Comparing passwords, tokens, and biometrics for user authentication

Top Cited Papers

1 December 2003

journal article
Published by Institute of Electrical and Electronics Engineers (IEEE) in Proceedings of the IEEE

Vol. 91 (12) , 2021-2040
https://doi.org/10.1109/jproc.2003.819611

Abstract

For decades, the password has been the standard means for user authentication on computers. However, as users are required to remember more, longer, and changing passwords, it is evident that a more convenient and secure solution to user authentication is necessary. This paper examines passwords, security tokens, and biometrics-which we collectively call authenticators-and compares these authenticators and their combinations. We examine their effectiveness against several attacks and suitability for particular security specifications such as compromise detection and nonrepudiation. Examples of authenticator combinations and protocols are described to show tradeoffs and solutions that meet chosen, practical requirements. The paper endeavors to offer a comprehensive picture of user authentication solutions for the purposes of evaluating options for use and identifying deficiencies requiring further research.

Keywords

This publication has 26 references indexed in Scilit:

Encrypted key exchange: password-based protocols secure against dictionary attacks
Published by Institute of Electrical and Electronics Engineers (IEEE) ,2003
On the individuality of fingerprints
Published by Institute of Electrical and Electronics Engineers (IEEE) ,2002
Impact of artificial "gummy" fingers on fingerprint systems
Published by SPIE-Intl Soc Optical Eng ,2002
A Biometric Standard for Information Management and Security
Computers & Security, 2000
Remote Authentication Dial In User Service (RADIUS)
Published by RFC Editor ,2000
Error rate equations for the general biometric system
IEEE Robotics & Automation Magazine, 1999
Fingerprint matching using transformation parameter clustering
IEEE Computational Science and Engineering, 1997
The Kerberos Network Authentication Service (V5)
Published by RFC Editor ,1993
The MD5 Message-Digest Algorithm
Published by RFC Editor ,1992
Using encryption for authentication in large networks of computers
Communications of the ACM, 1978