[Cryptography] Clever physical 2nd-factor authentication

[Joseph Ashwood]

-----Original Message----- 
From: Jerry Leichter
Subject: [Cryptography] Clever physical 2nd-factor authentication

> http://passwindow.com/

Since it doesn't seem to have been broken yet, I'll go ahead and do that 
right now.

It is a linear collection of 8-segment displays with certain segments 
already activated and printed on the card. So shorten the process further, 
each of the middle displays shares the left and right segments (2 per side) 
and the end displays share one side each (2 segments).

I'm going to begin the attack after the P has been displayed, even though 
they seem to be relying on this for security, a brute force attempt to 
display a P is easy enough on such a display.

To attack.

Start with a selected display, I will start with the left most.
Choose a segment to test.
Display 8 on that display minus the test segment. To test the middle segment 
send 0.
If the user enters the number 8, the segment is present on the card, 
otherwise the segment is not present on the card.
Repeat steps for each segment.

There are by my count 9 displays on the initial implementation, leading to a 
maximum work effort of 64 to solve the entire grid.

Scaling is not a problem, this attack scales linearly with the length of the 
unknown code.

The only downside is that this is an active attack.


Passive attacks are possible, but more complex.

I don't feel like providing the exact details, but they can be worked out 
easily enough.

Record a successful login for playback
At each step where a number was typed in there was at least one segment that 
was printed on the card.
Thus from each number recorded in this manner at least 1 segment on the 
device was recovered.
Assuming the selection is perfectly random it will take an observation of 
about 400 such numbers, multiple numbers per logins makes this passive 
attack relatively quick and efficient.

In the end you are using the simple fact that the user provides the data to 
find eliminate the apparent entropy that is the entire security of the 
system.

Sorry, the system is extremely weak.
                    Joe