My bank employs a step in its authentication process besides [the card itself and] the regular password, where the user has a secondary password (3 small sequences of letters, such as
Hy X Ba) previously given to him (not chosen at will). When authenticating, he is presented with 8 options such as:
1) Vi - A - Ha - Re - K - Po Me - Ni - C - Da - X - Xo (5 2) F - V - Ce - Xi - Go - Ka Je - Va - Ko - Z - Qi - M (6 3) Sa - N - Bo - Pe - J - Wi Mi - Vo - Hy - Ta - Q - G (7 4) Lo - Ti - Y - Xa - Ne - D L - Mo - Ba - B - Zi - Le (8
And he has to choose the group that contains the first sequence (in this case, the group
Hy). Then a new set of groups show up for him to find the second sequence, and another for the third sequence. The next time the user tries to authenticate, the process repeats, but with different groups each time. This usually happens at ATMs.
I'm intrigued by this technique, and want to learn more, but I don't even know where to start. Have anyone seen something like this before, does it have a name I could look up? Or if someone knows it well, could you comment on it?
I don't know how it works precisely, but my first impressions about it (which might be totally incorrect) are:
- Each time the user chooses a group he proves knowledge of the password, without revealing it though - if someone peeks while he's authenticating, the attacker can only narrow it down to the symbols in the chosen group (the made up example above has 6 symbols in each group, but in practice there's more, I can't recall exactly how many).
- To correctly learn the symbol an attacker would need to observe multiple authentication attempts. How many exactly, it would depend on how the groups are formed each time, whether or not they depend on previous attempts, etc.
(This is just a guess, I'm not even sure the purpose of this technique is what I think it is...)