Cryptography-Secure Login authentication design for Websites

User login is the basic function of any application system, especially for the internet banking system, the security of user login is especially important. How to design a secure login authentication program for a website is the main issue discussed in this paper.

Static password There are a lot of security risks, attackers have many means to obtain static password, management password also has a higher cost, I in the previous article "China Internet Banking system security analysis" has been demonstrated that the use of hardware security products "Dynamic password lock" or "USB Key" can be a better solution to this problem, But it will bring the cost of encryption lock, without increasing the cost of hardware, we can also through a number of design techniques and measures to a certain extent to ensure that the identity of the user.

　　One, client and server-side security

Client security, mainly the security of the user password itself (password length and complexity, etc.) and the security of the user's computer, including the user's computer does not install the hacker Trojan software, the login program is not loaded by the third party program debugging, user input box organization keyboard hook program, etc., through some code can be resolved.

Server-side security, including the security of the server itself (system vulnerabilities, etc.) and the design of the security, I am here to discuss the security of the program. The most basic problem is that the user's password should not be stored directly on the server's database, nor should the password be encrypted with a single-key algorithm to save, the most basic authentication method is through a one-way hash function to authenticate the password. In the article "Software encryption technology and registration mechanism", some unidirectional hashing functions are introduced to achieve simple authentication. Most Web sites now use the MD5 function for login authentication, but I recommend using a more secure SHA1 hash function for login authentication.

　　Second, the security of network transmission

The current network protocol communication through the HTTP protocol, there is a great security risk, hackers can use the sniffer tool to capture packet analysis network packets, so the user name and password transmission should be transmitted in a non-plaintext way, where the concept of "public key password" is used.

People who have learned basic cryptography should know that the concept of "public key algorithm (also known as asymmetric algorithm, double-key algorithm)", that is, the key used as encryption differs from the key used to decrypt it, and the decryption key cannot be computed from the encryption key.

Encryption of the transmission process is divided into two parts, part of the identity authentication, the user to identify the authenticity of the user, the other part of the data encryption for the confidentiality of data. Both of these functions require the use of asymmetric encryption techniques.

First, the identity authentication, the data of the communication can be processed so that the user's information (user name, password, etc.) is encrypted with the user's private key, and then transferred, and the server side will save the user's public key, with this user's public key to decrypt the information sent over, you can get the correct plaintext, This completes a secure network communication.

An example of the communication process is that Alice encrypts the plaintext with her private key and transmits it to the server, and the user on the server (for example, Bob) has a large number of users ' public keys, so the ciphertext is decrypted using Alice's public key, and if the key is correct, the plaintext can be decrypted. Also completed the identity of Alice.

Then is the data encryption, the data encryption and the data authentication is opposite, uses the receiver's public key to encrypt the data, transmits the process, even if the data is intercepted by the hacker, also cannot use these ciphertext, the receiving party receives the cipher text, uses own private key to decrypt the ciphertext, thus completes the data the encrypted transmission.

An example of the communication process is that Alice needs to send Bob a piece of encrypted information, so Alice uses Bob's public key to encrypt the plaintext after it is transmitted to the Bob,bob, and then decrypts the ciphertext using her private key to decrypt the plaintext, The decryption process of Alice's ciphertext was also completed.

The current public key algorithm mainly has RSA and Ecc,rsa is the older algorithm, based on large prime number decomposition, slow, ECC (elliptic curve) is the latest public key encryption algorithm, based on discrete logarithm calculation, faster than RSA, security is said to be higher.

Of course, the above mentioned technology is only the most basic authentication technology, just suitable for general website application, for e-commerce and banks need more complex and authoritative security authentication system. At present, the more popular is PKI technology. PKI (Public key Infrastructure) is a new security technology, which consists of common key cryptography, digital certificate, certificate issuing agency (CA) and security policy about public key. PKI technology has been widely used in e-government and e-commerce, has been proved to ensure Internet-based e-Government and e-commerce security of the best solution. Complete PKI construction needs a lot of capital and manpower to complete, here is not much introduced.

Transferred from: http://www.williamlong.info/archives/823.html

Cryptography-Secure Login authentication design for Websites