Protecting your R&D investment with secure authentication

Authentication is a process with the objective to establish proof of identity between two or more entities. In the case of one-way authentication, just one party is involved proving its identity to another. With two-way authentication, both parties prove their identity to each other. The most commonly used method of authentication is the password. The main problem with passwords is that they are exposed when used,making them vulnerable to spying.

After reviewing the historical use of cryptography, in 1883 the Flemish linguist Auguste Kerckhoffs published his findings in a ground-breaking article on military cryptography. Kerckhoffs argued that instead of relying on obscurity, security should depend on the strength of keys, because in the event of a breach, only the keys would need to be replaced, not the whole system.

A proven symmetric key-based authentication method works as shown in Figure 1: a secret key and the to-be-authenticated data (“message”) are taken as input to compute a message authentication code or MAC. The MAC is then attached to the message and transmitted upon request. The recipient of the message performs the same computation and compares its version of the MAC to the one received with the message. If both MACs match, the message is authentic. A weakness with this basic model, however, is that a static, intercepted message and MAC can later, or subsequently, be replayed by a nonauthentic sender and be mistaken as authentic.