Challenge Response Authentication Mechanism (CRAM)

Challenge Response Authentication Mechanism (CRAM) is the most often used way to authenticate actions. They are a group of protocols in which one side presents a challenge(to be answered) and the other side must present a correct answer(to be checked/validated) to the challenge in order to get authenticated. 

Figure – CRAM activity flow diagram 

Two types of questions (Challenge) –

• Static questions, as the name suggests, involve a static approach to the challenge selection. The user can select his challenge and authenticate himself. For example, take the use case of FORGET PASSWORD in email services. A static challenge is the ‘security question’ that you have saved as part of your account setup. The correct answer to those questions are not expected to change over time.
• Dynamic questions involve a dynamic approach to the Challenge selection and authentication. The challenges are selected randomly presuming that the user will know the valid answer to the challenge considering the user is the real one.

Ways CRAM is executed –

• CAPTCHA:
  The Completely Automated Public Turing Test to Tell Computers and Humans Apart. CAPTCHA is used to prevent spam and auto-registration of new accounts for email or websites.
• SSH (Secure Shell):
  SSH is a cryptographic network protocol for operating network services securely over an unsecured network.
• Password:
  The password is sent to the server for validation by matching with the correct password.
• Salted Challenge Response Authentication Mechanism (SCRAM, a variant of CRAM):
  The challenge is salted with a hash to make sure the password is used for only one time. The hash is sent to the server for matching with the hash of the correct password for match and not the match of the plain text password itself. So, the password is not revealed preventing the Man-in-the-Middle attack and replay attacks because the password can be used only once.
• Biometrics:
  The biometric details(retina scan, fingerprint scan) that are unique are recorded and every time a user wants to authenticate himself, he has to present his biometric credentials to the authenticating system for validation.

Use cases –

• To differentiate between a computer and a human:
  An image (usually difficult to read at a plain glance) is presented to the user and the user would be asked to input by reading the characters from the image. The input is then matched with the actual characters to prevent bots from entering the system.
• In training Machine Learning models:
  An image is pieced and jumbled up and presented to the user for some kind of verification that a real human user can do. The input is used for user validation. The answer given by the user is matched with the answer given by the ML model. The jumbled-up image is the ‘challenge’ and selecting the right pieces is the example. Commonly seen in Google CAPTCHA authentication.
• For login (authentication) purposes:
  The password input is matched(directly or indirectly) with the correct password(already stored in the server that you are trying to access) for matching.

Common attacks on CRAMs –

• Eavesdropping
• Phishing Attacks
• Pharming Attacks
• Man-In-The-Middle Attacks
• DNS Cache Poisoning Attacks
• Trojans Attacks
• Man-In-The-Phone Attacks
• Browser Poisoning Attacks
• Dictionary Attacks
• Brute-Force Attacks
• zero-knowledge password proof
• Reusable password attacks

Limitations –
A fundamental problem with passwords is that passwords are used repeatedly. When a password is received by the server, the server cannot determine if the real user is entering the password or not. 

Newer CRAMs also employ cryptography so that the hash of the passwords is matched and not the plain passwords. 
Some examples of cryptographic CRAMs –

• SCRAM – Salted Challenge Response Authentication Mechanism
• CRAM-MD5