Human–computer cryptography: An attempt

Article type: Research Article

Authors: Matsumoto, Tsutomu

Affiliations: Yokohama National University, Division of Electrical and Computer Engineering, 156 Tokiwadai, Hodogaya, Yokohama 240, Japan

Abstract: Can you securely prove your identity to a host computer by using no dedicated software at your terminal and no dedicated token at your hands? Conventional password checking schemes do not need such a software and hardware but have a disadvantage that an attacker who has correctly observed an input password by peeping or wiretapping can perfectly impersonate the corresponding user. Conventional dynamic (one-time) password schemes or zero-knowledge identification schemes can be securely implemented but require special software or hardware or memorandums. This paper develops human-friendly identification schemes such that a human prover knowing a secret key in her or his brain is asked a visual question by a machine verifier, who then checks if an answer sent from the prover matches the question with respect to the key. The novelty of these schemes lies in their ways of displaying questions. This paper also examines an application of the human identification schemes to human–computer cryptographic communication protocols.

Keywords: Authentication, human–computer interaction, passwords, information security

DOI: 10.3233/JCS-980076

Journal: Journal of Computer Security, vol. 6, no. 3, pp. 129-149, 1998