Is it too late for PAKE? John Engler (UC Berkeley) Chris Karlof - - PowerPoint PPT Presentation

▶

Mar 31, 2024 99 likes •206 views

Is it too late for PAKE? John Engler (UC Berkeley) Chris Karlof Elaine Shi Dawn Song (Usable Security (PARC) (UC Berkeley) Systems) What is PAKE? Password Authenticated Key Exchange 1 Enter Password 2 Crypto

SLIDE 1

Is it too late for PAKE?

Chris Karlof Elaine Shi Dawn Song

(Usable Security (PARC) (UC Berkeley) Systems)

John Engler (UC Berkeley)

SLIDE 2

What is PAKE?

Password Authenticated Key Exchange

1 Enter Password 2 Crypto Protocol 3 Generate Session Key

SLIDE 3

Why PAKE?

Password not transmitted
Mutual Authentication

SLIDE 4

T wo Hurdles

Secure password entry
Branding and message

SLIDE 5

Problem: Mimicry Attacks

SLIDE 6

Possible Solution: Secure UI

Oiwa, et al. MAP-HTTP's In-chrome Login Rachna, et al. Dynamic Security Skin Login

SLIDE 7

Problem: Confusion Attacks

SLIDE 8

Problem: Branding and Messaging

SLIDE 9

Conclusion

More issues remain:

– User Training – Implementation – Deployment

PAKE: Potential benefits but hurdles.
Full Paper:Firefox implemenation: