{"id":13275,"date":"2021-12-08T20:43:41","date_gmt":"2021-12-09T01:43:41","guid":{"rendered":"https:\/\/carleton.ca\/scs\/?page_id=13275"},"modified":"2026-06-02T14:59:23","modified_gmt":"2026-06-02T18:59:23","slug":"tr-08-17-croo-a-universal-infrastructure-and-protocol-to-detect-identity-fraud-extended-version","status":"publish","type":"page","link":"https:\/\/carleton.ca\/scs\/research\/scs-technical-reports\/technical-reports-2008\/tr-08-17-croo-a-universal-infrastructure-and-protocol-to-detect-identity-fraud-extended-version\/","title":{"rendered":"TR-08-17: CROO: A Universal Infrastructure and Protocol to Detect Identity Fraud (Extended Version)"},"content":{"rendered":"\n
\n
\n\n
\n
\n
\n

\n TR-08-17: CROO: A Universal Infrastructure and Protocol to Detect Identity Fraud (Extended Version)\n <\/h1>\n \n \n <\/header>\n\n <\/div>\n\n <\/div>\n\n <\/div>\n<\/section>\n\n

Carleton University
\nTechnical Report<\/a> TR-08-17
\nJuly 14, 2008<\/p>\n\n\n\n

CROO: A Universal Infrastructure and Protocol to Detect Identity Fraud (Extended Version)<\/h2>\n\n\n\n
\n
\n
\n
\n
\n
\n
\n
\n

D. Nali & P.C. van Oorschot<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

Abstract<\/h3>\n

Identity fraud (IDF) may be defined as unauthorized exploitation of credential information through the use of false identity. We propose CROO, a universal (i.e. generic) infrastructure and protocol to either prevent IDF (by detecting attempts thereof), or limit its consequences (by identifying cases of previously undetected IDF). CROO is a capture resilient one-time password scheme, whereby each user must carry a personal trusted device used to generate one-time passwords (OTPs) verified by online trusted parties. Multiple trusted parties may be used for increased scalability. OTPs are generated and verified for any desired user transaction, and can be used regardless of the transaction’s purpose (e.g. user authentication or financial payment), associated credentials, and online or on-site nature; this makes CROO a universal scheme. OTPs are not sent in cleartext; they are used as keys to compute MACs of hashed transaction information, in a manner allowing OTP-verifying parties to confirm that given user credentials (i.e. OTP-keyed MACs) correspond to claimed hashed transaction details. Hashing transaction details increases user privacy. Each OTP is generated from a PIN-encrypted non-verifiable key; this makes user’s personal devices resilient to off-line PIN-guessing attacks. CROO’s credentials can be formatted (hence used) as existing user credentials (e.g. credit cards or driver’s licenses).<\/p>\n

TR-08-17.pdf<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Carleton University Technical Report TR-08-17 July 14, 2008 CROO: A Universal Infrastructure and Protocol to Detect Identity Fraud (Extended Version) D. Nali & P.C. van Oorschot Abstract Identity fraud (IDF) may be defined as unauthorized exploitation of credential information through the use of false identity. We propose CROO, a universal (i.e. generic) infrastructure and protocol […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":12410,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_cu_dining_location_slug":"","footnotes":"","_links_to":"","_links_to_target":""},"cu_page_type":[],"class_list":["post-13275","page","type-page","status-publish","hentry"],"acf":{"cu_post_thumbnail":false},"_links":{"self":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/comments?post=13275"}],"version-history":[{"count":1,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13275\/revisions"}],"predecessor-version":[{"id":13276,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13275\/revisions\/13276"}],"up":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/12410"}],"wp:attachment":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/media?parent=13275"}],"wp:term":[{"taxonomy":"cu_page_type","embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/cu_page_type?post=13275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}