Security Of Cryptographic Protocols Research Articles

Methodology of Testing the Security of Cryptographic Protocols Using the CMMTree Framework

Internet communication is one of the significant aspects of modern civilization. People use banking, health, social, or shopping platforms and send a lot of data. Each communication should be secured and protected against dishonest users’ activities during its transfer via network links. Cryptographic protocols provide such security and protection. Because of the evolution of the vulnerabilities and attackers’ methods, the cryptographic protocols should be regularly verified. This paper presents a methodology for testing the security of cryptographic protocols using the CMMTree framework. We developed and adapted a software package for analyzing cryptographic protocols regarding compatibility with the CMMTree framework using a predicate according to the approach described in Siedlecka-Lamch et al.’s works. We optimized and strengthened the mentioned approach with tree optimization methods and a lexicographic sort rule. Next, we researched the well-known security protocols using a developed tool and compared and verified the results using sorted and shuffled data. This work produced promising results. No attacks on the tested protocols were discovered.

FPGA-Based PUF Designs: A Comprehensive Review and Comparative Analysis

Field-programmable gate arrays (FPGAs) have firmly established themselves as dynamic platforms for the implementation of physical unclonable functions (PUFs). Their intrinsic reconfigurability and profound implications for enhancing hardware security make them an invaluable asset in this realm. This groundbreaking study not only dives deep into the universe of FPGA-based PUF designs but also offers a comprehensive overview coupled with a discerning comparative analysis. PUFs are the bedrock of device authentication and key generation and the fortification of secure cryptographic protocols. Unleashing the potential of FPGA technology expands the horizons of PUF integration across diverse hardware systems. We set out to understand the fundamental ideas behind PUF and how crucially important it is to current security paradigms. Different FPGA-based PUF solutions, including static, dynamic, and hybrid systems, are closely examined. Each design paradigm is painstakingly examined to reveal its special qualities, functional nuances, and weaknesses. We closely assess a variety of performance metrics, including those related to distinctiveness, reliability, and resilience against hostile threats. We compare various FPGA-based PUF systems against one another to expose their unique advantages and disadvantages. This study provides system designers and security professionals with the crucial information they need to choose the best PUF design for their particular applications. Our paper provides a comprehensive view of the functionality, security capabilities, and prospective applications of FPGA-based PUF systems. The depth of knowledge gained from this research advances the field of hardware security, enabling security practitioners, researchers, and designers to make wise decisions when deciding on and implementing FPGA-based PUF solutions.

Secure cloud‐based data storage scheme using postquantum integer lattices‐based signcryption for IoT applications

AbstractThe primary objective of postquantum cryptography (also known as quantum‐resistant cryptography) is to develop the cryptographic systems that need to be robust against both quantum and classical computers, and can also interoperate with the existing communications protocols and networks. In an Internet of Things (IoT) environment, the communicated messages contain sensitive information that are transmitted over an open channel, where message integrity and data privacy become challenging tasks. Although several traditional cryptographic security protocols can be applied for IoT security and data privacy, such as authentication, access control, key agreement, and digital signature, but they are not resilient against quantum attacks. To overcome these issues, in this article, we first present an advanced and efficient construction of postquantum lattice‐based signcryption scheme, and then apply the constructed lattice‐based signcryption in IoT applications, where data sensed by the deployed IoT smart devices is securely stored at the cloud, via the gateway nodes (aggregators). The data stored at the cloud servers cannot be even modified by them due to the involved signatures generated by the aggregators. The formal security analysis shows the robustness of our designed lattice‐based signcryption scheme. Other detailed information security analysis and a performance analysis with the traditional number‐theoretical based public key cryptosystems show the efficacy, and significantly better security and functionality features of the proposed scheme under the lattice‐based postquantum context.

Oblivious Transfer Over Compound Binary Erasure Channels

Oblivious Transfer (OT) is a broadly studied cryptographic primitive which involves two mutually distrustful users who wish to interact with each other in order to transfer messages in an oblivious manner. Noise is an important resource to realize information-theoretically secure cryptographic protocols including oblivious transfer. However, oftentimes these noisy channels may be poorly characterized and the complete channel characteristics might be unknown to both users. Such channels are studied in the literature through the lens of compound channels. We study 1-out-of-2 oblivious transfer over a compound binary erasure channel (compound-BEC) and characterize the oblivious transfer capacity of compound-BEC. Our OT capacity characterization involves a general alphabet compound-DMC converse, subsequently specialized to compound-BEC along with an optimal and computationally-efficient achievability scheme for honest-but-curious users.

Model Checking M2M and Centralised IOT authentication Protocols.

It is very difficult to develop a perfect security protocol for communication over the IoT network and developing a reliable authentication protocol requires a detailed understanding of cryptography. To ensure the reliability of security protocols of IoT, the validation method is not a good choice because of its several disadvantages and limitations. To prove the high reliability of Cryptographic Security Protocols(CSP) for IoT networks, the functional correctness of security protocols must be proved secure mathematically. Using the Formal Verification technique we can prove the functional correctness of IoT security protocols by providing the proofs mathematically. In this work, The CoAP Machine to Machine authentication protocol and centralied IoT network Authentication Protocol RADIUS is formally verified using the well-known verification technique known as model checking technique and we have used the Scyther model checker for the verification of security properties of the respective protocols. The abstract protocol models of the IoT authentication protocols were specified in the security protocol description language and the security requirements of the authentication protocols were specified as claim events.

Методика оценки безопасности криптографических протоколов

This paper proposes a method for evaluating the security of cryptographic protocols used to protect information in telecommunication networks, as well as in networks of the “Internet of Things”. The procedure for evaluation of information system security is described, including the construction of the list of threats, the threat model, and detailing of the model and the abilities of the intruder. The concept of security property is considered, the extended list of the specified properties, their classification and formal mathematical model are given. As part of the model, for given properties of security, we propose a method for obtaining numerical values of performance parameters depending on the probability of success and algorithmic complexity of the solution of a number of known mathematical problems. In conclusion, the results of the application of the proposed method to the analysis of ESP and IKEv2 protocols of IPSec family standardized in the Russian Federation are presented.

Asymmetric cryptographic protocols with a blockchain core: development problems and their solutions

The problem of axiomatic construction of secure cryptographic protocols is closely related to the choice of basic cryptographic blocks from which a cryptographic protocol of arbitrary complexity can be built. Let’s call such blocks primitive cryptographic protocols. Along with a traditional choice as primitive secret sharing protocols and non-interactive proof protocols today blockchain is considered to be a primitive cryptographic protocol. The security of such cryptographic protocols with a blockchain core is studied a bit today. We consider the methods for increasing the security of protocols with blockchain core by using a new agreement protocol in the blockchain, which is secure in the information theoretically sense.

RV-TEE: secure cryptographic protocol execution based on runtime verification

Analytical security of cryptographic protocols does not immediately translate to operational security due to incorrect implementation and attacks targeting the execution environment. Code verification and hardware-based trusted execution solutions exist, however these leave it up to the implementer to assemble the complete solution, imposing a complete re-think of the hardware platforms and software development process. We rather aim for a comprehensive solution for secure cryptographic protocol execution, which takes the form of a trusted execution environment based on runtime verification and stock hardware security modules. RV-TEE can be deployed on existing platforms and protocol implementations. Runtime verification lends itself well at several conceptual levels of the execution environment, ranging from high level protocol properties, to lower level checks such as taint inference. The proposed architectural setup involving two runtime verification modules is instantiated through a case study using a popular web browser. We successfully monitor high and low level properties with promising results with respect to practicality.

CoopECC: A Collaborative Cryptographic Mechanism for the Internet of Things

The emergence of IoT applications has risen the security issues of the big data sent by the IoT devices. The design of lightweight cryptographic algorithms becomes a necessity. Moreover, elliptic curve cryptography (ECC) is a promising cryptographic technology that has been used in IoT. However, connected objects are resource‐constrained devices, with limited computing power and energy power. Driven by these motivations, we propose and develop a secure cryptographic protocol called CoopECC which leverages the organization of IoT nodes into cluster to distribute the load of cluster head (CH) among its cluster members. This technique proves that it optimizes the resource consumption of the IoT nodes including computation and energy consumption. Performance evaluation, done with TOSSIM simulator, shows that the proposed protocol CoopECC outperforms the original ECC algorithm, in terms of computation time, consumed energy, and the network’s lifespan.

RSEAP2: An enhanced version of RSEAP, an RFID based authentication protocol for vehicular cloud computing

RSEAP is a recently proposed RFID based authentication protocol for vehicular cloud computing whose authors claimed to be secure and efficient. In this article, we challenge these claims. More precisely, we show that RSEAP does not provide the desired security, and it is possible to conduct both tag and reader impersonation attacks efficiently. Besides, despite the use of timestamps, we show how this protocol also suffers from a range of relay attacks. The complexity of any of the proposed attacks is negligible while the success probability is maximum (i.e., the adversary's success probability is ‘1’ since all the proposed attacks are deterministic). To improve the security of RSEAP scheme, we suggest the required patches for fixing the security vulnerabilities mentioned above. We show that the improved protocol, called RSEAP2, is more efficient (computation and communication costs) than the original RSEAP, while provides a higher security level. The security of RSEAP2 is evaluated informally and also formally using the Scyther tool, which is a well-known and automated tool to assess the security of cryptographic protocols. Additionally, we have formally verified the security of the proposed scheme under the Real-or-Random oracle model.

Experimental realization of three quantum key distribution protocols

Classical computers allow security of cryptographic protocols based on the mathematical complexity of encoding functions and the shared key. This implies that high computational power can have a positive outcome in breaking cryptographic protocols that employ classical computers. Quantum machines claim to possess such power. Two parties interested in communicating with each other take up the process of measuring entangled states in order to construct a secret key which is safeguarded against an eavesdropper capable of performing quantum operations. At first, experimental verification of the BB84 protocol using three bases has been performed in this paper, out of which sub-cases have been considered based on whether or not Eve has attempted an attack. The following part includes experimental realization of the B92 protocol which was introduced by Charles Bennett in the year 1992. Possibility of an Eve’s attack is considered and implemented. Succeeding part relies on experimental implementation of the protocol that was introduced by Acin, Massar and Pironio in the year 2006 (New J Phys 8:126, 2006). All the implementations have been done using the IBM Quantum Experience platform.

Efficient Verification of Cryptographic Protocols with Dynamic Epistemic Logic

The security of cryptographic protocols has always been an important issue. Although there are various verification schemes of protocols in the literature, efficiently and accurately verifying cryptographic protocols is still a challenging research task. In this work, we develop a formal method based on dynamic epistemic logic to analyze and describe cryptographic protocols. In particular, we adopt the action model to depict the execution process of the protocol. To verify the security, the intruder’s actions are analyzed. We model exactly the protocol applying our formal language and give the verification models according to the security requirements of this cryptographic protocol. With analysis and proof on a selected example, we show the usefulness of our method. The result indicates that the selected protocol meets the security requirements.

Universally Composable Security

This work presents a general framework for describing cryptographic protocols and analyzing their security. The framework allows specifying the security requirements of practically any cryptographic task in a unified and systematic way. Furthermore, in this framework the security of protocols is preserved under a general composition operation, called universal composition. The proposed framework with its security-preserving composition operation allows for modular design and analysis of complex cryptographic protocols from simpler building blocks. Moreover, within this framework, protocols are guaranteed to maintain their security in any context, even in the presence of an unbounded number of arbitrary protocol sessions that run concurrently in an adversarially controlled manner. This is a useful guarantee, which allows arguing about the security of cryptographic protocols in complex and unpredictable environments such as modern communication networks.

Modeling security properties of authentication of cryptographic protocols using spin formal verification

To assess the quality and security of cryptographic protocols, we use various formal verification tools, such as Scyther tool, Avispa, ProVerif. these formal verifiers can check the protocol for vulnerability to attacks on secrecy and authentication, as these are the most prevalent attacks on protocols. However, this is not enough to fully analyze the security of the protocol. In this article, we will use linear temporal logic (LTL) model checking with SPIN. This tool, unlike the formal verifiers listed above, is not designed for a specific application in the context of cryptographic protocols; however, it has a very wide range of possibilities. In particular, for each security property, it is possible to describe the behavior of an attacker and test for the stability of the protocol model to its various attacks. The purpose of this work is to describe the developed methodology for verifying the security of authentication properties using the SPIN verifier.

On post-handshake authentication and external PSKs in TLS 1.3

The TLS protocol is the main cryptographic protocol of the Internet. The work on its current version, TLS 1.3, was completed in 2018. This version differs significantly from the previous ones and has a clean-state design taking into account all modern principles of constructing secure cryptographic protocols. At the same time, even when there are security proofs in some fairly strong security model, it is important to explore the possibility of extending this model and then clarifying the security limits of the protocol. This work considers the restriction on the usage of post-handshake authentication in connections established with external PSK. We show that some vulnerability appears in the case of psk_ke mode (PSK-only key establishment) if more than one pair of entities can possess the same PSK. We provide several practical scenarios where this condition can be easily achieved. Also we propose appropriate mitigation to prevent this vulnerability.

A subtree‐based transformation model for cryptosystem using chaotic maps under cloud computing environment for fuzzy user data sharing

SummaryCloud computing technologies have been prospering in recent years and have opened an avenue for a wide variety of forms of adaptable data sharing. Taking advantage of these state‐of‐the‐art innovations, the cloud storage data owner must, however, use a suitable identity‐based cryptographic mechanism to ensure the safety prerequisites while sharing data to large numbers of cloud data users with fuzzy identities. As a successful way to guarantee secure fuzzy sharing of cloud data, the identity‐based cryptographic technology still faces an effectiveness problem under multireceiver configurations. The chaos theory is considered a reasonable strategy for reducing computational complexity while meeting the cryptographic protocol's security needs. In an identity‐based cryptographic protocol, public keys for individual clients are distributed, allowing the clients to separately select their own network identities or names as their public keys. In fact, in a public‐key cryptographic protocol, it is for the best that the confirmation of the public key is done in a safe, private manner, because this way the load of storage on the server's side can be considerably relieved. The objective of this paper is to outline and examine a conversion process that can transfer cryptosystems using Chebyshev's chaotic maps over the Galois field to a subtree‐based protocol in the cloud computing setting for fuzzy user data sharing, as opposed to reconcocting a different structure. Furthermore, in the design of our conversion process, no adjustment of the original cryptosystem based on chaotic maps is needed.

A Secured e-Governance Enterprise Framework using Aadhaar Based eSign System

Over the wide expansion of internet and e-Governance, many services of government are nowadays provided online. In any online services, confidentiality, authentication and non-repudiation are of foremost priority in setting up any e-Governance framework. Strong cryptographic security protocols and framework must be deployed for large scale e-Governance transactions. We have proposed an open source based secured e-Governance enterprise framework, using Aadhaar based eSign system to integrate all available existing e-Governance services from different sources to seamlessly perform secured transactions in very large-scale and cost-effective manner.

A Lightweight Cryptographic Protocol with Certificateless Signature for the Internet of Things

The universality of smart-devices has brought rapid development and the significant advancement of ubiquitous applications for the Internet of Things (IoT). Designing new types of IoT-compatible cryptographic protocols has become a more popular way to secure IoT-based applications. Significant attention has been dedicated to the challenge of implementing a lightweight and secure cryptographic protocol for IoT devices. In this study, we propose a lightweight cryptographic protocol integrating certificateless signature and bilinear pairing crypto-primitives. In the proposed protocol, we elegantly refine the processes to account for computation-limited IoT devices during security operations. Rigorous security analyses are conducted to guarantee the robustness of the proposed cryptographic protocol. In addition, we demonstrate a thorough performance evaluation, where an IoT-based test-bed, i.e., the Raspberry PI, is simulated as the underlying platform of the implementation of our proposed cryptographic protocol. The results show the practicability of the proposed protocol.

A light-weight bit commitment protocol based on unpredictable channel noise

Bit commitment is an important tool in the design of many secure cryptographic protocols, such as coin flipping, zero-knowledge proof, and secure computation. In this paper, we present a computationally light-weight bit commitment protocol over a noisy channel. For the security of the proposed protocol, we show that the receiver has almost no information about the committer's secret due to unpredictability of the noises in the communication channel. Hence, the security of our bit commitment protocol does not depend on hard problems; it is information-theoretically secure. Furthermore, the protocol needs only exclusive-or operations. Thus, it is computationally light-weight, and it can be used in the devices whose computing resources are limited.

FPGA implementation of SRAM PUFs based cryptographically secure pseudo-random number generator

The security of cryptographic protocols depends on the security of key sequences consisting of random numbers. In this paper, we design a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG), which consists of a hash based Deterministic Random Bit Generator (DRBG) and a Get Entropy module. SRAM Physical Unclonable Functions (PUFs) are regarded as entropy sources, providing entropy data with enough entropy for CSPRNG. The construction of Get Entropy module is proposed to verify the availability of SRAM PUFs and compress the entropy data into truly random seeds that are fed into DRBG. This CSPRNG can reseed itself dynamically and can monitor the entropy of entropy sources in real time. The system is implemented and tested on Altera DE2. The test results show that, the pseudo-random numbers generated by this system can pass all random tests of National Institute of Standards and Technology (NIST) SP800-22 Test Suite and the throughput is up to 598.1 Mbps. Through the security discussion, this CSPRNG is theoretically confirmed that it can be securely applied to cryptographic protocols.