Pico Without Public Keys

Abstract

Abstract. Pico is a user authentication system that does not require remembering secrets. It is based on a personal handheld token that holds the user's credentials and that is unlocked by a "personal aura" generated by digital accessories worn by the owner. The token, acting as prover, engages in a public-key-based authentication protocol with the verifier. What would happen to Pico if success of the mythical quantum computer meant secure public key primitives were no longer available, or if for other reasons such as energy consumption we preferred not to deploy them? More generally, what would happen under those circumstances to user authentication on the web, which relies heavily on public key cryptography through HTTPS/TLS? Although the symmetric-key-vs-public-key debate dates back to the 1990s, we note that the problematic aspects of public key deployment that were identified back then are still ubiquitous today. In particular, although public key cryptography is widely deployed on the web, revocation still doesn't work. We discuss ways of providing desirable properties of public-key-based user authentication systems using symmetric-key primitives and tamperevident tokens. In particular, we present a protocol through which a compromise of the user credentials file at one website does not require users to change their credentials at that website or any other. We also note that the current prototype of Pico, when working in compatibility mode through the Pico Lens (i.e. with websites that are unaware of the Pico protocols), doesn't actually use public key cryptography, other than that implicit in TLS. With minor tweaks we adopt this as the native mode for Pico, dropping public key cryptography and achieving much greater deployability without any noteworthy loss in security.

Pico in the Wild: Replacing Passwords, One Site at a Time

“…The work has generated many technical results (e.g. see Goldberg et al, Stajano et al and others [22], [23]), but only one user study has previously been conducted and published on nonfunctional Pico prototypes [20]. Some recent work by Urueña and Soto [24] has sought to empirically assess login times, but currently the work is in its early stages.…”

Low-Cost Mitigation Against Cold Boot Attacks for an Authentication Token

“…Whether the credentials in the Pico are public keys or symmetric keys [7], we achieve the above without resorting to public-key primitives, so as to facilitate energyefficient implementation and to avoid introducing a failure point under the threat that quantum computing might one day break today's public-key cryptosystems.…”

“…A Pico stores a potentially large number N of user credentials, grouped into 256 bins. 7 The value 256 is a parameter of the system; it is straightforward to make it larger, at the cost of somewhat increased implementation complexity. For each account the user has, there is one (userid, credential) pair.…”

“…The most obviously related work is Pico: the relevant papers from Stajano and his group [2,[6][7][8]17] have been extensively referred to throughout the text.…”