International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Secure Human-Computer Identification (Interface) Systems against Peeping Attacks: SecHCI

Authors:
Shujun Li
Heung-Yeung Shum
Download:
URL: http://eprint.iacr.org/2005/268
Search ePrint
Search Google
Abstract: This paper focuses on human-computer identification systems against peeping attacks, in which adversaries can observe (and even control) interactions between humans (provers) and computers (verifiers). Real cases on peeping attacks were reported by Ross J. Anderson ten years before. Fixed passwords are insecure to peeping attacks since adversaries can simply replay the observed passwords. Some identification techniques can be used to defeat peeping attacks, but auxiliary devices must be used and such devices are also insecure against peeping attacks if they are lost or stolen. Although more and more people get to know risks from peeping attacks, a practical solution has not been found. This paper first gives a comprehensive review on peeping attacks and related issues, and then points out some basic design principles. Two general structures of secure human-computer identification systems are proposed against peeping attacks. A concrete SecHCI protocol and its various implementations are given, and a real Web service is developed for demonstration. The security and usability of the proposed protocol are investigated in detail. Although the usability of the proposed protocol is not yet sufficiently good, we believe that some design skills of the proposed protocol are useful for future work on SecHCI.
BibTeX
@misc{eprint-2005-12602,
  title={Secure Human-Computer Identification (Interface) Systems against Peeping Attacks: SecHCI},
  booktitle={IACR Eprint archive},
  keywords={cryptographic protocols /},
  url={http://eprint.iacr.org/2005/268},
  note={ hooklee@mail.com 13007 received 12 Aug 2005},
  author={Shujun Li and Heung-Yeung Shum},
  year=2005
}