Dağıtılmış Tek Parolalı Protokoller

Passwords are the most widely used factor in various areas such as secret sharing, key establishment, and user authentication. Single password protocols are proposed (starting with [Belenkiy et al., 2011]) to overcome the challenges of traditional password protocols and provide provable security against o ffline dictionary, man-in-the-middle, phishing, and honeypot attacks. While they ensure provable security, they allow a user securely to use a single low-entropy human-memorable password for all her accounts. They achieve this with the help of a cloud or mobile storage device. However, an attacker corrupting both the login server and storage can mount an o nline dictionary attack on user's single password. In this thesis, we introduce a framework for distributed single password protocols (DiSPP) that analyzes existing protocols, improves upon them regarding novel constructions and distributed schemes, and allows exploiting alternative cryptographic primitives to obtain secure distributed single password protocols with various tradeoffs. Previous single password solutions can be instantiated as part of our framework. We further introduce a secure DiSPP instantiation derived from our framework enforcing the adversary to corrupt several cloud and mobile storage devices in addition to the login server in order to perform a successful o ffline dictionary attack. We also provide a comparative analysis of different solutions derived from our framework. We de fine ideal and real world indistinguishability for DiSPP, and formally prove security of our proposed solution via ideal-real simulation. Finally, we implement two DiSPP instantiations (based on mobile and cloud) and assess their usability with their counterparts (traditional password and two-factor authentication). We conclude that DiSPP systems overall constitute a usable alternative to existing solutions that do not provide o ffline dictionary attack protection.