Computer security Lab 3: Authentication Security Assessment

Assignment Overview

Aim

• Understand secure password storage and hashing schemes.

• Build & secure an authentication API with tamper protection and multi-factor authentication
  (MFA).

• Measure and demonstrate attacks (cracking, timing, relay/phishing) and implement
  mitigations.

Tasks

• Flask REST API: /register, /login, /mfa/*; store users in SQLite (username, salt, hash, MFA
  metadata).

• Password storage: implement SHA-256, SHA-3, bcrypt, Argon2. Compare formats, cost
  parameters and brute-force resistance.

• Salt & pepper analysis: demonstrate per-user salts vs a system pepper and their impact on
  cracking difficulty.

• HMAC & integrity: add MAC to API responses; demonstrate naive length-extension
  vulnerabilities where applicable; replace with HMAC; use compare_digest) for constant-time
  checks.

• MFA TOTP & HOTP: enroll TOTP (pyotp + QR), implement HOTP (show counter desync), allow
  configurable 10/+1 time windows, and log acceptance/failure stats.

• FIDO2 / WebAuthn: integrate python-fido2 with browser credentials.create/get() flows; store
  credentialld & public key; show MITM succeeds for OTP but fails for WebAuthn (origin/RP-ID
  binding).

• Password cracking: provide scripts for dictionary and brute-force attacks; log time-to-crack
  under different schemes and settings.

• Timing attacks: implement naive comparisons and micro-benchmarks to show timing
  leakage; demonstrate mitigation via constant-time comparison.

• MITM relay demo (local only): build a local proxy that captures creds+OTP and forwards to
  the real
  API; measure relay success and latency for ТОТР/HOTP.

Brief Summary of Assessment Requirements 

The assessment requires building a small, self-contained authentication lab that demonstrates secure password storage and multiple authentication schemes and intentionally measures/illustrates common attacks and mitigations.
Core deliverables:

• A Flask REST API  with user records held in SQLite (username, salt, hash, MFA metadata).

• Implement and compare password hashing approaches (SHA-256, SHA-3, bcrypt, Argon2) with cost/strength analysis.

• Salt vs system-pepper analysis and measured effect on cracking difficulty.

• Message integrity: show naive MAC/length-extension weak points where relevant, then implement HMAC and constant-time checks.

• MFA: TOTP (pyotp + QR) and HOTP (show counter desync handling), configurable acceptance windows, logging.

• WebAuthn / FIDO2 integration and demonstration that OTPs are relayable while WebAuthn resists origin/RP-ID MITM.

• Controlled password cracking experiments (dictionary/brute force) with time-to-crack logs across schemes.

• Timing attack micro-benchmarks and mitigation via constant-time comparison.

• Local-only MITM/relay demo to measure relay success and latency for OTP/HOTP.

Key constraints to note: all attack demos must be carried out in a local, consented lab environment against test accounts only; the assessment focuses on measurement and mitigation, not on weaponizing attacks.

Key Pointers the Assessment Must Cover

• Functional API endpoints and secure storage format for user records.

• Clear, comparable implementation of each hashing algorithm and documented cost parameters.

• Experimental design for cracking and timing tests (dataset, attacker model, measurement method).

• Demonstration of integrity failures (where applicable) and the secure replacement (HMAC + compare_digest).

• Usability and security tradeoffs for MFA approaches: TOTP windowing, HOTP counter drift, and WebAuthn differences.

• Logging and metrics: acceptance/failure rates, time-to-crack, timing variance, relay latency.

• Ethical, local-only testing and reproducible scripts/notes.

How the Academic Mentor Guided the Student Step-by-Step 

1. Scoping & planning

   • Mentor reviewed the brief with the student and split work into modular tasks: API, hashing, MFA, integrity, attacks & measurements, documentation.

   • Agreed on safe rules: all tests use lab accounts on a closed network; backups made; no internet-facing services.

2. Environment & baseline

   • Set up a reproducible dev environment (virtualenv/container) and a SQLite DB seeded with a small set of test users.

   • Agreed on test vectors and measurement points (e.g., fixed password lists, timing test harness, logging format).

3. API skeleton

   • Mentor led implementation of the Flask endpoints with clear input/output contracts and structured logging.

   • Emphasized secure defaults: HTTPS in production, input validation, rate-limiting notes (even if not implemented in lab).

4. Password storage module

   • Mentor explained tradeoffs: fast hashes (SHA family) vs adaptive KDFs (bcrypt, Argon2).

   • Student implemented each scheme in a modular way so one can switch hashers and tune cost parameters.

   • Mentor insisted on documenting the storage format (algorithm id, salt, parameters, hash blob) to allow automated comparison.

5. Salt & pepper analysis (experimental design)

   • Mentor described two experiments: per-user salts only, and salts + a system pepper stored separately.

   • Student ran controlled cracking attempts against exported hashed datasets and logged relative difficulty/time.

   • Mentor emphasized interpretation: pepper increases attacker cost if it’s kept secret; salts prevent precomputed table attacks.

6. Integrity / MAC demonstration

   • Mentor explained conceptual length-extension vulnerabilities for naive constructions (high level only).

   • Student implemented HMAC for API responses and used 

   • Mentor reviewed the before/after tests showing how HMAC prevents tampering that naive MACs would allow.

7. MFA: TOTP & HOTP

   • Mentor walked through enrolling TOTP (pyotp + QR for authenticator apps) and how to log enrollment events.

   • For HOTP, mentor explained counter sync issues; student built a simple test harness to show how a desync appears and implemented counter resync strategies and configurable acceptance windows (e.g., look-ahead).

   • All acceptance/failure events were logged for analytics.

8. FIDO2 / WebAuthn integration

   • Mentor explained the high-level flow (credential creation + assertion) and origin/RP-ID binding benefits.

   • Student integrated to create/get flows in the browser; mentor supervised tests showing that a local proxy can relay OTPs but cannot forge origin-bound WebAuthn assertions—demonstrating the security advantage.

9. Password cracking & measurement (ethical, controlled)

   • Mentor insisted on safe parameters: small synthetic user set, short dictionaries, explicit time limits.

   • Student implemented scripts that attempt dictionary and incremental bruteforce on exported hashes while logging time-to-crack and which scheme yielded the fastest success.

   • Mentor guided interpretation: show how adaptive hashes (Argon2, bcrypt with high cost) drastically raise work/time compared to SHA-family.

10. Timing attacks & mitigation

    • Mentor explained how naive string comparisons leak timing differences at a conceptual level.

    • Student wrote micro-benchmarks to measure timing variance using lab harness and then switched to constant-time checks 

11. MITM / relay demo (local only)

    • Mentor required local-only, consented demo: student built a proxy that captures credentials and OTPs from a test client and forwards them to the API; measured relay latency and success rates for OTP/HOTP.

    • Mentor emphasized mitigation discussion: how WebAuthn avoids such relays, and operational mitigations (channel binding, user education, transaction signing).

12. Reporting and validation

    • Mentor reviewed all logs, measurement outputs, and ensured reproducible scripts and clear README explaining how to run experiments safely.

    • Together they produced summary tables showing time-to-crack vs hashing scheme, acceptance/failure rates for MFA windows, and timing-variance charts.

How the Outcome was Achieved 

• Working Flask API with the specified endpoints and SQLite user store (structured storage includes algorithm id, salt, params).

• Modular password storage implementations (SHA-256, SHA-3, bcrypt, Argon2) with documented cost parameters and storage format.

• Salt vs pepper experiment results — export of hashed datasets and time-to-crack logs showing increased attacker effort when pepper is used correctly.

• Integrity demo: sample responses demonstrating naive MAC weakness (conceptual only) and the HMAC replacement verified via test harness.

• MFA implementations: pyotp TOTP enrollment via QR, HOTP with drift handling, logging of acceptance/failure stats.

• FIDO2/WebAuthn integration in the browser demonstrating origin/RP-ID binding; test notes showing WebAuthn resists the local relay test.

• Controlled cracking scripts and measurement logs comparing schemes.

• Timing benchmark reports before/after mitigation.

• Local MITM/relay test results (latency and success metrics) and a written mitigation plan.

• Complete documentation: README, experiment instructions (lab-only), ethical statement, and interpretation of results.

Learning objectives covered

• Understand and implement multiple password hashing schemes and compare their security/cost tradeoffs.

• Design and implement secure storage formats (algorithm id + params + salt + hash).

• Understand role and effectiveness of salts vs peppers in defending against precomputation and offline attacks.

• Learn integrity protection concepts (why naive MACs can fail and why HMAC + constant-time checks are required).

• Implement and evaluate MFA methods (TOTP, HOTP) and practical issues (time windows, counter desync).

• Integrate WebAuthn/FIDO2 and understand its resistance to common relay/MITM attacks.

• Design ethical, controlled experiments to measure password cracking difficulty, timing leakage, and relay attack feasibility.

• Interpret empirical results and translate them into practical mitigation recommendations.

• Produce reproducible lab work, clear documentation, and an ethics / safety boundary for security testing.

Get Expert Guidance with This Sample Solution

Looking to understand how to approach your Computer Security Lab 3: Authentication Security Assessment? Download the available sample solution to explore high-quality academic writing, technical structure, and key implementation ideas. This file is a valuable reference guide designed to help you learn how to structure your own work effectively.

Important Notice:
This sample is for reference and learning purposes only. Submitting it as your own work may lead to plagiarism issues and academic penalties. Always use the sample responsibly to improve your understanding and develop your own original submission.

If you need a fresh, plagiarism-free, and fully customized assignment solution written by professional academic experts, our team can help you craft a unique paper tailored to your exact university requirements.

Why Choose a Fresh Custom Solution?

• 100% original and plagiarism-free content

• Written by qualified academic professionals

• Formatted and referenced as per your institution’s guidelines

• Delivered on time with guaranteed confidentiality

Get the best grades while staying completely safe and ethical in your studies.

Call to Action:
Download Sample Solution                                            Order Fresh Assignment