SSL/TLS Session-Aware User Authentication Using a GAA Bootstrapped Key - Information Security Theory and Practice: Security and Privacy of Mobile Devices in Wireless Communication Access content directly
Conference Papers Year : 2011

SSL/TLS Session-Aware User Authentication Using a GAA Bootstrapped Key

Chunhua Chen
  • Function : Author
  • PersonId : 1014522
Chris J. Mitchell
  • Function : Author
  • PersonId : 1014523
Shaohua Tang
  • Function : Author
  • PersonId : 1014524


Most SSL/TLS-based electronic commerce (e-commerce) applications (including Internet banking) are vulnerable to man in the middle attacks. Such attacks arise since users are often unable to authenticate a server effectively, and because user authentication methods are typically decoupled from SSL/TLS session establishment. Cryptographically binding the two authentication procedures together, a process referred to here as SSL/TLS session-aware user authentication (TLS-SA), is a lightweight and effective countermeasure. In this paper we propose a means of implementing TLS-SA using a GAA bootstrapped key. The scheme employs a GAA-enabled user device with a display and an input capability (e.g. a 3G mobile phone) and a GAA-aware server. We describe a simple instantiation of the scheme which makes the password authentication mechanism SSL/TLS session-aware; in addition we describe two possible variants that give security-efficiency trade-offs. Analysis shows that the scheme is effective, secure and scalable. Moreover, the approach fits well to the multi-institution scenario.
Fichier principal
Vignette du fichier
978-3-642-21040-2_4_Chapter.pdf (257.13 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-01573291 , version 1 (09-08-2017)





Chunhua Chen, Chris J. Mitchell, Shaohua Tang. SSL/TLS Session-Aware User Authentication Using a GAA Bootstrapped Key. 5th Workshop on Information Security Theory and Practices (WISTP), Jun 2011, Heraklion, Crete, Greece. pp.54-68, ⟨10.1007/978-3-642-21040-2_4⟩. ⟨hal-01573291⟩
80 View
73 Download



Gmail Facebook X LinkedIn More