5

An organization requires employees to use 2 person authentication in some scenarios. That is, when accessing, say, a server, secret knowledge from 2 people should be used for authentication. No one person should ever have access to the server alone.

Question: What implementations of this requirement are possible?

This is a Windows setup.

The only implementation I can think of is the following: 2 people both connect to the machine (say, remotely), first person enters first part of the password he knows, and the second person enters the second half.

Note: Not to be confused with two factor authentication.

  • 1
    Launching missiles? – DKNUCKLES Jul 10 '14 at 16:08
  • You will likely need a custom Winlogon GINA to accommodate this. I'm not aware of any implementation... msdn.microsoft.com/en-us/library/windows/desktop/… – goodguys_activate Jul 10 '14 at 16:10
  • @DKNUCKLES Sorry, classified :| – Babken Vardanyan Jul 10 '14 at 16:15
  • @makerofthings7 I'd prefer not to poke with any code. – Babken Vardanyan Jul 10 '14 at 16:20
  • 1
    Will the two people only have remote or physical access to the machine you are trying to access? Or a mixture of the two. – j_thiel Jul 10 '14 at 20:34
1

One approach is to use temporary passwords, and a password management application. The process could work like:

  1. An admin submits a request for access to a server for a particular time window
  2. A separate admin approves this request
  3. With the request approved, from the start of the time window the first admin can now access a temporary password for the server
  4. The admin logs in as normal, using the temporary password
  5. At the end of the time window, the temporary password is automatically reset to a new value

I have seen systems like this, but they all used some bespoke scripting, based on an existing request management system. I don't know anywhere you can just download such an application.

Of course, once the admin has the temporary password, they have single-handed access to the server. If you need the two-man rule the whole way - that there have to be two admins sat at one computer to perform the work - this approach won't work.

A variant on this I have seen is that a secure ID token is held by ops staff. When the admin needs to login to the server, they provide a password (that only they know) and also phone the ops desk to get the code from the secure ID token. I'm not convinced this arrangement is a good idea, but it does get used.

1

Two people with the same password (each knows a half) is not a good idea from a security perspective as each will have knowledge on the password. This would break by half their chances of guessing the other half with known attacks (brute-force, dictionary, ..).

I would suggest Shamir's Secret Sharing. Each person would have a password and only combining them would generate a shared secret. Both passwords have to be changed each time they're used tough.

  • If the password is limited to 8 characters, breaking it in half would obviously be a problem. But what system that any security-conscious person would consider using has that limitation? Just make the password longer so that each half is still strong enough. – jjanes Jul 10 '14 at 21:13
  • Well in the implementation I described in OP each half of the password will be treated with security mesaures of a regular password (length, complexity etc). – Babken Vardanyan Jul 11 '14 at 15:21
  • Although it's not recommended (still because of the knowledge on the password) yes you can set up a big password and each user know a part of it (don't need to be half) and still have an acceptable risk level for your application. On the other hand, if you want to have more than 2 users in your database (say 10 users) and setup a threshold (in your case 2 users) needed to complete the authentication, then you're going to have to use other scheme, like Shamir or other ideas proposed here. – rda Jul 11 '14 at 19:09
1

In addition to @rda's mention Shamir Secret Sharing, or @paj28's idea of an out-of-band authorization mechanism, you can also consider a much simpler solution, that does not require a lot of coding or setup:

Use 2 factor authentication, giving each person a different factor.
E.g. you give a hardware token to one, and a password to the other. The advantage of this solution is that it can be directly applied even to Windows access quite simply. The weakness, of course, is the same as using a single factor anywhere - a hardware token with no password is usually trivial to be stolen. To counter this, there should still be another factor, e.g. there are some tokens that require a PIN (separate from the OS password).
Another similar solution, is for one to have the OS password, the other has the physical key (or biometric) to enter the data centre where the server is located. Or one has the password, the other is allowed through the firewall. Or OS user vs application user (and verify they match).

Most of these are pretty straightforward to set up, but possibly not as strong or as strict as Shamir. It really depends on the specific scenario and what requirements and constraints you have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.