diff --git a/docs/nkode_over_unencrypted_channel.md b/docs/nkode_unsecure_lowbandwitdh.md similarity index 59% rename from docs/nkode_over_unencrypted_channel.md rename to docs/nkode_unsecure_lowbandwitdh.md index 8c5b89a..884f285 100644 --- a/docs/nkode_over_unencrypted_channel.md +++ b/docs/nkode_unsecure_lowbandwitdh.md @@ -1,10 +1,10 @@ -# nKode Authentication Over Unencrypted Channel in Low-Bandwidth Environments +# nKode Authentication Over Unsecured and Low-Bandwidth Network ## Low-Bandwidth Architecture The standard nKode architecture will not work in low-bandwidth environments. -Keypad icons are too large to send from the sever to the client. -To over come this issue, we can move the nKode icons from the serve to the users mobile device. +Keypad icons are too large to send from the server to the client. +To over come this issue, we can move the nKode icons from the server to the users mobile device. The server only sends the indices in which the icons need to be arranged. ```mermaid @@ -15,8 +15,9 @@ sequenceDiagram Note over User,Server: Enrollment User ->> Server: Initiate Enrollment Server ->> Server: Generate Keypad Icons + Note right of Server: Ideally the icons are generated on the users device.
Since current ML models are too compute intense,
a GPU enabled server must run the models during enrollment. Server -->> Mobile Client: Store Icons On Device - Note right of Server: Server does not store the icons and does not know what they are + Note right of Server: The Server does not store the icons Server ->> Mobile Client: Keypad Index Array Mobile Client ->> User: Render Keypad User ->> Server: Set nKode @@ -37,48 +38,35 @@ A ChaCha20 Deterministic CSPRNG is a cryptographically secure pseudorandom numbe ## Secure Low-Bandwidth Architecture -We can modify the architecture above to allow secure authentication over an unencrypted network +We can modify the architecture above to allow secure authentication over an unencrypted network using ChaCha20. ```mermaid sequenceDiagram participant User participant Mobile Client participant Server - Note over User,Server: Enrollment + Note over User,Server: Enrollment (assume secure network) User ->> Server: Initiate Enrollment Server ->> Server: Generate Keypad Icons Server -->> Mobile Client: Store Icons On Device - Note right of Server: Server does not store the icons and does not know what they are rect rgb(191, 223, 255) Server -->> Mobile Client: Store ChaCha20 256-bit key end - rect rgb(191, 223, 255) - Server ->> Server: Ciphered Keypad Index Array =
ChaCha20FisherYates(Keypad Index Array, SharedKey, Nonce) - Server ->> Mobile Client: Ciphered Keypad Index Array + Nonce - end - Note right of Server: Server also sends the 96-bit nonce in plain-text.
The Serve must never use the same nonce twice.
It must be randonly generated for every authentication.
The only additional overhead is the 96-bit nonce. - rect rgb(191, 223, 255) - Mobile Client ->> Mobile Client: Keypad Index Array =
Reverse(Ciphered Keypad Index Array, SharedKey, Nonce) - end + Server ->> Mobile Client: Keypad Index Array Mobile Client ->> User: Render Keypad User ->> Server: Set nKode Server ->> Server: Disperse Keypad - rect rgb(191, 223, 255) - Server ->> Server: Ciphered Keypad Index Array =
ChaCha20FisherYates(Keypad Index Array, SharedKey, Nonce) - Server ->> Mobile Client: Ciphered Keypad Index Array + Nonce - end - rect rgb(191, 223, 255) - Mobile Client ->> Mobile Client: Keypad Index Array =
Reverse(Ciphered Keypad Index Array, SharedKey, Nonce) - end + Server ->> Mobile Client: Keypad Index Array Mobile Client ->> User: Render Keypad User ->> Server: Confirm nKode - Note over User,Server: Login + Note over User,Server: Login (assume unsecure network) rect rgb(191, 223, 255) - Server ->> Server: Ciphered Keypad Index Array =
ChaCha20FisherYates(Keypad Index Array, SharedKey, Nonce) - Server ->> Mobile Client: Ciphered Keypad Index Array + Nonce + Server ->> Server: Shuffled Keypad Index Array =
ChaCha20FisherYates(Keypad Index Array, SharedKey, Nonce) + Server ->> Mobile Client: Shuffled Keypad Index Array + Nonce end + Note right of Server: Server also sends the 96-bit nonce in plain-text.
The Server must never use the same nonce twice.
It must be randonly generated for every authentication.
The only additional overhead is the 96-bit nonce. rect rgb(191, 223, 255) - Mobile Client ->> Mobile Client: Keypad Index Array =
Reverse(Ciphered Keypad Index Array, SharedKey, Nonce) + Mobile Client ->> Mobile Client: Keypad Index Array =
Unshuffle(Shuffled Keypad Index Array, SharedKey, Nonce) end Mobile Client ->> User: Render Keypad User ->> Server: Successful Login