Bristol Access Control Specialists

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Key authentication" – news · newspapers · books · scholar · JSTOR (November 2023) (Learn how and when to remove this message)

Key/Config-authentication is used to solve the problem of authenticating the keys of a person (say "person A") that some other person ("person B") is talking to or trying to talk to. In other words, it is the process of assuring that the key of "person A", held by "person B", does in fact belong to "person A" and vice versa.

This is usually done after the keys have been shared among the two sides over some secure channel. However, some algorithms share the keys at the time of authentication.

The simplest solution for this kind of problem is for the two concerned users to communicate and exchange keys. However, for systems in which there are a large number of users or in which the users do not personally know each other (e.g., Internet shopping), this is not practical. There are various algorithms for both symmetric keys and asymmetric public key cryptography to solve this problem.

For key authentication using the traditional symmetric key cryptography, this is the problem of assuring that there is no man-in-the-middle attacker who is trying to read or spoof the communication. There are various algorithms used now-a-days to prevent such attacks. The most common among the algorithms are Diffie–Hellman key exchange, authentication using Key distribution center, kerberos and Needham–Schroeder protocol. Other methods that can be used include Password-authenticated key agreement protocols etc.^[1]

Crypto systems using asymmetric key algorithms do not evade the problem either. That a public key can be known by all without compromising the security of an encryption algorithm (for some such algorithms, though not for all) is certainly useful, but does not prevent some kinds of attacks. For example, a spoofing attack in which public key A is claimed publicly to be that of user Alice, but is in fact a public key belonging to man-in-the-middle attacker Mallet, is easily possible. No public key is inherently bound to any particular user, and any user relying on a defective binding (including Alice herself when she sends herself protected messages) will have trouble.

The most common solution to this problem is the use of public key certificates and certificate authorities (CAs) for them in a public-key infrastructure (PKI) system. The certificate authority (CA) acts as a 'trusted third party' for the communicating users and, using cryptographic binding methods (e.g., digital signatures) represents to both parties involved that the public keys each holds which allegedly belong to the other, actually do so. A digital notary service, if you will. Such CAs can be private organizations providing such assurances, or government agencies, or some combination of the two. However, in a significant sense, this merely moves the key authentication problem back one level for any CA may make a good faith certification of some key but, through error or malice, be mistaken. Any reliance on a defective key certificate 'authenticating' a public key will cause problems. As a result, many people find all PKI designs unacceptably insecure.

Accordingly, key authentication methods are being actively researched.

• Honest Achmed asks for trust
• Kerberos: The Network Authentication Protocol
• Kerberos Authentication explained

An access badge is a credential used to gain entry to an area having automated access control entry points. Entry points may be doors, turnstiles, parking gates or other barriers.

Access badges use various technologies to identify the holder of the badge to an access control system. The most common technologies are magnetic stripe, proximity, barcode, smart cards and various biometric devices. The magnetic stripe ID card was invented by Forrest Parry in 1960.^[1]

The access badge contains a number that is read by a card reader. This number is usually called the facility code and is programmed by the administrator. The number is sent to an access control system, a computer system that makes access control decisions based on information about the credential. If the credential is included in an access control list, the access control system unlocks the controlled access point. The transaction is stored in the system for later retrieval; reports can be generated showing the date/time the card was used to enter the controlled access point.

The Wiegand effect was used in early access cards. This method was abandoned in favor of other proximity technologies. The new technologies retained the Wiegand upstream data so that the new readers were compatible with old systems. Readers are still called Wiegand but no longer use the Wiegand effect. A Wiegand reader radiates a 1" to 5" electrical field around itself. Cards use a simple LC circuit. When a card is presented to the reader, the reader's electrical field excites a coil in the card. The coil charges a capacitor and in turn powers an integrated circuit. The integrated circuit outputs the card number to the coil which transmits it to the reader. The transmission of the card number happens in the clear—it is not encrypted. With basic understanding of radio technology and of card formats, Wiegand proximity cards can be hacked.

A common proximity format is 26 bit Wiegand. This format uses a facility code, also called a site code. The facility code is a unique number common to all of the cards in a particular set. The idea is an organization has their own facility code and then numbered cards incrementing from 1. Another organization has a different facility code and their card set also increments from 1. Thus different organizations can have card sets with the same card numbers but since the facility codes differ, the cards only work at one organization. This idea worked fine for a while but there is no governing body controlling card numbers, different manufacturers can supply cards with identical facility codes and identical card numbers to different organizations. Thus there is a problem of duplicate cards. To counteract this problem some manufacturers have created formats beyond 26 bit Wiegand that they control and issue to an organization.

In the 26 bit Wiegand format bit 1 is an even parity bit. Bits 2-9 are a facility code. Bits 10-25 are the card number. Bit 26 is an odd parity bit. Other formats have a similar structure of leading facility code followed by card number and including parity bits for error checking.

Smart cards can be used to counteract the problems of transmitting card numbers in the clear and control of the card numbers by manufacturers. Smart cards can be encoded by organizations with unique numbers and the communication between card and reader can be encrypted.

• Access control
• Biometrics
• Card printer
• Common Access Card
• Computer security
• Credential
• Door security
• Electronic lock
• Fortification
• ID Card
• ID card printer
• IP video surveillance
• Keycards
• Locksmithing
• Lock picking
• Logical security
• Magnetic stripe card
• Optical turnstile
• Photo identification
• Physical Security Professional
• Proximity card
• Security
• Security engineering
• Security lighting
• Security policy
• Smart card
• Swipe card
• Wiegand effect