Authentication protocol

Short description: Type of cryptographic protocol

An authentication protocol is a type of computer communications protocol or cryptographic protocol specifically designed for transfer of authentication data between two entities. It allows the receiving entity to authenticate the connecting entity (e.g. Client connecting to a Server) as well as authenticate itself to the connecting entity (Server to a client) by declaring the type of information needed for authentication as well as syntax.[1] It is the most important layer of protection needed for secure communication within computer networks.

## Contents

* 1 Purpose
* 2 Types
* 2.1 Authentication protocols developed for PPP Point-to-Point Protocol
* 2.1.1 PAP - Password Authentication Protocol
* 2.1.2 CHAP - Challenge-handshake authentication protocol
* 2.1.3 EAP - Extensible Authentication Protocol
* 2.2 AAA architecture protocols (Authentication, Authorization, Accounting)
* 2.2.1 TACACS, XTACACS and TACACS+
* 2.2.2 RADIUS
* 2.2.3 DIAMETER
* 2.3 Other
* 2.3.1 Kerberos (protocol)
* 3 Emerging technologies in authentication protocols
* 4 List of various other authentication protocols
* 5 References

## Purpose

With the increasing amount of trustworthy information being accessible over the network, the need for keeping unauthorized persons from access to this data emerged. It is possible to steal one's identity in the computing world - special verification methods were invented to find out whether the person/computer requesting data is really who they say they are.[2] The task of the authentication protocol is to specify the exact series of steps needed for execution of the authentication. It has to comply with the main protocol principles:

1. A Protocol has to involve two or more parties and everyone involved in the protocol must know the protocol in advance.
2. All the included parties have to follow the protocol.
3. A protocol has to be unambiguous - each step must be defined precisely.
4. A protocol must be complete - must include a specified action for every possible situation.

An illustration of password-based authentication using simple authentication protocol:

Alice (an entity wishing to be verified) and Bob (an entity verifying Alice's identity) are both aware of the protocol they agreed on using. Bob has Alice's password stored in a database for comparison.

1. Alice sends Bob her password in a packet complying with the protocol rules.
2. Bob checks the received password against the one stored in his database. Then he sends a packet saying "Authentication successful" or "Authentication failed" based on the result.[3]

This is an example of a very basic authentication protocol vulnerable to many threats such as eavesdropping, replay attack, man-in-the-middle attacks, dictionary attacks or brute-force attacks. Most authentication protocols are more complicated in order to be resilient against these attacks.[4]

## Types

### Authentication protocols developed for PPP Point-to-Point Protocol

Protocols are used mainly by Point-to-Point Protocol (PPP) servers to validate the identity of remote clients before granting them access to server data. Most of them use a password as the cornerstone of the authentication. In most cases, the password has to be shared between the communicating entities in advance.[5]

PAP 2-way handshake scheme

#### PAP - Password Authentication Protocol

Password Authentication Protocol is one of the oldest authentication protocols. Authentication is initialized by the client sending a packet with credentials (username and password) at the beginning of the connection, with the client repeating the authentication request until acknowledgement is received.[6] It is highly insecure because credentials are sent "in the clear" and repeatedly, making it vulnerable even to the most simple attacks like eavesdropping and man-in-the-middle based attacks. Although widely supported, it is specified that if an implementation offers a stronger authentication method, that method must be offered before PAP. Mixed authentication (e.g. the same client alternately using both PAP and CHAP) is also not expected, as the CHAP authentication would be compromised by PAP sending the password in plain-text.

#### CHAP - Challenge-handshake authentication protocol

The authentication process in this protocol is always initiated by the server/host and can be performed anytime during the session, even repeatedly. The server sends a random string (usually 128B long). The client uses the password and the string received as input to a hash function and then sends the result together with username in plain text. The server uses the username to apply the same function and compares the calculated and received hash. An authentication is successful when the calculated and received hashes match.

#### EAP - Extensible Authentication Protocol

EAP was originally developed for PPP(Point-to-Point Protocol) but today is widely used in IEEE 802.3, IEEE 802.11(WiFi) or IEEE 802.16 as a part of IEEE 802.1x authentication framework. The latest version is standardized in RFC 5247. The advantage of EAP is that it is only a general authentication framework for client-server authentication - the specific way of authentication is defined in its many versions called EAP-methods. More than 40 EAP-methods exist, the most common are:

* EAP-MD5
* EAP-TLS
* EAP-TTLS
* EAP-FAST
* EAP-PEAP

### AAA architecture protocols (Authentication, Authorization, Accounting)

#### TACACS, XTACACS and TACACS+

#### RADIUS

Remote Authentication Dial-In User Service (RADIUS) is a full AAA protocol  commonly used by Internet service providers. Credentials are mostly username-password combination based, and it uses NAS and UDP protocol for transport.[7]

#### DIAMETER

Diameter (protocol) evolved from RADIUS and involves many improvements such as usage of more reliable TCP or SCTP transport protocol and higher security thanks to TLS.[8]

### Other

Kerberos authentication scheme

#### Kerberos (protocol)

Kerberos is a centralized network authentication system developed at MIT and available as a free implementation from MIT but also in many commercial products. It is the default authentication method in Windows 2000 and later. The authentication process itself is much more complicated than in the previous protocols - Kerberos uses symmetric key cryptography, requires a trusted third party and can use public-key cryptography during certain phases of authentication if need be.[9][10][11]

## Emerging technologies in authentication protocols

Recent research in authentication protocols highlights advancements aimed at securing resource-constrained environments such as the Industrial Internet of Things (IoT). These modern protocols employ advanced cryptographic techniques, including Elliptic Curve Cryptography (ECC), to enable secure mutual authentication and session key agreement while minimizing computational and energy overhead. Privacy-preserving mechanisms have also been integrated with biometric authentication to enhance security without compromising user confidentiality. Further emphasis has been placed on resistance to side-channel and replay attacks, alongside the achievement of forward and backward secrecy to protect session keys in dynamic network scenarios. These emerging technologies mark significant progress in making authentication more efficient and secure across evolving digital landscapes.[12]

## List of various other authentication protocols

* AKA
* Basic access authentication
* CAVE-based authentication
* CRAM-MD5
* Digest
* Host Identity Protocol (HIP)
* LAN Manager
* NTLM, also known as NT LAN Manager
* OpenID protocol
* Password-authenticated key agreement protocols
* Protocol for Carrying Authentication for Network Access (PANA)
* Secure Remote Password protocol (SRP)
* RFID-Authentication Protocols
* Woo Lam 92 (protocol)
* SAML

## References

1. ↑ Duncan, Richard (23 October 2001). "An Overview of Different Authentication Methods and Protocols". SANS Institute. https://www.sans.org/reading-room/whitepapers/authentication/overview-authentication-methods-protocols-118.
2. ↑ Shinder, Deb (28 August 2001). "Understanding and selecting authentication methods". http://www.techrepublic.com/article/understanding-and-selecting-authentication-methods/.
3. ↑ van Tilborg, Henk C.A. (2000). Fundamentals of Cryptology. Massachusetts: Kluwer Academic Publishers. pp. 66–67. ISBN 0-7923-8675-2.
4. ↑ Smith, Richard E. (1997). Internet Cryptography. Massachusetts: Addison Wesley Longman. pp. 1–27. ISBN 0-201-92480-3. https://archive.org/details/internetcryptogr0000smit/page/1.
5. ↑ Halevi, Shai (1998). "Public-key cryptography and password protocols". pp. 230–268\. CiteSeerX 10.1.1.45.6423.
6. ↑ Vanek, Tomas. "Autentizacní telekomunikacních a datových sítích". CVUT Prague. http://data.cedupoint.cz/oppa_e-learning/2_KME/044.pdf.
7. ↑ "AAA protocols". CISCO. http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-1/user/guide/acsuserguide/rad_tac_phase.html.
8. ↑ Liu, Jeffrey (24 January 2006). "Introduction to Diameter". IBM. http://www.ibm.com/developerworks/wireless/library/wi-diameter/.
9. ↑ "Kerberos: The Network Authentication Protocol". MIT Kerberos. 10 September 2015. http://web.mit.edu/kerberos/.
10. ↑ Schneier, Bruce (1997). Applied Cryptography. New York: John Wiley & Sons, Inc.. pp. 52–74. ISBN 0-471-12845-7.
11. ↑ "Protocols of the Past". Stanford University. http://srp.stanford.edu/history.html.
12. ↑ Alghamdi, A. M. (2025). Design and analysis of lightweight and robust authentication protocol for securing the resource constrained IIoT environment. PLoS ONE, 20(2), e0318064. https://doi.org/10.1371/journal.pone.0318064

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Authentication protocol. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Authentication_protocol&oldid=4230872"