the reflection's attack (the attacker reflects the verifier's challenge back to the verifier, so the verifier authenticates itself to the attacker) and the man-in-the-middle's attack (the attacker relays the messages between the subject and the verifier, so the attacker's presence is hidden). The defences are the protocol's design (the mutual authentication, the channel's binding, the key exchange's authentication) and the transport's security (the TLS, the SSH), and the protocols' design is the cryptographic engineering's central challenge.

4.7 Possession-based authentication

The possession-based authentication uses the object the subject holds, and the modern mechanisms are:

One-time passwords (OTPs)

The passwords that are valid for a single authentication's session (or a short time window). The OTP's advantage is the replay's defence (the captured password is useless after its use), and its mechanisms are the HOTP (the HMAC-based one-time password: the OTP is the HMAC of the counter, and the counter's synchronization between the token and the verifier) and the TOTP (the time-based one-time password: the OTP is the HMAC of the current time's step, typically the 30 seconds). The TOTP's implementations are the software's (the Google Authenticator, the Authy, the FreeOTP) and the hardware's (the key fobs, the smart cards). The OTP's disadvantage is the phishing's vulnerability (the attacker who captures the OTP in the real time can relay it to the verifier before the window's expiry), and its mitigation is the origin's binding (the FIDO2's approach).

Hardware tokens

The dedicated devices that perform the authentication's computations: the OTP's fobs (the RSA SecurID), the smart cards (the cryptographic's processors that store the private keys and perform the signatures), the USB keys (the FIDO's U2F and the FIDO2's security keys), and the trusted platform modules (the TPMs, the chips that are soldered to the motherboard and store the platform's keys). The hardware tokens' advantages are the secret's non-extractability (the key never leaves the device) and the phishing's resistance (the FIDO2's keys are bound to the origin's domain); their disadvantages are the cost (the distribution, the management), the loss's risk (the token's loss requires the recovery's procedure), and the compatibility (the systems must support the tokens).

FIDO2 and WebAuthn

The modern standards for the phishing-resistant authentication. The FIDO2 (the Fast Identity Online, the version 2) is the standard's suite, and the WebAuthn (the Web Authentication) is the web's API. The standard's design is the public key's cryptography: the authenticator (the hardware's key, the platform's biometric's sensor, the phone) generates the key pair per the relying party (the website), and the private key never leaves the authenticator. The authentication is the challenge's signature with the private key, and the signature's verification is the public key's check. The standard's advantages are the phishing's resistance (the credential is bound to the origin's domain, so the look-alike's domains cannot use it), the replay's resistance (the challenge's freshness), and the convenience (the user's gesture — the touch, the biometric — is the only interaction); its disadvantage is the ecosystem's requirement (the browsers, the websites, and the authenticators must support the standard).

4.8 Inherence-based authentication: biometrics

The biometric authentication uses the subject's biological or behavioural characteristic. The biometrics are classified into the physiological (the fingerprint, the face, the iris, the retina, the hand's geometry, the DNA) and the behavioural (the voice, the gait, the signature's dynamics, the keystroke's dynamics). The biometric's authentication's process has the two phases: the enrollment (the biometric's capture, the feature's extraction, the template's storage) and the verification (the biometric's capture, the feature's extraction, the template's comparison).

The biometric's accuracy is measured by the two error rates:

• The false acceptance rate (FAR): the probability that the system accepts an impostor (the biometric's match with the wrong template). The FAR is the security's metric: the lower the FAR, the stronger the security.
• The false rejection rate (FRR): the probability that the system rejects a legitimate subject (the biometric's mismatch with the correct template). The FRR is the usability's metric: the lower the FRR, the more convenient the system.
• The equal error rate (EER): the operating point where the FAR and the FRR are equal. The EER is the biometric's single-number comparison: the lower the EER, the better the biometric's accuracy. The modern biometrics' EERs are the fractions of a percent (the fingerprints' and the irises' are the lowest; the faces' and the voices' are the higher).

The biometric's design has the fundamental trade-off: the FAR and the FRR are the coupled (the system's threshold's adjustment moves the operating point along the curve). A stricter threshold (the lower's FAR) is the more secure but the less convenient (the higher's FRR); a looser threshold (the higher's FAR) is the more convenient but the less secure. The observation is the reason the biometric's deployment must specify the application's requirement: a border's control (the high security) uses the stricter threshold, and a phone's unlock (the high convenience) uses the looser threshold.

The biometric's advantages are its convenience (nothing to remember, nothing to carry) and its difficulty's imposture (the biometric is difficult to forge without the sophisticated attacks). Its disadvantages are its privacy (the biometric is personal, and it cannot be changed if compromised: a leaked fingerprint is the permanent's exposure), its accuracy (the FAR and the FRR are the non-zero, and the environmental's factors — the lighting, the moisture, the injuries — affect the reading), and its liveness (the biometric's capture can be fooled by the replicas: the fake's fingers, the photos, the masks, the recorded's voices). The observation is the reason the biometrics are usually deployed as the second factor (the password and the fingerprint), not the sole authenticator, and the reason the liveness's detection is the biometric's systems' critical component.

4.9 Multi-factor authentication and single sign-on

The multi-factor authentication (MFA) combines two or more factors from the different categories. The MFA's design's requirements are:

• The factors' independence. The factors must be from the different categories (the knowledge, the possession, the inherence), not the same category's two instances. The two-password's scheme is not an MFA.
• The factors' compromise's independence. The factors' compromises must be the different causes: the password's phishing and the token's theft are the different causes, while the password's phishing and the security question's phishing are the same cause.
• The factors' usability. The MFA must be the usable: the users must be able to complete the authentication's sequence without the excessive burden, or they will find the ways to bypass it (the psychological acceptability's principle, Lesson 12.1).

The MFA's deployment's variants are the 2FA (the two factors: the password and the OTP, the password and the fingerprint), the step-up (the additional factor's requirement for the sensitive operations: the login is the password-only, and the money's transfer requires the additional token), and the adaptive (the factors' selection based on the risk's context: the known device and the known location require the fewer factors, the new device and the unusual location require the more).

The single sign-on (SSO) is the authentication's architecture in which the subject authenticates once, and the authentication's result is used for the multiple services. The SSO's advantages are the users' convenience (the one password for the many services) and the security's centralization (the authentication's policy, the auditing, and the MFA's enforcement are the centralized). The SSO's disadvantage is the single point's failure: the SSO's authentication's compromise exposes every service, and the SSO's server's outage blocks the access to every service. The SSO's protocols are:

Kerberos

The MIT's protocol (the 1980s) for the network's authentication, based on the tickets and the key distribution center (the KDC). The subject authenticates to the KDC (the authentication server, the AS) and obtains the ticket-granting ticket (the TGT); the subject presents the TGT to the ticket-granting server (the TGS) and obtains the service's ticket; the subject presents the service's ticket to the service, and the service authenticates the subject. The Kerberos's advantages are the password's non-transmission (the challenge-response's protocol), the tickets' time-boundedness (the tickets' expiry), and the mutual's authentication (the subject and the service authenticate to each other); its disadvantages are the KDC's centralization (the KDC's compromise or its outage compromises the authentication) and the clock's synchronization (the tickets' expiry requires the clocks' synchronization).

RADIUS and LDAP

The RADIUS (the Remote Authentication Dial-In User Service) is the protocol for the network's access's authentication, authorization, and accounting (the AAA), used for the VPNs, the Wi-Fi's enterprise's networks, and the network's devices. The LDAP (the Lightweight Directory Access Protocol) is the directory's protocol for the users' and the groups' information, used for the authentication's backends (the nsswitch's and the PAM's integration) and the address books.

SAML, OAuth, and OpenID Connect

The web's SSO's protocols. The SAML (the Security Assertion Markup Language) is the XML's protocol for the assertions' exchange, used for the enterprise's SSO. The OAuth 2.0 is the authorization's framework (the access's delegation: the user grants the application the access to the user's resources on another service, without sharing the password), and the OpenID Connect (the OIDC) is the authentication's layer on top of the OAuth (the identity's verification). The three protocols are the modern web's SSO's foundation, and their designs' subtleties (the redirects' validation, the tokens' binding, the state's parameter) are the security's critical concerns.

4.10 The Linux authentication stack

The Linux's authentication is the layered stack, and its components are:

The user's database: /etc/passwd and /etc/shadow

The /etc/passwd is the world-readable file that holds the users' accounts: the username, the user's ID (the UID), the group's ID (the GID), the user's full name (the GECOS field), the home's directory, and the login's shell. The /etc/shadow is the root-readable-only file that holds the passwords' hashes and the passwords' aging's information (the last change, the minimum and the maximum age, the warning's period, the inactivity's period, the expiry's date). The two files' separation is the security's design: the /etc/passwd is readable by the world (the programs need the users' information), and the /etc/shadow is restricted (the passwords' hashes are the sensitive data).

PAM (Pluggable Authentication Modules)

The Linux's authentication's framework: the programs (the login, the sudo, the sshd, the su) call the PAM's library, and the library's modules (the pam_unix, the pam_pwquality, the pam_tally2 or the pam_faillock, the pam_google_authenticator, the pam_fprintd) perform the authentication's steps. The PAM's advantages are the programs' and the mechanisms' independence (the program does not know which mechanism authenticates the user, and the administrator can change the mechanism by the configuration), and its configuration's files are /etc/pam.conf and /etc/pam.d/.

NSS (Name Service Switch)

The Linux's framework for the users' and the groups' information's sources: the /etc/nsswitch.conf specifies the sources' order (the files for the /etc/passwd, the systemd for the systemd's accounts, the ldap for the directory's accounts, the sss for the System Security Services Daemon's accounts). The NSS is what makes the Linux's authentication the enterprise-ready: the same PAM's stack can authenticate the local users (the /etc/passwd) and the directory's users (the LDAP), and the NSS's configuration determines the sources.

The password's management: passwd and chage

The passwd command changes the user's password (with the PAM's stack's validation, the pam_pwquality's checks), and the chage command manages the password's aging (the minimum and the maximum age, the warning's period, the expiry's date). The aging's purpose is the compromise's window's limitation (the password must be changed periodically), and the modern guidance's nuance (the NIST SP 800-63B) is the aging's requirement's relaxation (the rotation only when the compromise's evidence exists).

The privilege's escalation: su and sudo

The su command switches the user's identity (the subject authenticates as the target user, and the shell runs with the target's privileges), and the sudo command executes the specific commands with the target's privileges (the subject authenticates as themselves, and the sudoers's file determines the commands they can run). The sudo's advantages are the least privilege's granularity (the users run the specific commands, not the whole shell's root) and the auditing (the sudo's log records the commands), and its configuration is the /etc/sudoers (edited with the visudo's command, which validates the syntax).

The SSH's keys

The ssh command authenticates with the password or the public key's cryptography. The public key's authentication is the modern's standard: the user generates the key pair (ssh-keygen), the public key is placed on the server (~/.ssh/authorized_keys), and the authentication is the challenge's signature with the private key. The private key's protection is the passphrase (the key's encryption at rest) and the agent (the ssh-agent, which caches the decrypted key for the session). The SSH's key's advantages are the password's non-transmission (the key never leaves the client), the brute force's resistance (the key is the 2048-bit or larger), and the automation's support (the scripts, the configuration's management).

4.11 The authentication's design principles

The authentication's design applies the Lesson 12.1's principles, and the specific applications are:

• The fail-safe defaults. The authentication's default must be the denial: the subject is denied until the authentication's success, and the missing or the failed authentication does not grant the access. The application is the default's deny policy (the systems that require the authentication for the access), the password's policies (the new accounts' passwords must be set before the login), and the sessions' expiry (the idle sessions' logout).
• The least privilege. The authenticated subject's privileges must be the minimum for the task. The application is the sudo's granularity (the specific commands, not the whole root's shell), the services' accounts (the dedicated users, not the root), and the capabilities (the fine-grained privileges, not the root's all-or-nothing).
• The separation of privilege. The authentication must require more than one factor, so the single factor's compromise is not sufficient. The application is the multi-factor authentication (the password and the token, the password and the biometric).
• The complete mediation. Every access must be authenticated (or the authentication's result must be bound to the access). The application is the session's tokens (the authentication's result's binding to the session), the cookies' and the tokens' validation (the every request's check), and the re-authentication for the sensitive operations (the step-up's authentication).
• The economy of mechanism. The authentication's mechanism must be the simple and the small. The application is the standard protocols (the Kerberos, the TLS, the FIDO2) rather than the custom's designs, the established libraries rather than the custom's cryptography, and the minimal PAM's stacks.
• The psychological acceptability. The authentication must be the usable: the users must be able to complete it without the excessive burden, or they will find the ways to bypass it. The application is the single sign-on (the one password for the many services), the password managers (the strong passwords' generation), the biometrics (the nothing to remember, nothing to carry), and the FIDO2's keys (the one gesture's authentication).

The authentication's design's central tension is the security and the usability's trade-off. A system that requires the strong passwords, the frequent rotations, the many factors, and the frequent re-authentications is the more secure but the less usable, and the users' response is the passwords' reuse, the writing's down, the bypasses' search. A system that requires the nothing (the no passwords, the no factors) is the more usable but the insecure. The authentication's design's goal is the balance: the strongest security the users will accept, and the most usable the security can tolerate. The observation is the reason the modern guidance emphasizes the length over the complexity (the longer passwords are the stronger and the more memorable), the password managers (the strong passwords without the users' burden), the MFA (the strong security with the moderate burden), and the FIDO2's keys (the strong security with the minimal burden).

4.12 Common misconceptions

05 Worked example

The following example traces a user's authentication through the Linux's PAM's stack, computes the password's storage's cost, and analyzes the authentication's attack's scenarios.

# Show the users' accounts
cat /etc/passwd
sudo cat /etc/shadow | head -10
# The /etc/shadow's second field is the password's
# hash (the $6$ for the SHA-512, the $y$ for the
# yescrypt, the $2b$ for the bcrypt). The '*' or '!'
# means the account has no password (the login's
# disabled).

# Show the password's aging for a user
sudo chage -l alice 2>/dev/null

# Show the PAM's configuration
cat /etc/pam.d/sshd
cat /etc/pam.d/login

# Show the NSS's configuration
cat /etc/nsswitch.conf | grep -E 'passwd|group|shadow'

# Show the SSH's configuration
sudo grep -iE 'PasswordAuthentication|PubkeyAuthentication|PermitRootLogin' /etc/ssh/sshd_config

# Show the SSH's keys
ls -la ~/.ssh/
cat ~/.ssh/authorized_keys 2>/dev/null

# Show the sudo's configuration
sudo cat /etc/sudoers | grep -vE '^#|^$'

# Show the recent authentication's events
sudo lastb | head -10
sudo grep -iE 'authentication|failed|accepted' /var/log/auth.log 2>/dev/null | tail -20
sudo ausearch -m USER_AUTH -ts recent 2>/dev/null | head -10

06 Interactive activity

07 Knowledge check

08 Unit discussion

09 Practice exercise

10 Summary

• Identification is the subject's claim of an identity, the authentication is the claim's verification, and the authorization is the determination of the authenticated principal's privileges. The three form the security's first conversation's sequence.
• The three authentication factors are the knowledge (something the subject knows: the password), the possession (something the subject has: the token), and the inherence (something the subject is: the biometric). The multi-factor authentication combines the factors from the different categories.
• The passwords' storage has evolved through the plaintext (the obsolete), the hash (the vulnerable to the dictionary and the rainbow tables), the salted hash (the rainbow tables' defence), and the key derivation function (the slow hash: the PBKDF2, the bcrypt, the scrypt, the Argon2).
• The password attacks are the brute force, the dictionary, the rainbow tables, the credential stuffing, the phishing, and the observation (the shoulder surfing, the keyloggers). The defences are the length, the blocklist, the KDFs, the rate limiting, the managers, and the MFA. The modern guidance (the NIST SP 800-63B) emphasizes the length over the complexity and the blocklist's checking over the rotation.
• The challenge-response protocols prove the secret's possession without the secret's transmission, and the nonce's freshness defeats the replay. The one-time passwords (the HOTP and the TOTP) and the FIDO2/WebAuthn standards are the possession-based mechanisms; the FIDO2's origin's binding makes it the phishing-resistant authentication.
• The biometrics use the subject's physiological or behavioural characteristics, and their accuracy is measured by the FAR, the FRR, and the EER. The biometrics are usually the second factor, not the sole authenticator.
• The single sign-on (the SSO) authenticates the subject once and uses the result for the multiple services. Its protocols are the Kerberos (the tickets and the KDC), the RADIUS and the LDAP (the network's and the directory's access), and the SAML, the OAuth, and the OpenID Connect (the web's SSO).
• The Linux authentication stack comprises the /etc/passwd and the /etc/shadow (the users' database), the PAM (the Pluggable Authentication Modules' framework), the NSS (the Name Service Switch), the passwd and the chage commands (the password's management), the su and the sudo commands (the privilege's escalation), and the SSH's keys (the public key's authentication).
• The authentication's design applies the Lesson 12.1's principles: the fail-safe defaults, the least privilege, the separation of privilege, the complete mediation, the economy of mechanism, and the psychological acceptability. The central tension is the security and the usability's trade-off.

11 References

• Silberschatz, A., Galvin, P. B., & Gagne, G. Operating System Concepts, 10th ed., Chapter 16, Section 16.4.
• Arpaci-Dusseau, R. H., & Arpaci-Dusseau, A. C. Operating Systems: Three Easy Pieces, the Security chapters. Available online at ostep.org.
• Tanenbaum, A. S., & Bos, H. Modern Operating Systems, 4th ed., Chapter 9, Sections 9.4–9.6.
• Anderson, R. Security Engineering, 2nd ed., Chapters 3 and 4. Wiley, 2008.
• NIST SP 800-63B. Digital Identity Guidelines: Authentication and Lifecycle Management. National Institute of Standards and Technology.
• Bonneau, J., Herley, C., van Oorschot, P. C., & Stajano, F. The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes. IEEE Symposium on Security and Privacy, 2012.
• Grassi, P. A., Garcia, M. E., & Fenton, J. L. Digital Identity Guidelines. NIST SP 800-63-3, 2017.
• Linux man-pages: man 5 passwd, man 5 shadow, man 5 group, man 5 pam.conf, man 8 pam_unix, man 8 pam_pwquality, man 8 pam_faillock, man 8 su, man 8 sudo, man 5 sudoers, man 1 passwd, man 1 chage, man 1 ssh-keygen, man 5 sshd_config, man 8 sshd, man 1 ssh-copy-id.