Cyberstudy
PDF p.88 In progress

Hard Authentication Tokens

Open PDF at p.88 13 flashcards

Summary

PDF p.88

Hard authentication tokens use physical devices (authenticators) to generate or receive tokens that authenticate users. These tokens can be generated through certificate-based authentication, one-time passwords (OTP), or Fast Identity Online (FIDO) Universal 2nd Factor (U2F). Common devices include smart cards, OTP generators, and security keys.

In plain words

Supplementary — not from your PDF

Hard tokens are physical devices that prove you have something: smart cards with certificates, key fobs showing one-time codes, or USB/NFC security keys (FIDO). The secret stays inside the device.

Detailed explanation

PDF p.88
  • Ownership Factor
    • Definition: Users possess a device (authenticator) that generates or receives a token for authentication.
    • Types of Token Generation
    • Certificate-Based Authentication
      • Process: Uses a private key to generate a signed token, verified by a public key.
      • Drawback: Requires Public Key Infrastructure (PKI) for issuing digital certificates.
    • One-Time Password (OTP)
      • Process: Generates a token using a hash function on a shared secret and a synchronization seed (e.g., timestamp for TOTP or HMAC for HOTP).
      • Advantage: Does not require PKI.
    • FIDO U2F
      • Process: Uses a public/private key pair to register accounts, avoiding shared secrets.
      • Advantage: Does not rely on PKI.
  • Hard Authentication Tokens
    • Generation: Tokens are generated within a secure cryptoprocessor, with no transmission of the token itself.
    • Device Types
    • Smart Cards
      • Function: Store digital certificates, private keys, and a PIN for activation.
      • Types: Physical contact and contactless NFC cards.
    • One-Time Password (OTP) Generators
      • Function: Generate tokens without needing a computer interface; users read the displayed code.
    • Security Keys
      • Function: Portable hardware security modules (HSM) with interfaces like USB or NFC.
      • Features: Often associated with U2F, may support certificate-based authentication or HOTP/TOTP, and typically include an activation button or biometric fingerprint reader.
  • Static Tokens
    • Examples: Simple smart cards and fobs that transmit static tokens.
    • Vulnerability: Prone to cloning and replay attacks.

Important terms

taken from the text above
Ownership Factor
Users possess a device (authenticator) that generates or receives a token for authentication.
Drawback
Requires Public Key Infrastructure (PKI) for issuing digital certificates.
Generation
Tokens are generated within a secure cryptoprocessor, with no transmission of the token itself.
FIDO Fast Identity Online U2F Universal 2nd Factor PKI Public Key Infrastructure OTP One-Time Password

Examples & real-world scenarios

Supplementary — not from your PDF
  • A smart card with a certificate, unlocked by a PIN.
  • A key fob showing a new 6-digit code every 30 seconds (TOTP).
  • A USB security key you touch to approve a login.

Scenario

An organization using old badges that send the same static code is told they can be cloned. Moving to smart cards with cryptographic challenge-response fixes the replay risk.

Common mistakes

Supplementary — not from your PDF
  • Assuming all tokens are equal. Static tokens can be cloned and replayed.
  • Mixing up HOTP (counter-based) and TOTP (time-based).

Practical skills

Supplementary — not from your PDF
  • Compare smart cards, OTP fobs and security keys.

What I should remember

Key Points PDF p.88
  • Ownership Factor
    • Authenticator: Device generating/receiving tokens.
    • Token Generation Types
      • Certificate-Based: Uses private/public keys, requires PKI.
      • OTP: Uses hash functions, no PKI needed.
      • FIDO U2F: Uses key pairs, no shared secrets or PKI.
  • Hard Authentication Tokens
    • Generation: Secure cryptoprocessor.
    • Device Types
      • Smart Cards: Store certificates, keys, and PINs.
      • OTP Generators: Display tokens.
      • Security Keys: HSMs with USB/NFC, activation features.
  • Static Tokens
    • Examples: Simple smart cards/fobs.
    • Vulnerability: Cloning and replay attacks.