Efficient - Self authentication

From SAFE Network Wiki
Jump to: navigation, search

The SAFE Network supports a mechanism that enables Users to create accounts on the SAFE Network and log in from any computer without the need or knowledge of third parties. This is called self-authentication.

To achieve this the authentication privileges (login token) have to be stored on the SAFE Network as part of the self-authentication process.

A User creates their own keyword (K), password (W) and PIN. Salts (S) are also generated using the User's PIN.

Then, to generate a unique identifier, a hash is created from the concatenated keyword and a salt, H(K + S).

A Password Based Key Derivation Function (PBKDF2) is used to strengthen the password. This is required as user-selected passwords are commonly weak.

Finally the encrypted access permission is stored on the SAFE Network using the following structure:

Store key-value pair to network, wherein
key = the hash of the keyword plus a salt = [H(K+S)] where the salt (S) is the User's PIN, and  
value = symmetrically encrypted full account data atlas = PBKDF2[P][S] where the salt (S) is the reverse of the User's PIN.

Self-authentication relies on a system where a Vault can create a unique key to store a value in the SAFE Network. The value stored with this key contains an encrypted passport to data.

This passport contains a variety of key types that enable different tasks to be performed across the network.

The location of this initial key is masked or at least not obvious in the SAFE Network. This approach is the basis for self-authentication and is extended into the SAFE Network to allow access to data to be stored publicly and with no additional requirement such as firewalls or access controls.

Guessing login information

An intruder or hostile person on the network can test for the presence of a User and download the login token. This is similar to continual testing of a password on a centralised server. In centralised servers this is alleviated by backing off login attempts.

In the SAFE Network as a User requests a login token, they are provided with one. Tokens are provided on every attempt, whether valid or not. This means that an attacker will have to decrypt many millions of strongly encrypted login tokens, not knowing at any point if the decryption attempt is being performed on a valid or invalid token.

The login token is only useful for authentication after it is validated against the password and User details, which are never sent out onto the SAFE Network. This process should render such attacks computationally infeasible.