Abstract
Recently a convex hull based human identification protocol was proposed by Sobrado and Birget, whose steps can be performed by humans without additional aid. The main part of the protocol involves the user mentally forming a convex hull of secret icons in a set of graphical icons and then clicking randomly within this convex hull. In this paper we show two efficient probabilistic attacks on this protocol which reveal the user’s secret after the observation of only a handful of authentication sessions. We show that while the first attack can be mitigated through appropriately chosen values of system parameters, the second attack succeeds with a non-negligible probability even with large system parameter values which cross the threshold of usability.
The full edition of this paper is available at http://eprint.iacr.org/2010/478 .
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Sobrado, L., Birget, J.C.: Graphical Passwords. The Rutgers Scholar 4 (2002)
Zhao, H., Li, X.: S3PAS: A Scalable Shoulder-Surfing Resistant Textual-Graphical. In: AINAW 2007, pp. 467–472. IEEE Computer Society, Los Alamitos (2007)
Wiedenbeck, S., Waters, J., Sobrado, L., Birget, J.C.: Design and Evaluation of a Shoulder-Surfing Resistant Graphical Password Scheme. In: AVI 2006, pp. 177–184. ACM, New York (2006)
Matsumoto, T., Imai, H.: Human Identification through Insecure Channel. In: Davies, D.W. (ed.) EUROCRYPT 1991. LNCS, vol. 547, pp. 409–421. Springer, Heidelberg (1991)
Wang, C.H., Hwang, T., Tsai, J.J.: On the Matsumoto and Imai’s Human Identification Scheme. In: Guillou, L.C., Quisquater, J.-J. (eds.) EUROCRYPT 1995. LNCS, vol. 921, pp. 382–392. Springer, Heidelberg (1995)
Matsumoto, T.: Human-Computer Cryptography: An Attempt. In: CCS 1996, pp. 68–75. ACM, New York (1996)
Li, S., Shum, H.Y.: Secure Human-Computer Identification against Peeping Attacks (SecHCI): A Survey. Technical report (2003)
Hopper, N.J., Blum, M.: Secure Human Identification Protocols. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 52–66. Springer, Heidelberg (2001)
Weinshall, D.: Cognitive Authentication Schemes Safe Against Spyware (Short Paper). In: SP 2006, pp. 295–300. IEEE Computer Society, Los Alamitos (2006)
Bai, X., Gu, W., Chellappan, S., Wang, X., Xuan, D., Ma, B.: PAS: Predicate-based Authentication Services against Powerful Passive Adversaries. In: ACSAC 2008, pp. 433–442. IEEE Computer Society, Los Alamitos (2008)
Lei, M., Xiao, Y., Vrbsky, S.V., Li, C.C.: Virtual password using random linear functions for on-line services, ATM machines, and pervasive computing. Computer Communications 31, 4367–4375 (2008)
Golle, P., Wagner, D.: Cryptanalysis of a Cognitive Authentication Scheme (Extended Abstract). In: SP 2007, pp. 66–70. IEEE Computer Society, Los Alamitos (2007)
Li, S., Asghar, H.J., Pieprzyk, J., Sadeghi, A.R., Schmitz, R., Wang, H.: On the Security of PAS (Predicate-based Authentication Service). In: ACSAC 2009, pp. 209–218. IEEE Computer Society, Los Alamitos (2009)
Li, S., Khayam, S.A., Sadeghi, A.R., Schmitz, R.: Breaking Randomized Linear Generation Functions based Virtual Password System. To appear in ICC 2010 (2010)
Li, X.Y., Teng, S.H.: Practical Human-Machine Identification over Insecure Channels. Journal of Combinatorial Optimization 3, 347–361 (1999)
Jameel, H., Shaikh, R., Lee, H., Lee, S.: Human Identification Through Image Evaluation Using Secret Predicates. In: Abe, M. (ed.) CT-RSA 2007. LNCS, vol. 4377, pp. 67–84. Springer, Heidelberg (2006)
Jameel, H., Shaikh, R.A., Hung, L.X., Wei Wei, Y., Raazi, S.M.K., Canh, N.T., Lee, S., Lee, H., Son, Y., Fernandes, M.: Image-Feature Based Human Identification Protocols on Limited Display Devices. In: Chung, K.-I., Sohn, K., Yung, M. (eds.) WISA 2008. LNCS, vol. 5379, pp. 211–224. Springer, Heidelberg (2009)
Asghar, H.J., Pieprzyk, J., Wang, H.: A New Human Identification Protocol and Coppersmith’s Baby-Step Giant-Step Algorithm. In: Zhou, J., Yung, M. (eds.) ACNS 2010. LNCS, vol. 6123, pp. 349–366. Springer, Heidelberg (2010)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Asghar, H.J., Li, S., Pieprzyk, J., Wang, H. (2011). Cryptanalysis of the Convex Hull Click Human Identification Protocol. In: Burmester, M., Tsudik, G., Magliveras, S., Ilić, I. (eds) Information Security. ISC 2010. Lecture Notes in Computer Science, vol 6531. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-18178-8_3
Download citation
DOI: https://doi.org/10.1007/978-3-642-18178-8_3
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-18177-1
Online ISBN: 978-3-642-18178-8
eBook Packages: Computer ScienceComputer Science (R0)