Human–computer cryptography: An attempt

Abstract

Can you securely prove your identity to a host computer by using no dedicated software at your terminal and no dedicated token at your hands? Conventional password checking schemes do not need such a software and hardware but have a disadvantage that an attacker who has correctly observed an input password by peeping or wiretapping can perfectly impersonate the corresponding user. Conventional dynamic (one-time) password schemes or zero-knowledge identification schemes can be securely implemented but require special software or hardware or memorandums. This paper develops human-friendly identification schemes such that a human prover knowing a secret key in her or his brain is asked a visual question by a machine verifier, who then checks if an answer sent from the prover matches the question with respect to the key. The novelty of these schemes lies in their ways of displaying questions. This paper also examines an application of the human identification schemes to human–computer cryptographic communication protocols.

Keywords

Authentication human–computer interaction passwords information security

Get full access to this article

View all access options for this article.

References

D.M.

Davies and

W.L.

Price, Security for Computer Networks, Chapter 7, John Wiley and Sons, 1984.

J.G.

Steiner,

Neuman and

J.I.

Schiller, Kerberos: An authentication service for open network systems, in: USENIX Conference Proceedings, February 1988, pp. 191–202.

Matsumoto and

Imai, Human identification through insecure channel, in: Advances in Cryptology – EUROCRYPT’91, LNCS, Vol. 547, Springer-Verlag, 1991, pp. 409–421.

Fiat and

Shamir, How to prove yourself: Practical solutions to identification and signature problems, in: Advances in Cryptology – CRYPTO’86, LNCS, Vol. 263, Springer-Verlag, 1987, pp. 186–194.

Lamport, Password authentication with insecure communication, Communications of ACM 24(11) (1981), 770–772.

N.M.

Haller, The S/KEY™ one-time password system, in: Proceedings of Internet Society Symposium on Network and Distribution System Security, 1994, pp. 151–157.

C.H.

Wang,

Hwang and

J.J.

Tsai, On the Matsumoto and Imai’s human identification scheme, in: Advances in Cryptology – EUROCRYPT’95, LNCS, Vol. 921, Springer-Verlag, 1995, pp. 382–392.