A Proof of Concept Implementation of SSL/TLS Session-Aware User Authentication (TLS-SA)

Abstract Most SSL/TLS-based e-commerce applications employ conventional mechanisms for user authentication. These mechanisms—if decoupled from SSL/TLS session establishment—are vulnerable to manin-the-middle (MITM) attacks. In this paper, we elaborate on the feasibility of MITM attacks, survey countermeasures, introduce the notion of SSL/TLS session-aware user authentication (TLS-SA), and present a proof of concept implementation of TLS-SA. We think that TLS-SA fills a gap between the use of public key certificates on the client side and currently deployed user authentication mechanisms. Most importantly, it allows for the continued use of legacy two-factor authentication devices while still providing high levels of protection against MITM attacks.

• Type: Conference
• Year: 2007
• Where: KIVS
• Authors: Rolf Oppliger, Ralf Hauser, David A. Basin, Aldo Rodenhaeuser, Bruno Kaiser
• Keywords: Computer Networks, KIVS 2007, MitM Attacks, Session-aware User Authentication, User Authentication