A certain system uses two-factor authentication. Let the fir…

Questions

A certаin system uses twо-fаctоr аuthenticatiоn. Let the first method be A1 and the second one  A2. Also, assume that the guessing entropy for A1 is e1 bits and the guessing entropy for A2 is e2 bits.  A1 and A2 are defined to be independent if e1 and e2 do not depend on each other. Consider the password-hardening paper discussed in class. The use of a password is method A1 which has entropy e1. A2 is defined by the keystroke timing-derived hardening features and it provides entropy e2. Are these two factors (A1 and A2) independent of each other? What is an upper bound on the entropy that can be provided by this method? Provide your answer as a function of e1 and e2. Explain your answer.  (2+2+4pts.) Assume in a system, more accurate recording of timing is possible and users can be categorized as really fast, fast, slow, and really slow. Thus, multiple thresholds will be defined to determine which of these describes the timing of a certain feature of a user. Can this more accurate timing be used to develop a more secure password-hardening authentication method? How will the instruction table be defined when these new feature values are used?  If the password is n characters long, what will be the size of the instruction table in this system? What would be the best case hardening entropy (entropy only due to the keystroke timing and pressure-derived features) in this system?  (4+4+4 pts.) As users gain more experience typing the same password, they tend to type it faster. Assume users are slow when a new password is chosen, but the password typing pattern changes and they become fast soon after a new password is chosen. Also, passwords are not changed frequently. Assume an attacker has knowledge of such typing behavior of users. The attacker gains access to Bob's instruction table and history files but does not know when Bob's current password was first used.  Explain the strategy that should be used by the attacker to choose shares in the instruction table to minimize the computational effort required for reconstructing the hardened password to gain access to Bob's account.  (4 pts.)