Cryptographic techniques for secure
authentication and access control
Introduction
Cryptographic techniques play an important role in securing digital
information and systems from unauthorized access. Strong authentication
and access control mechanisms are essential for protecting sensitive data
and resources. This paper discusses some important cryptographic
techniques that are commonly used for secure authentication and access
control purposes.
Symmetric Cryptography
Symmetric cryptography, also known as private-key cryptography, is a
technique where the same cryptographic key is used for both encryption and
decryption of data. Some common symmetric algorithms used for
authentication and access control include AES, 3DES and Blowfish.
Symmetric algorithms are typically faster than asymmetric ones as fewer
computational resources are required for encryption and decryption. They
are well-suited for encrypting large volumes of data. However, a major
drawback is the need to distribute cryptographic keys securely to
communicating parties before encrypted communication can take place.
One way symmetric cryptography is used for authentication is by employing
message authentication codes (MACs). MAC algorithms such as HMAC
produce a cryptographic checksum for a message using a secret shared key.
The receiver can recompute the MAC and verify the integrity and authenticity
of the received data by comparing it to the transmitted MAC.
Access control systems often rely on symmetric cryptography to securely
store user credentials like passwords. Strong hashing algorithms like bcrypt,
scrypt and Argon2 are commonly used to generate password hashes from
user input. These hashes are then stored in the system’s database for
verification during login. Salting is typically used to add randomness to
passwords before hashing to further strengthen security against
precomputed rainbow table attacks.
Asymmetric Cryptography
Asymmetric or public-key cryptography addresses the key distribution
problem of symmetric cryptography through the use of unique public-private
key pairs. Each user has both a public key which is openly shared, and a
private key which is kept secret. Data encrypted with the public key can only
be decrypted with the associated private key, and vice versa.
Public-key cryptography plays a vital role in secure user authentication over
open networks by enabling the establishment of encrypted sessions without
requiring any pre-shared keys. The most widely used public-key algorithm is
RSA, though other options like elliptic curve cryptography provide
comparable security with smaller key sizes.
Digital signatures can be generated by signing a hash of data with the
sender’s private key. Anyone with access to the corresponding public key can
verify the signature to authenticate the identity of the sender. This allows
authenticated and integrity-checked communication without requiring a
shared secret between parties. Signatures are commonly used to issue and
verify authentication tokens for single sign-on systems.
X.509 Certificates
X.509 is an important public-key infrastructure (PKI) standard used to issue
and manage digital certificates containing a public key and identity
information belonging to an individual, server or other entity.
Certificates help address the public-key identity problem through the use of
certificate authorities (CAs). A CA acts as a trusted third party that verifies
and validates the identity of certificate holders before signing their
certificates. Web browsers and operating systems maintain a list of trusted
root CAs to verify certificates during TLS/SSL protected communication.
Certificates typically contain fields for the certificate issuer, validity period,
subject, associated public key and the digital signature of the issuer. They
establish a trusted association between a public key and identity, allowing
authentic encrypted communication and validation of website identities
through HTTPS.
Certificates also play a role in secure access control by enabling
authentication of clients to servers through TLS client authentication. This
binds a certificate and associated private key to a unique client, allowing
servers to verify client identities and attributes upon connection. Certificate
attributes can represent group memberships for authorization decisions.
Digital Signatures
Digital signatures provide a way to cryptographically sign digital documents
or messages to achieve data integrity, authentication and non-repudiation.
Producing a digital signature involves hashing the plaintext message and
encrypting the hash value with the signer’s private key, producing what’s
known as a signature value.
Anyone with access to the corresponding public key can verify the signature
by decrypting the signature value to recover the hash, recomputing the hash
of the original message, and comparing the two hashes. If they match, it
confirms the identity of the signer and that the message was not altered
after being signed.
Digital signatures are used extensively for authentication in applications that
involve legally binding electronic records. Signature algorithms commonly
used include RSA, DSA and ECDSA. Standards like XML Signatures specify
how to apply digital signatures to XML data, enabling use cases like
authenticated e-signatures and document preservation.
Digital signatures have practical uses in authentication for applications
involving remotely signed application/document forms, authenticated code
signing for downloading trusted software updates and tamper-detection of
digitally archived records. Their cryptographic properties make digital
signatures a core technology for secure systems that require non-repudiation
of signed transactions.
Password Hashing Standards
As mentioned earlier, hashing is commonly used to securely store password
credentials in authentication databases. However, weak password hashing
techniques from early systems have allowed large data breaches to occur
through offline cracking of password hashes. To address this, organizations
have transitioned to more secure password hashing standards.
The NIST cryptographic standards now recommend use of adaptive one-way
functions like Argon2, bcrypt or scrypt for password storage. These are
designed to be costly to compute, which prevents brute-force cracking
attempts against password hashes. Parameters like the computational cost,
salt and iterations can be tuned to keep up with ever-increasing computing
power.
Standards like STORNG Framework and NIST 800-63B provide best practices
guidance on implementing password storage securely. This includes
requirements around hashes suited for the protection level needed, salt sizes
of at least 16 bytes, high computational costs and preventing rainbow table
precomputation through per-password salts. Properly implementing modern
standards greatly increases the work factor needed to compromise password
hashes.
Multi-Factor Authentication
Relying solely on passwords has limitations in terms of usable strength and
susceptibility to phishing. Multi-factor authentication (MFA) enhances
security by requiring two or more verification factors from different
categories – something users know (password), something they have
(physical token) and something they are (biometrics).
Popular hardware MFA tokens include USB keys like Yubikeys which output
one-time codes. Software MFA tokens on mobile devices dynamically
generate time-based one-time passwords (TOTP). MFA methods like one-time
SMS codes provide a secondary means of vetting login attempts beyond a
single factor like passwords.
Biometrics are also increasingly used as a second factor through fingerprint,
facial or iris scans on supported devices. Standards like FIDO U2F have
helped drive adoption of hardware security keys for passwordless
authentication via platform authenticators using public-key cryptography.
Umbrella approaches for multi-factor authentication like FIDO2 are emerging
to provide an interoperable framework across devices and applications.
Rather than relying on a single point of failure, MFA makes account hijacking
far more difficult by requiring an attacker to compromise two or more
independent verification factors associated with the user’s identity. It
significantly raises the level of assurance provided by authentication and is
recommended for high-risk accounts or environments where advanced
threats may be present.
Cryptographically Generated Addresses
Cryptographic techniques can also help strengthen access controls without
necessarily involving secrets like passwords. Cryptographically Generated
Addresses (CGAs) are one such application which authenticates source IP
addresses using public-key cryptography.
CGAs enable endpoints to cryptographically sign their IP addresses and
include the associated public key within their packets. Verifiers can then
validate that the IP indeed originated from the claimed network location
through public-key signature verification. This provides binding between the
originating subnet and source IP, preventing spoofing.
CGAs could help secure protocols vulnerable to IP address spoofing like
SMTP, combat DDoS reflection attacks and validate source addresses used
for billing. They provide a way to authenticate properties of message
originators – like specific endpoints on authorized subnets – without
traditional authentication factors. However, CGAs require widespread
deployment and standardization to see significant benefits at internet scale.
Attribute-Based Access Control
Attribute-Based Access Control (ABAC) is an authorization model that
predicates access decisions on attributes of the requester, resource and
environment, rather than just user roles or identities. Attributes represent
properties or characteristics of authorization data and can include anything
relevant to access control like employer, department, location, security
clearance level and more.
ABAC policies allow fine-grained access rules by combining attributes using
logical conditions. For example, a policy could specify “Doctors from
Department X can view patient records only for their specialty at a specific
hospital”. The policy language is Turing-complete and can encode complex
relationships between various attributes in flexible ways.
Implementations of ABAC require maintaining attributes and associations
securely. Cryptographic techniques like encryption, signatures, hash chains
and blockchain can help establish attribute integrity and reliable attribute
sources. For example, a user’s attributes could be signed by an attribute
authority during authentication to prevent tampering. Blockchain may also
provide a means of establishing distributed attribute provenance through
audited transactions.
With proper standards and implementations, ABAC offers significant
advantages like decentralized administration of dynamic, context-aware
authorization policies. It is well-suited for cloud, IoT and other complex
application environments that require flexible, fine-grained access
management to diverse authorization data. Cryptography helps realize
ABAC’s full potential by enabling strong attribute integrity guarantees
essential for authorization decisions.
Blockchain for Identity and Access Management
Blockchain is an emerging decentralized ledger technology promising
applications beyond cryptocurrencies. It offers an append-only transactional
data structure secured by cryptographic hashing and distributed consensus.
Blockchain addresses some limitations of traditional centralized identity
systems through distributed credential management without single points of
failure or control.
Examples of identity use cases being explored include self-sovereign identity
models where end users own and securely manage their own decentralized
identifiers (DIDs) and verifiable credentials through blockchain wallets. Users
can prove attributes about themselves to relying parties without involving
centralized identity providers. Blockchain time-stamping also enables new
non-repudiation capabilities by anchoring evidence of events or transactions.
Frameworks like Sovrin aim to build global user-controlled networks for
managing verifiable claims on blockchain. Enterprises are prototyping private
permissioned blockchain networks for storing encrypted employee
credentials and entitlements. Smart contracts enable automated
enforcement of access policies. Over time, blockchain may reshape identity
and access management towards more user-centric models with improved
transparency, portability and reduced vulnerability to data breaches.
Cryptographic Agility
Finally, it is important that access control infrastructures do not rely on static
cryptography. Algorithms and key sizes that are secure today may become
vulnerable to advances in computing power over time. The National Institute
for Standards and Technology (NIST) periodically reviews and updates
recommendations for suitable cryptographic techniques.
Systems must support algorithm and key agility to smoothly transition
security as needed. For example, during the transition from 3DES to AES,
implementations supported both standards simultaneously before retiring
3DES. Protocols like TLS provide negotiation capabilities to select
cryptographic settings appropriate for endpoint capabilities. Likewise, hashed
passwords should periodically refresh to more modern standards like Argon2
instead of relying indefinitely on legacy techniques.
Well-designed access control frameworks make cryptographic choices
configurable rather than hard-coded, allowing parameters to be upgraded
proactively. This ensures they maintain security in line with evolving
recommendations from standards bodies, despite inevitable advances
breaking older cryptanalysis assumptions over the long run.
Conclusion
Secure authentication and access control depends on sound cryptographic
techniques at its core. This paper discussed how symmetric and asymmetric
cryptography, digital signatures, PKI, password hashing, MFA and emerging
approaches jointly provide robust yet flexible solutions for identity
management and access authorization. Properly applying standards with an
understanding of their strengths and weaknesses helps organizations defend
sensitive systems and data through resilient cryptographic security
measures with built-in agility. Continued advances will lead to further
innovation, but fundamental principles of cryptography will remain
indispensable for bolstering cyber defenses.
Cryptographic techniques play an important role in securing digital
information and systems from unauthorized access. Strong authentication
and access control mechanisms are essential for protecting sensitive data
and resources. This paper discusses some important cryptographic
techniques that are commonly used for secure authentication and access
control purposes.
Symmetric Cryptography
Symmetric cryptography, also known as private-key cryptography, is a
technique where the same cryptographic key is used for both encryption and
decryption of data. Some common symmetric algorithms used for
authentication and access control include AES, 3DES and Blowfish.
Symmetric algorithms are typically faster than asymmetric ones as fewer
computational resources are required for encryption and decryption. They
are well-suited for encrypting large volumes of data. However, a major
drawback is the need to distribute cryptographic keys securely to
communicating parties before encrypted communication can take place.
One way symmetric cryptography is used for authentication is by employing
message authentication codes (MACs). MAC algorithms such as HMAC
produce a cryptographic checksum for a message using a secret shared key.
The receiver can recompute the MAC and verify the integrity and authenticity
of the received data by comparing it to the transmitted MAC.
Access control systems often rely on symmetric cryptography to securely
store user credentials like passwords. Strong hashing algorithms like bcrypt,
scrypt and Argon2 are commonly used to generate password hashes from
user input. These hashes are then stored in the system’s database for
verification during login. Salting is typically used to add randomness to
passwords before hashing to further strengthen security against
precomputed rainbow table attacks.
Asymmetric Cryptography
Asymmetric or public-key cryptography addresses the key distribution
problem of symmetric cryptography through the use of unique public-private
key pairs. Each user has both a public key which is openly shared, and a
private key which is kept secret. Data encrypted with the public key can only
be decrypted with the associated private key, and vice versa.
Public-key cryptography plays a vital role in secure user authentication over
open networks by enabling the establishment of encrypted sessions without
requiring any pre-shared keys. The most widely used public-key algorithm is
RSA, though other options like elliptic curve cryptography provide
comparable security with smaller key sizes.
Digital signatures can be generated by signing a hash of data with the
sender’s private key. Anyone with access to the corresponding public key can
verify the signature to authenticate the identity of the sender. This allows
authenticated and integrity-checked communication without requiring a
shared secret between parties. Signatures are commonly used to issue and
verify authentication tokens for single sign-on systems.
X.509 Certificates
X.509 is an important public-key infrastructure (PKI) standard used to issue
and manage digital certificates containing a public key and identity
information belonging to an individual, server or other entity.
Certificates help address the public-key identity problem through the use of
certificate authorities (CAs). A CA acts as a trusted third party that verifies
and validates the identity of certificate holders before signing their
certificates. Web browsers and operating systems maintain a list of trusted
root CAs to verify certificates during TLS/SSL protected communication.
Certificates typically contain fields for the certificate issuer, validity period,
subject, associated public key and the digital signature of the issuer. They
establish a trusted association between a public key and identity, allowing
authentic encrypted communication and validation of website identities
through HTTPS.
Certificates also play a role in secure access control by enabling
authentication of clients to servers through TLS client authentication. This
binds a certificate and associated private key to a unique client, allowing
servers to verify client identities and attributes upon connection. Certificate
attributes can represent group memberships for authorization decisions.
Digital Signatures
Digital signatures provide a way to cryptographically sign digital documents
or messages to achieve data integrity, authentication and non-repudiation.
Producing a digital signature involves hashing the plaintext message and
encrypting the hash value with the signer’s private key, producing what’s
known as a signature value.
Anyone with access to the corresponding public key can verify the signature
by decrypting the signature value to recover the hash, recomputing the hash
of the original message, and comparing the two hashes. If they match, it
confirms the identity of the signer and that the message was not altered
after being signed.
Digital signatures are used extensively for authentication in applications that
involve legally binding electronic records. Signature algorithms commonly
used include RSA, DSA and ECDSA. Standards like XML Signatures specify
how to apply digital signatures to XML data, enabling use cases like
authenticated e-signatures and document preservation.
Digital signatures have practical uses in authentication for applications
involving remotely signed application/document forms, authenticated code
signing for downloading trusted software updates and tamper-detection of
digitally archived records. Their cryptographic properties make digital
signatures a core technology for secure systems that require non-repudiation
of signed transactions.
Password Hashing Standards
As mentioned earlier, hashing is commonly used to securely store password
credentials in authentication databases. However, weak password hashing
techniques from early systems have allowed large data breaches to occur
through offline cracking of password hashes. To address this, organizations
have transitioned to more secure password hashing standards.
The NIST cryptographic standards now recommend use of adaptive one-way
functions like Argon2, bcrypt or scrypt for password storage. These are
designed to be costly to compute, which prevents brute-force cracking
attempts against password hashes. Parameters like the computational cost,
salt and iterations can be tuned to keep up with ever-increasing computing
power.
Standards like STORNG Framework and NIST 800-63B provide best practices
guidance on implementing password storage securely. This includes
requirements around hashes suited for the protection level needed, salt sizes
of at least 16 bytes, high computational costs and preventing rainbow table
precomputation through per-password salts. Properly implementing modern
standards greatly increases the work factor needed to compromise password
hashes.
Multi-Factor Authentication
Relying solely on passwords has limitations in terms of usable strength and
susceptibility to phishing. Multi-factor authentication (MFA) enhances
security by requiring two or more verification factors from different
categories – something users know (password), something they have
(physical token) and something they are (biometrics).
Popular hardware MFA tokens include USB keys like Yubikeys which output
one-time codes. Software MFA tokens on mobile devices dynamically
generate time-based one-time passwords (TOTP). MFA methods like one-time
SMS codes provide a secondary means of vetting login attempts beyond a
single factor like passwords.
Biometrics are also increasingly used as a second factor through fingerprint,
facial or iris scans on supported devices. Standards like FIDO U2F have
helped drive adoption of hardware security keys for passwordless
authentication via platform authenticators using public-key cryptography.
Umbrella approaches for multi-factor authentication like FIDO2 are emerging
to provide an interoperable framework across devices and applications.
Rather than relying on a single point of failure, MFA makes account hijacking
far more difficult by requiring an attacker to compromise two or more
independent verification factors associated with the user’s identity. It
significantly raises the level of assurance provided by authentication and is
recommended for high-risk accounts or environments where advanced
threats may be present.
Cryptographically Generated Addresses
Cryptographic techniques can also help strengthen access controls without
necessarily involving secrets like passwords. Cryptographically Generated
Addresses (CGAs) are one such application which authenticates source IP
addresses using public-key cryptography.
CGAs enable endpoints to cryptographically sign their IP addresses and
include the associated public key within their packets. Verifiers can then
validate that the IP indeed originated from the claimed network location
through public-key signature verification. This provides binding between the
originating subnet and source IP, preventing spoofing.
CGAs could help secure protocols vulnerable to IP address spoofing like
SMTP, combat DDoS reflection attacks and validate source addresses used
for billing. They provide a way to authenticate properties of message
originators – like specific endpoints on authorized subnets – without
traditional authentication factors. However, CGAs require widespread
deployment and standardization to see significant benefits at internet scale.
Attribute-Based Access Control
Attribute-Based Access Control (ABAC) is an authorization model that
predicates access decisions on attributes of the requester, resource and
environment, rather than just user roles or identities. Attributes represent
properties or characteristics of authorization data and can include anything
relevant to access control like employer, department, location, security
clearance level and more.
ABAC policies allow fine-grained access rules by combining attributes using
logical conditions. For example, a policy could specify “Doctors from
Department X can view patient records only for their specialty at a specific
hospital”. The policy language is Turing-complete and can encode complex
relationships between various attributes in flexible ways.
Implementations of ABAC require maintaining attributes and associations
securely. Cryptographic techniques like encryption, signatures, hash chains
and blockchain can help establish attribute integrity and reliable attribute
sources. For example, a user’s attributes could be signed by an attribute
authority during authentication to prevent tampering. Blockchain may also
provide a means of establishing distributed attribute provenance through
audited transactions.
With proper standards and implementations, ABAC offers significant
advantages like decentralized administration of dynamic, context-aware
authorization policies. It is well-suited for cloud, IoT and other complex
application environments that require flexible, fine-grained access
management to diverse authorization data. Cryptography helps realize
ABAC’s full potential by enabling strong attribute integrity guarantees
essential for authorization decisions.
Blockchain for Identity and Access Management
Blockchain is an emerging decentralized ledger technology promising
applications beyond cryptocurrencies. It offers an append-only transactional
data structure secured by cryptographic hashing and distributed consensus.
Blockchain addresses some limitations of traditional centralized identity
systems through distributed credential management without single points of
failure or control.
Examples of identity use cases being explored include self-sovereign identity
models where end users own and securely manage their own decentralized
identifiers (DIDs) and verifiable credentials through blockchain wallets. Users
can prove attributes about themselves to relying parties without involving
centralized identity providers. Blockchain time-stamping also enables new
non-repudiation capabilities by anchoring evidence of events or transactions.
Frameworks like Sovrin aim to build global user-controlled networks for
managing verifiable claims on blockchain. Enterprises are prototyping private
permissioned blockchain networks for storing encrypted employee
credentials and entitlements. Smart contracts enable automated
enforcement of access policies. Over time, blockchain may reshape identity
and access management towards more user-centric models with improved
transparency, portability and reduced vulnerability to data breaches.
Cryptographic Agility
Finally, it is important that access control infrastructures do not rely on static
cryptography. Algorithms and key sizes that are secure today may become
vulnerable to advances in computing power over time. The National Institute
for Standards and Technology (NIST) periodically reviews and updates
recommendations for suitable cryptographic techniques.
Systems must support algorithm and key agility to smoothly transition
security as needed. For example, during the transition from 3DES to AES,
implementations supported both standards simultaneously before retiring
3DES. Protocols like TLS provide negotiation capabilities to select
cryptographic settings appropriate for endpoint capabilities. Likewise, hashed
passwords should periodically refresh to more modern standards like Argon2
instead of relying indefinitely on legacy techniques.
Well-designed access control frameworks make cryptographic choices
configurable rather than hard-coded, allowing parameters to be upgraded
proactively. This ensures they maintain security in line with evolving
recommendations from standards bodies, despite inevitable advances
breaking older cryptanalysis assumptions over the long run.
Conclusion
Secure authentication and access control depends on sound cryptographic
techniques at its core. This paper discussed how symmetric and asymmetric
cryptography, digital signatures, PKI, password hashing, MFA and emerging
approaches jointly provide robust yet flexible solutions for identity
management and access authorization. Properly applying standards with an
understanding of their strengths and weaknesses helps organizations defend
sensitive systems and data through resilient cryptographic security
measures with built-in agility. Continued advances will lead to further
innovation, but fundamental principles of cryptography will remain
indispensable for bolstering cyber defenses.
Cryptographic techniques play an important role in securing digital
information and systems from unauthorized access. Strong authentication
and access control mechanisms are essential for protecting sensitive data
and resources. This paper discusses some important cryptographic
techniques that are commonly used for secure authentication and access
control purposes.
Symmetric Cryptography
Symmetric cryptography, also known as private-key cryptography, is a
technique where the same cryptographic key is used for both encryption and
decryption of data. Some common symmetric algorithms used for
authentication and access control include AES, 3DES and Blowfish.
Symmetric algorithms are typically faster than asymmetric ones as fewer
computational resources are required for encryption and decryption. They
are well-suited for encrypting large volumes of data. However, a major
drawback is the need to distribute cryptographic keys securely to
communicating parties before encrypted communication can take place.
One way symmetric cryptography is used for authentication is by employing
message authentication codes (MACs). MAC algorithms such as HMAC
produce a cryptographic checksum for a message using a secret shared key.
The receiver can recompute the MAC and verify the integrity and authenticity
of the received data by comparing it to the transmitted MAC.
Access control systems often rely on symmetric cryptography to securely
store user credentials like passwords. Strong hashing algorithms like bcrypt,
scrypt and Argon2 are commonly used to generate password hashes from
user input. These hashes are then stored in the system’s database for
verification during login. Salting is typically used to add randomness to
passwords before hashing to further strengthen security against
precomputed rainbow table attacks.
Asymmetric Cryptography
Asymmetric or public-key cryptography addresses the key distribution
problem of symmetric cryptography through the use of unique public-private
key pairs. Each user has both a public key which is openly shared, and a
private key which is kept secret. Data encrypted with the public key can only
be decrypted with the associated private key, and vice versa.
Public-key cryptography plays a vital role in secure user authentication over
open networks by enabling the establishment of encrypted sessions without
requiring any pre-shared keys. The most widely used public-key algorithm is
RSA, though other options like elliptic curve cryptography provide
comparable security with smaller key sizes.
Digital signatures can be generated by signing a hash of data with the
sender’s private key. Anyone with access to the corresponding public key can
verify the signature to authenticate the identity of the sender. This allows
authenticated and integrity-checked communication without requiring a
shared secret between parties. Signatures are commonly used to issue and
verify authentication tokens for single sign-on systems.
X.509 Certificates
X.509 is an important public-key infrastructure (PKI) standard used to issue
and manage digital certificates containing a public key and identity
information belonging to an individual, server or other entity.
Certificates help address the public-key identity problem through the use of
certificate authorities (CAs). A CA acts as a trusted third party that verifies
and validates the identity of certificate holders before signing their
certificates. Web browsers and operating systems maintain a list of trusted
root CAs to verify certificates during TLS/SSL protected communication.
Certificates typically contain fields for the certificate issuer, validity period,
subject, associated public key and the digital signature of the issuer. They
establish a trusted association between a public key and identity, allowing
authentic encrypted communication and validation of website identities
through HTTPS.
Certificates also play a role in secure access control by enabling
authentication of clients to servers through TLS client authentication. This
binds a certificate and associated private key to a unique client, allowing
servers to verify client identities and attributes upon connection. Certificate
attributes can represent group memberships for authorization decisions.
Digital Signatures
Digital signatures provide a way to cryptographically sign digital documents
or messages to achieve data integrity, authentication and non-repudiation.
Producing a digital signature involves hashing the plaintext message and
encrypting the hash value with the signer’s private key, producing what’s
known as a signature value.
Anyone with access to the corresponding public key can verify the signature
by decrypting the signature value to recover the hash, recomputing the hash
of the original message, and comparing the two hashes. If they match, it
confirms the identity of the signer and that the message was not altered
after being signed.
Digital signatures are used extensively for authentication in applications that
involve legally binding electronic records. Signature algorithms commonly
used include RSA, DSA and ECDSA. Standards like XML Signatures specify
how to apply digital signatures to XML data, enabling use cases like
authenticated e-signatures and document preservation.
Digital signatures have practical uses in authentication for applications
involving remotely signed application/document forms, authenticated code
signing for downloading trusted software updates and tamper-detection of
digitally archived records. Their cryptographic properties make digital
signatures a core technology for secure systems that require non-repudiation
of signed transactions.
Password Hashing Standards
As mentioned earlier, hashing is commonly used to securely store password
credentials in authentication databases. However, weak password hashing
techniques from early systems have allowed large data breaches to occur
through offline cracking of password hashes. To address this, organizations
have transitioned to more secure password hashing standards.
The NIST cryptographic standards now recommend use of adaptive one-way
functions like Argon2, bcrypt or scrypt for password storage. These are
designed to be costly to compute, which prevents brute-force cracking
attempts against password hashes. Parameters like the computational cost,
salt and iterations can be tuned to keep up with ever-increasing computing
power.
Standards like STORNG Framework and NIST 800-63B provide best practices
guidance on implementing password storage securely. This includes
requirements around hashes suited for the protection level needed, salt sizes
of at least 16 bytes, high computational costs and preventing rainbow table
precomputation through per-password salts. Properly implementing modern
standards greatly increases the work factor needed to compromise password
hashes.
Multi-Factor Authentication
Relying solely on passwords has limitations in terms of usable strength and
susceptibility to phishing. Multi-factor authentication (MFA) enhances
security by requiring two or more verification factors from different
categories – something users know (password), something they have
(physical token) and something they are (biometrics).
Popular hardware MFA tokens include USB keys like Yubikeys which output
one-time codes. Software MFA tokens on mobile devices dynamically
generate time-based one-time passwords (TOTP). MFA methods like one-time
SMS codes provide a secondary means of vetting login attempts beyond a
single factor like passwords.
Biometrics are also increasingly used as a second factor through fingerprint,
facial or iris scans on supported devices. Standards like FIDO U2F have
helped drive adoption of hardware security keys for passwordless
authentication via platform authenticators using public-key cryptography.
Umbrella approaches for multi-factor authentication like FIDO2 are emerging
to provide an interoperable framework across devices and applications.
Rather than relying on a single point of failure, MFA makes account hijacking
far more difficult by requiring an attacker to compromise two or more
independent verification factors associated with the user’s identity. It
significantly raises the level of assurance provided by authentication and is
recommended for high-risk accounts or environments where advanced
threats may be present.
Cryptographically Generated Addresses
Cryptographic techniques can also help strengthen access controls without
necessarily involving secrets like passwords. Cryptographically Generated
Addresses (CGAs) are one such application which authenticates source IP
addresses using public-key cryptography.
CGAs enable endpoints to cryptographically sign their IP addresses and
include the associated public key within their packets. Verifiers can then
validate that the IP indeed originated from the claimed network location
through public-key signature verification. This provides binding between the
originating subnet and source IP, preventing spoofing.
CGAs could help secure protocols vulnerable to IP address spoofing like
SMTP, combat DDoS reflection attacks and validate source addresses used
for billing. They provide a way to authenticate properties of message
originators – like specific endpoints on authorized subnets – without
traditional authentication factors. However, CGAs require widespread
deployment and standardization to see significant benefits at internet scale.
Attribute-Based Access Control
Attribute-Based Access Control (ABAC) is an authorization model that
predicates access decisions on attributes of the requester, resource and
environment, rather than just user roles or identities. Attributes represent
properties or characteristics of authorization data and can include anything
relevant to access control like employer, department, location, security
clearance level and more.
ABAC policies allow fine-grained access rules by combining attributes using
logical conditions. For example, a policy could specify “Doctors from
Department X can view patient records only for their specialty at a specific
hospital”. The policy language is Turing-complete and can encode complex
relationships between various attributes in flexible ways.
Implementations of ABAC require maintaining attributes and associations
securely. Cryptographic techniques like encryption, signatures, hash chains
and blockchain can help establish attribute integrity and reliable attribute
sources. For example, a user’s attributes could be signed by an attribute
authority during authentication to prevent tampering. Blockchain may also
provide a means of establishing distributed attribute provenance through
audited transactions.
With proper standards and implementations, ABAC offers significant
advantages like decentralized administration of dynamic, context-aware
authorization policies. It is well-suited for cloud, IoT and other complex
application environments that require flexible, fine-grained access
management to diverse authorization data. Cryptography helps realize
ABAC’s full potential by enabling strong attribute integrity guarantees
essential for authorization decisions.
Blockchain for Identity and Access Management
Blockchain is an emerging decentralized ledger technology promising
applications beyond cryptocurrencies. It offers an append-only transactional
data structure secured by cryptographic hashing and distributed consensus.
Blockchain addresses some limitations of traditional centralized identity
systems through distributed credential management without single points of
failure or control.
Examples of identity use cases being explored include self-sovereign identity
models where end users own and securely manage their own decentralized
identifiers (DIDs) and verifiable credentials through blockchain wallets. Users
can prove attributes about themselves to relying parties without involving
centralized identity providers. Blockchain time-stamping also enables new
non-repudiation capabilities by anchoring evidence of events or transactions.
Frameworks like Sovrin aim to build global user-controlled networks for
managing verifiable claims on blockchain. Enterprises are prototyping private
permissioned blockchain networks for storing encrypted employee
credentials and entitlements. Smart contracts enable automated
enforcement of access policies. Over time, blockchain may reshape identity
and access management towards more user-centric models with improved
transparency, portability and reduced vulnerability to data breaches.
Cryptographic Agility
Finally, it is important that access control infrastructures do not rely on static
cryptography. Algorithms and key sizes that are secure today may become
vulnerable to advances in computing power over time. The National Institute
for Standards and Technology (NIST) periodically reviews and updates
recommendations for suitable cryptographic techniques.
Systems must support algorithm and key agility to smoothly transition
security as needed. For example, during the transition from 3DES to AES,
implementations supported both standards simultaneously before retiring
3DES. Protocols like TLS provide negotiation capabilities to select
cryptographic settings appropriate for endpoint capabilities. Likewise, hashed
passwords should periodically refresh to more modern standards like Argon2
instead of relying indefinitely on legacy techniques.
Well-designed access control frameworks make cryptographic choices
configurable rather than hard-coded, allowing parameters to be upgraded
proactively. This ensures they maintain security in line with evolving
recommendations from standards bodies, despite inevitable advances
breaking older cryptanalysis assumptions over the long run.
Conclusion
Secure authentication and access control depends on sound cryptographic
techniques at its core. This paper discussed how symmetric and asymmetric
cryptography, digital signatures, PKI, password hashing, MFA and emerging
approaches jointly provide robust yet flexible solutions for identity
management and access authorization. Properly applying standards with an
understanding of their strengths and weaknesses helps organizations defend
sensitive systems and data through resilient cryptographic security
measures with built-in agility. Continued advances will lead to further
innovation, but fundamental principles of cryptography will remain
indispensable for bolstering cyber defenses.
Cryptographic techniques play an important role in securing digital
information and systems from unauthorized access. Strong authentication
and access control mechanisms are essential for protecting sensitive data
and resources. This paper discusses some important cryptographic
techniques that are commonly used for secure authentication and access
control purposes.
Symmetric Cryptography
Symmetric cryptography, also known as private-key cryptography, is a
technique where the same cryptographic key is used for both encryption and
decryption of data. Some common symmetric algorithms used for
authentication and access control include AES, 3DES and Blowfish.
Symmetric algorithms are typically faster than asymmetric ones as fewer
computational resources are required for encryption and decryption. They
are well-suited for encrypting large volumes of data. However, a major
drawback is the need to distribute cryptographic keys securely to
communicating parties before encrypted communication can take place.
One way symmetric cryptography is used for authentication is by employing
message authentication codes (MACs). MAC algorithms such as HMAC
produce a cryptographic checksum for a message using a secret shared key.
The receiver can recompute the MAC and verify the integrity and authenticity
of the received data by comparing it to the transmitted MAC.
Access control systems often rely on symmetric cryptography to securely
store user credentials like passwords. Strong hashing algorithms like bcrypt,
scrypt and Argon2 are commonly used to generate password hashes from
user input. These hashes are then stored in the system’s database for
verification during login. Salting is typically used to add randomness to
passwords before hashing to further strengthen security against
precomputed rainbow table attacks.
Asymmetric Cryptography
Asymmetric or public-key cryptography addresses the key distribution
problem of symmetric cryptography through the use of unique public-private
key pairs. Each user has both a public key which is openly shared, and a
private key which is kept secret. Data encrypted with the public key can only
be decrypted with the associated private key, and vice versa.
Public-key cryptography plays a vital role in secure user authentication over
open networks by enabling the establishment of encrypted sessions without
requiring any pre-shared keys. The most widely used public-key algorithm is
RSA, though other options like elliptic curve cryptography provide
comparable security with smaller key sizes.
Digital signatures can be generated by signing a hash of data with the
sender’s private key. Anyone with access to the corresponding public key can
verify the signature to authenticate the identity of the sender. This allows
authenticated and integrity-checked communication without requiring a
shared secret between parties. Signatures are commonly used to issue and
verify authentication tokens for single sign-on systems.
X.509 Certificates
X.509 is an important public-key infrastructure (PKI) standard used to issue
and manage digital certificates containing a public key and identity
information belonging to an individual, server or other entity.
Certificates help address the public-key identity problem through the use of
certificate authorities (CAs). A CA acts as a trusted third party that verifies
and validates the identity of certificate holders before signing their
certificates. Web browsers and operating systems maintain a list of trusted
root CAs to verify certificates during TLS/SSL protected communication.
Certificates typically contain fields for the certificate issuer, validity period,
subject, associated public key and the digital signature of the issuer. They
establish a trusted association between a public key and identity, allowing
authentic encrypted communication and validation of website identities
through HTTPS.
Certificates also play a role in secure access control by enabling
authentication of clients to servers through TLS client authentication. This
binds a certificate and associated private key to a unique client, allowing
servers to verify client identities and attributes upon connection. Certificate
attributes can represent group memberships for authorization decisions.
Digital Signatures
Digital signatures provide a way to cryptographically sign digital documents
or messages to achieve data integrity, authentication and non-repudiation.
Producing a digital signature involves hashing the plaintext message and
encrypting the hash value with the signer’s private key, producing what’s
known as a signature value.
Anyone with access to the corresponding public key can verify the signature
by decrypting the signature value to recover the hash, recomputing the hash
of the original message, and comparing the two hashes. If they match, it
confirms the identity of the signer and that the message was not altered
after being signed.
Digital signatures are used extensively for authentication in applications that
involve legally binding electronic records. Signature algorithms commonly
used include RSA, DSA and ECDSA. Standards like XML Signatures specify
how to apply digital signatures to XML data, enabling use cases like
authenticated e-signatures and document preservation.
Digital signatures have practical uses in authentication for applications
involving remotely signed application/document forms, authenticated code
signing for downloading trusted software updates and tamper-detection of
digitally archived records. Their cryptographic properties make digital
signatures a core technology for secure systems that require non-repudiation
of signed transactions.
Password Hashing Standards
As mentioned earlier, hashing is commonly used to securely store password
credentials in authentication databases. However, weak password hashing
techniques from early systems have allowed large data breaches to occur
through offline cracking of password hashes. To address this, organizations
have transitioned to more secure password hashing standards.
The NIST cryptographic standards now recommend use of adaptive one-way
functions like Argon2, bcrypt or scrypt for password storage. These are
designed to be costly to compute, which prevents brute-force cracking
attempts against password hashes. Parameters like the computational cost,
salt and iterations can be tuned to keep up with ever-increasing computing
power.
Standards like STORNG Framework and NIST 800-63B provide best practices
guidance on implementing password storage securely. This includes
requirements around hashes suited for the protection level needed, salt sizes
of at least 16 bytes, high computational costs and preventing rainbow table
precomputation through per-password salts. Properly implementing modern
standards greatly increases the work factor needed to compromise password
hashes.
Multi-Factor Authentication
Relying solely on passwords has limitations in terms of usable strength and
susceptibility to phishing. Multi-factor authentication (MFA) enhances
security by requiring two or more verification factors from different
categories – something users know (password), something they have
(physical token) and something they are (biometrics).
Popular hardware MFA tokens include USB keys like Yubikeys which output
one-time codes. Software MFA tokens on mobile devices dynamically
generate time-based one-time passwords (TOTP). MFA methods like one-time
SMS codes provide a secondary means of vetting login attempts beyond a
single factor like passwords.
Biometrics are also increasingly used as a second factor through fingerprint,
facial or iris scans on supported devices. Standards like FIDO U2F have
helped drive adoption of hardware security keys for passwordless
authentication via platform authenticators using public-key cryptography.
Umbrella approaches for multi-factor authentication like FIDO2 are emerging
to provide an interoperable framework across devices and applications.
Rather than relying on a single point of failure, MFA makes account hijacking
far more difficult by requiring an attacker to compromise two or more
independent verification factors associated with the user’s identity. It
significantly raises the level of assurance provided by authentication and is
recommended for high-risk accounts or environments where advanced
threats may be present.
Cryptographically Generated Addresses
Cryptographic techniques can also help strengthen access controls without
necessarily involving secrets like passwords. Cryptographically Generated
Addresses (CGAs) are one such application which authenticates source IP
addresses using public-key cryptography.
CGAs enable endpoints to cryptographically sign their IP addresses and
include the associated public key within their packets. Verifiers can then
validate that the IP indeed originated from the claimed network location
through public-key signature verification. This provides binding between the
originating subnet and source IP, preventing spoofing.
CGAs could help secure protocols vulnerable to IP address spoofing like
SMTP, combat DDoS reflection attacks and validate source addresses used
for billing. They provide a way to authenticate properties of message
originators – like specific endpoints on authorized subnets – without
traditional authentication factors. However, CGAs require widespread
deployment and standardization to see significant benefits at internet scale.
Attribute-Based Access Control
Attribute-Based Access Control (ABAC) is an authorization model that
predicates access decisions on attributes of the requester, resource and
environment, rather than just user roles or identities. Attributes represent
properties or characteristics of authorization data and can include anything
relevant to access control like employer, department, location, security
clearance level and more.
ABAC policies allow fine-grained access rules by combining attributes using
logical conditions. For example, a policy could specify “Doctors from
Department X can view patient records only for their specialty at a specific
hospital”. The policy language is Turing-complete and can encode complex
relationships between various attributes in flexible ways.
Implementations of ABAC require maintaining attributes and associations
securely. Cryptographic techniques like encryption, signatures, hash chains
and blockchain can help establish attribute integrity and reliable attribute
sources. For example, a user’s attributes could be signed by an attribute
authority during authentication to prevent tampering. Blockchain may also
provide a means of establishing distributed attribute provenance through
audited transactions.
With proper standards and implementations, ABAC offers significant
advantages like decentralized administration of dynamic, context-aware
authorization policies. It is well-suited for cloud, IoT and other complex
application environments that require flexible, fine-grained access
management to diverse authorization data. Cryptography helps realize
ABAC’s full potential by enabling strong attribute integrity guarantees
essential for authorization decisions.
Blockchain for Identity and Access Management
Blockchain is an emerging decentralized ledger technology promising
applications beyond cryptocurrencies. It offers an append-only transactional
data structure secured by cryptographic hashing and distributed consensus.
Blockchain addresses some limitations of traditional centralized identity
systems through distributed credential management without single points of
failure or control.
Examples of identity use cases being explored include self-sovereign identity
models where end users own and securely manage their own decentralized
identifiers (DIDs) and verifiable credentials through blockchain wallets. Users
can prove attributes about themselves to relying parties without involving
centralized identity providers. Blockchain time-stamping also enables new
non-repudiation capabilities by anchoring evidence of events or transactions.
Frameworks like Sovrin aim to build global user-controlled networks for
managing verifiable claims on blockchain. Enterprises are prototyping private
permissioned blockchain networks for storing encrypted employee
credentials and entitlements. Smart contracts enable automated
enforcement of access policies. Over time, blockchain may reshape identity
and access management towards more user-centric models with improved
transparency, portability and reduced vulnerability to data breaches.
Cryptographic Agility
Finally, it is important that access control infrastructures do not rely on static
cryptography. Algorithms and key sizes that are secure today may become
vulnerable to advances in computing power over time. The National Institute
for Standards and Technology (NIST) periodically reviews and updates
recommendations for suitable cryptographic techniques.
Systems must support algorithm and key agility to smoothly transition
security as needed. For example, during the transition from 3DES to AES,
implementations supported both standards simultaneously before retiring
3DES. Protocols like TLS provide negotiation capabilities to select
cryptographic settings appropriate for endpoint capabilities. Likewise, hashed
passwords should periodically refresh to more modern standards like Argon2
instead of relying indefinitely on legacy techniques.
Well-designed access control frameworks make cryptographic choices
configurable rather than hard-coded, allowing parameters to be upgraded
proactively. This ensures they maintain security in line with evolving
recommendations from standards bodies, despite inevitable advances
breaking older cryptanalysis assumptions over the long run.
Conclusion
Secure authentication and access control depends on sound cryptographic
techniques at its core. This paper discussed how symmetric and asymmetric
cryptography, digital signatures, PKI, password hashing, MFA and emerging
approaches jointly provide robust yet flexible solutions for identity
management and access authorization. Properly applying standards with an
understanding of their strengths and weaknesses helps organizations defend
sensitive systems and data through resilient cryptographic security
measures with built-in agility. Continued advances will lead to further
innovation, but fundamental principles of cryptography will remain
indispensable for bolstering cyber defenses.
Cryptographic techniques play an important role in securing digital
information and systems from unauthorized access. Strong authentication
and access control mechanisms are essential for protecting sensitive data
and resources. This paper discusses some important cryptographic
techniques that are commonly used for secure authentication and access
control purposes.
Symmetric Cryptography
Symmetric cryptography, also known as private-key cryptography, is a
technique where the same cryptographic key is used for both encryption and
decryption of data. Some common symmetric algorithms used for
authentication and access control include AES, 3DES and Blowfish.
Symmetric algorithms are typically faster than asymmetric ones as fewer
computational resources are required for encryption and decryption. They
are well-suited for encrypting large volumes of data. However, a major
drawback is the need to distribute cryptographic keys securely to
communicating parties before encrypted communication can take place.
One way symmetric cryptography is used for authentication is by employing
message authentication codes (MACs). MAC algorithms such as HMAC
produce a cryptographic checksum for a message using a secret shared key.
The receiver can recompute the MAC and verify the integrity and authenticity
of the received data by comparing it to the transmitted MAC.
Access control systems often rely on symmetric cryptography to securely
store user credentials like passwords. Strong hashing algorithms like bcrypt,
scrypt and Argon2 are commonly used to generate password hashes from
user input. These hashes are then stored in the system’s database for
verification during login. Salting is typically used to add randomness to
passwords before hashing to further strengthen security against
precomputed rainbow table attacks.
Asymmetric Cryptography
Asymmetric or public-key cryptography addresses the key distribution
problem of symmetric cryptography through the use of unique public-private
key pairs. Each user has both a public key which is openly shared, and a
private key which is kept secret. Data encrypted with the public key can only
be decrypted with the associated private key, and vice versa.
Public-key cryptography plays a vital role in secure user authentication over
open networks by enabling the establishment of encrypted sessions without
requiring any pre-shared keys. The most widely used public-key algorithm is
RSA, though other options like elliptic curve cryptography provide
comparable security with smaller key sizes.
Digital signatures can be generated by signing a hash of data with the
sender’s private key. Anyone with access to the corresponding public key can
verify the signature to authenticate the identity of the sender. This allows
authenticated and integrity-checked communication without requiring a
shared secret between parties. Signatures are commonly used to issue and
verify authentication tokens for single sign-on systems.
X.509 Certificates
X.509 is an important public-key infrastructure (PKI) standard used to issue
and manage digital certificates containing a public key and identity
information belonging to an individual, server or other entity.
Certificates help address the public-key identity problem through the use of
certificate authorities (CAs). A CA acts as a trusted third party that verifies
and validates the identity of certificate holders before signing their
certificates. Web browsers and operating systems maintain a list of trusted
root CAs to verify certificates during TLS/SSL protected communication.
Certificates typically contain fields for the certificate issuer, validity period,
subject, associated public key and the digital signature of the issuer. They
establish a trusted association between a public key and identity, allowing
authentic encrypted communication and validation of website identities
through HTTPS.
Certificates also play a role in secure access control by enabling
authentication of clients to servers through TLS client authentication. This
binds a certificate and associated private key to a unique client, allowing
servers to verify client identities and attributes upon connection. Certificate
attributes can represent group memberships for authorization decisions.
Digital Signatures
Digital signatures provide a way to cryptographically sign digital documents
or messages to achieve data integrity, authentication and non-repudiation.
Producing a digital signature involves hashing the plaintext message and
encrypting the hash value with the signer’s private key, producing what’s
known as a signature value.
Anyone with access to the corresponding public key can verify the signature
by decrypting the signature value to recover the hash, recomputing the hash
of the original message, and comparing the two hashes. If they match, it
confirms the identity of the signer and that the message was not altered
after being signed.
Digital signatures are used extensively for authentication in applications that
involve legally binding electronic records. Signature algorithms commonly
used include RSA, DSA and ECDSA. Standards like XML Signatures specify
how to apply digital signatures to XML data, enabling use cases like
authenticated e-signatures and document preservation.
Digital signatures have practical uses in authentication for applications
involving remotely signed application/document forms, authenticated code
signing for downloading trusted software updates and tamper-detection of
digitally archived records. Their cryptographic properties make digital
signatures a core technology for secure systems that require non-repudiation
of signed transactions.
Password Hashing Standards
As mentioned earlier, hashing is commonly used to securely store password
credentials in authentication databases. However, weak password hashing
techniques from early systems have allowed large data breaches to occur
through offline cracking of password hashes. To address this, organizations
have transitioned to more secure password hashing standards.
The NIST cryptographic standards now recommend use of adaptive one-way
functions like Argon2, bcrypt or scrypt for password storage. These are
designed to be costly to compute, which prevents brute-force cracking
attempts against password hashes. Parameters like the computational cost,
salt and iterations can be tuned to keep up with ever-increasing computing
power.
Standards like STORNG Framework and NIST 800-63B provide best practices
guidance on implementing password storage securely. This includes
requirements around hashes suited for the protection level needed, salt sizes
of at least 16 bytes, high computational costs and preventing rainbow table
precomputation through per-password salts. Properly implementing modern
standards greatly increases the work factor needed to compromise password
hashes.
Multi-Factor Authentication
Relying solely on passwords has limitations in terms of usable strength and
susceptibility to phishing. Multi-factor authentication (MFA) enhances
security by requiring two or more verification factors from different
categories – something users know (password), something they have
(physical token) and something they are (biometrics).
Popular hardware MFA tokens include USB keys like Yubikeys which output
one-time codes. Software MFA tokens on mobile devices dynamically
generate time-based one-time passwords (TOTP). MFA methods like one-time
SMS codes provide a secondary means of vetting login attempts beyond a
single factor like passwords.
Biometrics are also increasingly used as a second factor through fingerprint,
facial or iris scans on supported devices. Standards like FIDO U2F have
helped drive adoption of hardware security keys for passwordless
authentication via platform authenticators using public-key cryptography.
Umbrella approaches for multi-factor authentication like FIDO2 are emerging
to provide an interoperable framework across devices and applications.
Rather than relying on a single point of failure, MFA makes account hijacking
far more difficult by requiring an attacker to compromise two or more
independent verification factors associated with the user’s identity. It
significantly raises the level of assurance provided by authentication and is
recommended for high-risk accounts or environments where advanced
threats may be present.
Cryptographically Generated Addresses
Cryptographic techniques can also help strengthen access controls without
necessarily involving secrets like passwords. Cryptographically Generated
Addresses (CGAs) are one such application which authenticates source IP
addresses using public-key cryptography.
CGAs enable endpoints to cryptographically sign their IP addresses and
include the associated public key within their packets. Verifiers can then
validate that the IP indeed originated from the claimed network location
through public-key signature verification. This provides binding between the
originating subnet and source IP, preventing spoofing.
CGAs could help secure protocols vulnerable to IP address spoofing like
SMTP, combat DDoS reflection attacks and validate source addresses used
for billing. They provide a way to authenticate properties of message
originators – like specific endpoints on authorized subnets – without
traditional authentication factors. However, CGAs require widespread
deployment and standardization to see significant benefits at internet scale.
Attribute-Based Access Control
Attribute-Based Access Control (ABAC) is an authorization model that
predicates access decisions on attributes of the requester, resource and
environment, rather than just user roles or identities. Attributes represent
properties or characteristics of authorization data and can include anything
relevant to access control like employer, department, location, security
clearance level and more.
ABAC policies allow fine-grained access rules by combining attributes using
logical conditions. For example, a policy could specify “Doctors from
Department X can view patient records only for their specialty at a specific
hospital”. The policy language is Turing-complete and can encode complex
relationships between various attributes in flexible ways.
Implementations of ABAC require maintaining attributes and associations
securely. Cryptographic techniques like encryption, signatures, hash chains
and blockchain can help establish attribute integrity and reliable attribute
sources. For example, a user’s attributes could be signed by an attribute
authority during authentication to prevent tampering. Blockchain may also
provide a means of establishing distributed attribute provenance through
audited transactions.
With proper standards and implementations, ABAC offers significant
advantages like decentralized administration of dynamic, context-aware
authorization policies. It is well-suited for cloud, IoT and other complex
application environments that require flexible, fine-grained access
management to diverse authorization data. Cryptography helps realize
ABAC’s full potential by enabling strong attribute integrity guarantees
essential for authorization decisions.
Blockchain for Identity and Access Management
Blockchain is an emerging decentralized ledger technology promising
applications beyond cryptocurrencies. It offers an append-only transactional
data structure secured by cryptographic hashing and distributed consensus.
Blockchain addresses some limitations of traditional centralized identity
systems through distributed credential management without single points of
failure or control.
Examples of identity use cases being explored include self-sovereign identity
models where end users own and securely manage their own decentralized
identifiers (DIDs) and verifiable credentials through blockchain wallets. Users
can prove attributes about themselves to relying parties without involving
centralized identity providers. Blockchain time-stamping also enables new
non-repudiation capabilities by anchoring evidence of events or transactions.
Frameworks like Sovrin aim to build global user-controlled networks for
managing verifiable claims on blockchain. Enterprises are prototyping private
permissioned blockchain networks for storing encrypted employee
credentials and entitlements. Smart contracts enable automated
enforcement of access policies. Over time, blockchain may reshape identity
and access management towards more user-centric models with improved
transparency, portability and reduced vulnerability to data breaches.
Cryptographic Agility
Finally, it is important that access control infrastructures do not rely on static
cryptography. Algorithms and key sizes that are secure today may become
vulnerable to advances in computing power over time. The National Institute
for Standards and Technology (NIST) periodically reviews and updates
recommendations for suitable cryptographic techniques.
Systems must support algorithm and key agility to smoothly transition
security as needed. For example, during the transition from 3DES to AES,
implementations supported both standards simultaneously before retiring
3DES. Protocols like TLS provide negotiation capabilities to select
cryptographic settings appropriate for endpoint capabilities. Likewise, hashed
passwords should periodically refresh to more modern standards like Argon2
instead of relying indefinitely on legacy techniques.
Well-designed access control frameworks make cryptographic choices
configurable rather than hard-coded, allowing parameters to be upgraded
proactively. This ensures they maintain security in line with evolving
recommendations from standards bodies, despite inevitable advances
breaking older cryptanalysis assumptions over the long run.
Conclusion
Secure authentication and access control depends on sound cryptographic
techniques at its core. This paper discussed how symmetric and asymmetric
cryptography, digital signatures, PKI, password hashing, MFA and emerging
approaches jointly provide robust yet flexible solutions for identity
management and access authorization. Properly applying standards with an
understanding of their strengths and weaknesses helps organizations defend
sensitive systems and data through resilient cryptographic security
measures with built-in agility. Continued advances will lead to further
innovation, but fundamental principles of cryptography will remain
indispensable for bolstering cyber defenses.
