9
$\begingroup$

Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that the fingerprint of the server is the expected fingerprint. The user can phone the owner of the server, and confirm that the sequence of 32 hex digits are the ones shown on her screen.

The process seems vulnerable to the shortcomings of human perception, memory and energy. In practise, users do not check the fingerprint, because it is too tiresome.

The fingerprint could be made more memorable. For example, it is conceivable that a sequence of 32 hex digits could be reversibly converted to a sequence of eight English words. This would work as long as all implementations share the exact same bidirectional mapping between a tuple of four hex digits and between an English word. (I'm not asking for a review of this example, I'm just trying to explain the problem by explaining a naive solution.)

Within the cryptographic community, what is this problem called? Has there been any research on it?

Improve this question
$\endgroup$
3

2 Answers 2

Reset to default
10
$\begingroup$

I look forward to seeing more research on ways of representing cryptographically significant numbers in ways that are easier for humans to memorize or use in other ways.

memorizing and typing

There are several ways to bidirectionally convert a series of completely random bits into a series of English words and back again. (That series of English words is easier for a touch-typist to type in, easier for a human to memorize, easier for a human to visually compare two sequences, etc. than the same bits in the form of hex digits).

The most popular wordlists seem to be:

  • the Diceware wordlist of 7,776 unique words: any 64 bit number can be encoded into five words and back again.
  • The S/KEY one-time password system uses 2048 unique words: any 64 bit number can be encoded into 6 words and back again.
  • The mnemonicode system uses a dictionary of 1633 unique words: any 64 bit number can be encoded into 7 words and back again.
  • The PGP word list of 512 unique words: any 64 bit number can be encoded into 8 words and back again. (This system has an extra feature, not found in the other systems, that allows a repeated word to be immediately detected and the duplicated word dropped without error).

I find all of these systems much easier to use than raw hex digits. And by definition (because they are all various ways of encoding a completely random 64 bit number) they are all just as secure as 64 bits represented as raw hex digits or as a series of ASCII characters that includes lowercase, digits, punctuation, etc.

The size of the dictionary is a tradeoff: small dictionaries let you use common words that are much easier to remember how to spell, but force you to use more words to store a 64 bit number. Larger dictionaries force you to use uncommon words that may be difficult to spell or to distinguish from each other, but allow you to use fewer words to store that same number.

Alas, all the research I've seen in designing such wordlists involves making the words as distinguishable as possible from each other when one human reads the series of words to another over a noisy audio link.

comparing

The "visual host key" is intended to make it easy for humans to compare two SSH fingerprints. (See "ASCII Art Fingerprints"; also "Easy to remember fingerprints for data?" ) Compared to hex digits or English words, this "visual host key" seems to be easier for humans to visually compare two fingerprints. Alas, compared to a series of English words, it seems to be more difficult for a human to memorize and type back in a key in this form.

Improve this answer
$\endgroup$
0
$\begingroup$

Authentication can be done using three factors , what the user knows ( password , passphrase etc), what the user posses( smart card, pda etc ) , what the user is ( biometrics, retina scans etc), more here

Now Well the answer is multi fold . 1. If for a certain application , its difficult for the user to remember/memorize certain passphrase , then alternatives can be other factors like above 2. If the problem is with user memorizing , then its more of psychology research. There are few things like implicit learning etc being researched upon. For example check this paper and here

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.