Observation Resilient Authentication Schemes (ORAS) are a class of shared secret challenge–response identification schemes where a user mentally computes the response via a cognitive function to authenticate herself such that eavesdroppers cannot readily extract the secret. Security evaluation of ORAS generally involves quantifying information leaked via observed challenge–response pairs. However, little work has evaluated information leaked via human behavior while interacting with these schemes. A common way to achieve observation resilience is by including a modulus operation in the cognitive function. This minimizes the information leaked about the secret due to the many-to-one map from the set of possible secrets to a given response. In this work, we show that user behavior can be used as a side channel to obtain the secret in such ORAS. Specifically, the user’s eye-movement patterns and associated timing information can deduce whether a modulus operation was performed (a fundamental design element) to leak information about the secret. We further show that the secret can still be retrieved if the deduction is erroneous, a more likely case in practice. We treat the vulnerability analytically and propose a generic attack algorithm that iteratively obtains the secret despite the “faulty” modulus information. We demonstrate the attack on five ORAS and show that the secret can be retrieved with considerably less challenge–response pairs than non-side-channel attacks (e.g., algebraic/statistical attacks). In particular, our attack is applicable on Mod10, a one-time-pad-based scheme, for which no non-side-channel attack exists. We field test our attack with a small-scale eye-tracking user study.

中文翻译：

---

在观察弹性认知认证方案中利用行为侧通道

Observation Resilient Authentication Schemes (ORAS) 是一类共享秘密挑战-响应识别方案，其中用户通过认知功能在心理上计算响应以验证自己，这样窃听者就无法轻易提取秘密。ORAS 的安全评估通常涉及量化通过观察到的挑战-响应对泄露的信息。然而，很少有工作评估在与这些方案交互时通过人类行为泄露的信息。实现观察弹性的一种常见方法是在认知功能中加入模运算。由于从一组可能的秘密到给定响应的多对一映射，这最大限度地减少了有关秘密的信息泄露。在这项工作中，我们展示了用户行为可以用作获取此类 ORAS 中的秘密的侧通道。具体来说，用户的眼球运动模式和相关的时序信息可以推断出是否执行了模运算（基本设计元素）以泄漏有关秘密的信息。我们进一步表明，如果推断错误，仍然可以检索到秘密，这在实践中更有可能发生。我们对漏洞进行分析处理，并提出了一种通用攻击算法，尽管存在“错误”模数信息，但该算法迭代地获取秘密。我们演示了对五个 ORAS 的攻击，并表明与非侧信道攻击（例如，代数/统计攻击）相比，可以使用更少的挑战 - 响应对来检索秘密。特别是，我们的攻击适用于 Mod10，这是一种基于一次性填充的方案，不存在非侧信道攻击。