Elliptic Curve Diffie-Hellman Research Articles

A secure ECC-based RFID mutual authentication protocol for internet of things

Progression of the internet technologies has led to the emergence of internet of things (IoT). One of the familiar deployment of IoT is through radio-frequency identification (RFID) technology. In recent times, RFID based systems are one of the most widely spread applications for tagging and keep tracking purposes in IoT deployment. This is due to their powerful features compared to their counterparts of similar techniques such as barcodes. In contrast, radio-frequency identification systems suffer from various attacks and security threats. The wireless channel used for communication is responsible for the majority of these vulnerabilities. In this paper, we propose a new radio-frequency identification authentication protocol based on elliptic curve cryptography (ECC) to eliminate these vulnerabilities. In addition, we use elliptic curve Diffie–Hellman (ECDH) key agreement protocol to generate a temporary shared key used to encrypt the later transmitted messages. Our protocol achieves a set of security properties likes mutual authentication, anonymity, confidentiality, forward security, location privacy, resistance of man-in-the-middle attack, resistance of replay attack and resistance of impersonation attack. We implement our proposed protocol in real RFID system using Omnikey smartcard reader (Omnikey 5421) and NXP Java smartcards (J3A040). Implementation results shows that our proposed protocol outperform in term of time complexity as compared to other similar protocols and requires less number of operations.

Efficient Implementation of NIST-Compliant Elliptic Curve Cryptography for 8-bit AVR-Based Sensor Nodes

In this paper, we introduce a highly optimized software implementation of standards-compliant elliptic curve cryptography (ECC) for wireless sensor nodes equipped with an 8-bit AVR microcontroller. We exploit the state-of-the-art optimizations and propose novel techniques to further push the performance envelope of a scalar multiplication on the NIST P-192 curve. To illustrate the performance of our ECC software, we develope the prototype implementations of different cryptographic schemes for securing communication in a wireless sensor network, including elliptic curve Diffie–Hellman (ECDH) key exchange, the elliptic curve digital signature algorithm (ECDSA), and the elliptic curve Menezes–Qu–Vanstone (ECMQV) protocol. We obtain record-setting execution times for fixed-base, point variable-base, and double-base scalar multiplication. Compared with the related work, our ECDH key exchange achieves a performance gain of roughly 27% over the best previously published result using the NIST P-192 curve on the same platform, while our ECDSA performs twice as fast as the ECDSA implementation of the well-known TinyECC library. We also evaluate the impact of Karatsuba’s multiplication technique on the overall execution time of a scalar multiplication. In addition to offering high performance, our implementation of scalar multiplication has a highly regular execution profile, which helps to protect against certain side-channel attacks. Our results show that NIST-compliant ECC can be implemented efficiently enough to be suitable for resource-constrained sensor nodes.

Elliptic Curve Diffie-Hellman Random Keys Using Artificial Neural Network and Genetic Algorithm for Secure Data over Private Cloud

Elliptic Curve Diffie-Hellman Random Keys Using Artificial Neural Network and Genetic Algorithm for Secure Data over Private Cloud

네트워크 공격 방지를 지원하는 DHCP의 설계 및 구현에 관한 연구

ABSTRACT DHCP(Dynamic Host Configuration Protocol) is a protocol for efficiency and convenience of the IP address management. DHCP automatically assigns an IP address and configuration information needed to run the TCP/IP communication to individual host in the network. However, existing DHCP is vulnerable for network attack such as DHCP spoofing, release attack because there is no mutual auth entication systems between server and client. To solve this problem, we have designed a new DHCP protocol supporting the following features: First, ECDH(Elliptic Curve Diffie-Hellman) is used to create session key and ECDSA(Elliptic Curve Digital Signature Algorithm) is used for mutual authentication between server and client. Also this protocol ensures integrity of message by adding a HMAC(Hash-based Message Authentication Code) on the message. And replay attacks can be prevented by using a Nonce. As a result, The receiver can prevent the network attack by discarding the received message from unauthorized host.

An Efficient 3D Elliptic Curve Diffie–Hellman (ECDH) Based Two-Server Password-Only Authenticated Key Exchange Protocol with Provable Security

ABSTRACTIn large-scale distributed systems, where adversarial attacks have extensive impact, authentication provides fortification against threats involving impersonation of entities and tampering of data. Towards this, we introduce the first tetrahedron (three-dimensional (3D)) based two-server Password Authenticated and Key Exchange (PAKE) protocol to represent text passwords. A 3D PAKE protocol is a hybrid cryptographic algorithm that requires two servers for authentication; one server engages with users and the other is hidden from the clients. A remarkable aspect of the proposed 3D PAKE protocol is that reclaiming password from the stored credentials is not possible when either one/both the servers gets compromised. In this paper, we discuss the properties of tetrahedron that mesh well with Diffie–Hellman key exchange protocol and elliptic curve cryptography encryption scheme and proved that the protocol is resistant against cryptographic attacks without the involvement of public key infrastructure. The proposed protocol is the first provably secure two-server PAKE protocol against an offline dictionary attack.

ECDSA Passive Attacks, Leakage Sources, and Common Design Mistakes

Elliptic Curves Cryptography (ECC) tends to replace RSA for public key cryptographic services. ECC is involved in many secure schemes such as Elliptic Curve Diffie-Hellman (ECDH) key agreement, Elliptic Curve Integrated Encryption Scheme (ECIES), and Elliptic Curve Digital Signature Algorithm (ECDSA). As for every cryptosystem, implementation of such schemes may jeopardize the inherent security provided by the mathematical properties of the ECC. Unfortunate implementation or algorithm choices may create serious vulnerabilities. The elliptic curve scalar operation is particularly sensitive among these schemes. This article surveys passive attacks against well-spread elliptic curve scalar multiplication algorithms highlighting leakage sources and common mistakes that can be used to attack the ECDSA scheme. Experimental results are provided to illustrate and demonstrate the effectiveness of each vulnerability. Finally, the article describes the link between partial leakage and lattice attack in order to understand and demonstrate the impact of small leakages on the security of ECDSA. An example of side channel and lattice attack combination on NIST P-256 is provided in the case where the elliptic curve scalar multiplication is not protected against DPA/CPA and a controllable device is not accessible.

Security Analysis and Improvements of Session Key Establishment for Clustered Sensor Networks

WSN (wireless sensor network) is one of the main technologies in IoT (Internet of Things) applications or services. To date, several schemes have been proposed to establish a pair-wise key between two nodes in WSN, and most of them are designed to establish long-term keys used throughout the network lifetime. However, in the near future, if WSN will be used for information infrastructures in various fields such as manufacturing, distribution, or public facilities management and its life cycle can be as long as that of other common networks, it will definitely be advantageous in terms of security to encrypt messages using session keys instead of long-term keys. In this paper, we propose a session key establishment scheme for clustered sensor networks that is based on elliptic curve Diffie-Hellman (ECDH) key exchange and hash chain. The proposed scheme eliminates vulnerabilities of existing schemes for WSN and has improved security. The proposed scheme is efficient in terms of energy costs compared to related schemes.

Flexible group key management and secure data transmission in mobile device communications using elliptic curve Diffie-Hellman cryptographic system

Nowadays, mobile networks are a popular environment. The networks consist of diverse mobile equipments, and frequently change without predictions. Therefore, it is difficult to share and secure information among them. Hence, a workable infrastructure is essential to be proposed. This study combines base stations with a cloud-based infrastructure to construct secure mobile network communications. The infrastructure allows mobile phones, moving vehicles and different mobile devices to securely share information with each other. Each mobile device collects its adjacent information and sends it through base stations. Eventually, base stations deliver the collected data to a control centre which digests the mass data into valuable information and shares the precious result with mobile devices. During the data transmission, this study introduces several mechanisms to secure the transmitted data. The proposed infrastructure is quite suited for diverse mobile devices, and can be implemented on mobile communications.

Provably secure group key agreement protocol based on ECDH with integrated signature

This paper proposes a new two round authenticated contributory group key agreement (ACGKA) protocol based on elliptic curve Diffie–Hellman (ECDH) with integrated signature. In this technique, one node is picked up as the group controller, and this node runs an authenticated ECDH with the rest of the nodes to generate an authenticated shared key per each two-party. It then merges these keys in another round in such a way that every member obtains the identical authenticated group key. Further, ACGKA is extended to dynamic ACGKA protocol. The dynamic ACGKA, being elliptic curve decisional Diffie Hellman-based, is less expensive and well suited for resource constrained networks such as mobile ad-hoc networks, and wireless sensor network. Also, we demonstrate that all the protocols proposed in this paper are provably secure in the standard model under ECDDH assumption and moreover secure against most of the active and passive attacks. Finally, the proposed protocol is compared with other prevalent ECDH and Diffie Hellman based group key agreement protocols, and results are found to be satisfactory. Copyright © 2015 John Wiley & Sons, Ltd

Towards Smart Card Based Mutual Authentication Schemes in Cloud Computing

In the cloud environment, users pay more attentions to their data security since all of them are stored in the cloud server. Researchers have proposed many mutual authentication schemes for the access control of the cloud server by using the smart card to protect the sensitive data. However, few of them can resist from the smart card lost problem and provide both of the forward security and the backward security. In this paper, we propose a novel authentication scheme for cloud computing which can address these problems and also provide the anonymity for the user. The trick we use is using the password, the smart card and the public key technique to protect the processes of the user’s authentication and key exchange. Under the Elliptic Curve Diffie-Hellman (ECDH) assumption, it is provably secure in the random oracle model. Compared with the existing smart card based authentication schemes in the cloud computing, the proposed scheme can provide better security degree.

A key management technique based on elliptic curves for static wireless sensor networks

AbstractThis paper presents a key distribution scheme based on elliptic curve Diffie–Hellman (ECDH) key exchange for static wireless sensor networks with node addition. The proposed scheme relies on the transitory master key approach for secret key establishment and addresses the man‐in‐the‐middle attack in ECDH key exchange. The major advantage of the proposed method compared with the state‐of‐the‐art schemes is the high resilience offered by this scheme even if nodes are compromised in the initialisation phase. The communication overhead, computational cost and storage requirement of the proposed method is very less compared with the elliptic curve‐based approaches available in the literature. The proposed scheme can also support large networks without affecting the security and efficiency. Copyright © 2015 John Wiley & Sons, Ltd.

구글 보이스 취약점을 통한 안드로이드 서드 파티 어플리케이션의 사용자 인증 개선방안 연구

In the Android market, a large portion of the market share consists of third party applications, but not much research has been performed in this respect. Of these applications, mobile Voice Over IP (VoIP) applications are one of the types of applications that are used the most. In this paper, we focus on user authentication methods for three representative applications of the Google Voice service, which is a famous mobile VoIP application. Then, with respect to the Android file system, we developed a method to store and to send user information for authentication. Finally, we demonstrate a vulnerability in the mechanism and propose an improved mechanism for user authentication by using hash chaining and an elliptic curve Diffie-Hellman key exchange.

Protecting User Privacy for Cloud Computing by Bivariate Polynomial Based Secret Sharing

Cloud computing is an Internet-based computing. In cloud computing, the service is fully served by the provider. Users need nothing but personal devices and Internet access. Computing services, such as data, storage, software, computing, and application, can be delivered to local devices through Internet. The major security issue of cloud computing is that cloud providers must ensure that their infrastructure is secure, and prevent illegal data accesses from outsiders, other clients, or even the unauthorized cloud employees. In this paper, we deal with key agreement and authentication for cloud computing. By using Elliptic Curve Diffie Hellman (ECDH) and symmetric bivariate polynomial based secret sharing, we design a secure cloud computing (SCC). Two types of SCC are proposed. One requires a trusted third party (TTP), and the other does not need a TTP. Additionally, via the homomorphism property of polynomial based secret sharing, our SCC can be extended to multi-server SCC (MSCC) to fit an environment where a multi-server system contains multiple servers to collaborate for serving applications.

Review of current methods of quantum and post-quantum cryptography

A quantum computer can destroy most, if not all, of the traditional cryptosystems used in practice, namely, all the systems on the basis of the integer factorization problem (e. g. RSA) or the discrete logarithm problem (both traditional and elliptic curve Diffie-Hellman and DSA, and the whole cryptography based on the pairing). Some classic cryptosystems based on computationally difficult problems are very different from the above and more difficult to solve, they are independent of the quantum computation. In this paper, a review of methods of information security based on quantum and post-quantum technologies was carried out. For each of the methods of information security based on quantum technologies are the advantages and disadvantages. Describes the system of post-quantum cryptography based on lattice theory. The results of the survey allow to formalize the direction of future research of post-quantum methods and development of new effective information security systems using quantum technologies.

Analyzing secure key authentication and key agreement protocol for promising features of IP multimedia subsystem using IP multimedia server-client systems

Recently, Session Initiation Protocol (SIP) has become a prime signaling protocol for the multimedia communication systems, though none of the researchers have analyzed its promising features, namely access independence, authentication scheme verification, AKA (Authentication and Key Agreement) security properties, 3GPP security properties, signal congestion, bandwidth consumption and computation overhead using the physical multimedia server-client platform. To examine the issues realistically, the existing authentication schemes, such as UMTS AKA, EPS AKA, Cocktail AKA, S AKA, HL AKA and ZZ AKA were designed and developed in the multimedia server-client systems deployed on Linux platform. The cross-examination revealed that the existing schemes failed to satisfy the IMS (IP Multimedia Subsystem) promising features, like mutual authentication, session-key sharing, (perfect) forward secrecy and implicit-key authentication. Thus, this paper proposes a Secure-Key Authentication and Key Agreement protocol (SK AKA) to meet out the standard demands of IMS. To curtail its authentication steps, the secure authentication vector SAV computes and dispenses the generated vectors between the multimedia server-client systems in advance, through the serving call session control function SCSCF. As a result, the execution steps of UMTS AKA are annulled for the sake of accomplishment of the IMS features. In addition, the protocol of SK AKA integrates the strategies of Context Identity CID and Elliptic Curve --- Diffie Hellman (EC-DH) to resist most of the potential attacks like SIP flooding, forgery, man-in-the-middle, password guessing and key impersonation. To analyze the parameters, such as (SIP) Flooding Attack Detection Rate, End-To-End Delay of Multiple Voice Call Session, Call Success Rate, SIP Utilization, RTP Utilization, Call Response Time, Bandwidth Consumption and Signalling Congestion realistically, the proposed and existing authentication schemes have been coded and integrated in the real-time IMS client-server system. Above all, the thoroughgoing research has revealed that the proposed protocol of SK AKA accomplishes all the IMS challenges: 1. Adhere the promising features of IMS; 2. Attack resiliency; and 3. Fulfill the promising parameters of IMS, in comparison with the other existing schemes.

QoS-Aware Distributed Security Architecture for 4G Multihop Wireless Networks

Vehicular communications have received a great deal of attention in recent years due to the demand for multimedia applications during travel and for improvements in safety. Safety applications often require fast message exchanges but do not use much bandwidth. On the other hand, multimedia services require high bandwidth for vehicular users. Hence, to provide mobile broadband services at a vehicular speed of up to 350 km/h, Worldwide interoperable for Microwave Access (WiMAX) and Long-Term Evolution (LTE) are considered the best technologies for vehicular networks. WiMAX and LTE are Fourth-Generation (4G) wireless technologies that have well-defined quality of service (QoS) and security architectures. However, some security threats, such as denial of service (DoS), an introduction of rogue node, etc., still exist in WiMAX and LTE networks, particularly in multihop networks. Therefore, strong security architecture and hasty authentication methods are needed to mitigate the existing security threats in 4G multihop wireless networks. Conversely, the network QoS should not be degraded while enhancing security. Thus, we propose QoS-aware distributed security architecture using the elliptic curve Diffie-Hellman (ECDH) protocol that has proven security strength and low overhead for 4G wireless networks. In this paper, we first describe the current security standards and security threats in WiMAX and LTE networks. Then, the proposed distributed security architecture for 4G multihop wireless networks is presented. Finally, we compare and analyze the proposed solution using testbed implementation and simulation approaches for WiMAX. From the simulation and testbed results for WiMAX networks, it is evident that the proposed scheme provides strong security and hasty authentication for handover users without affecting the QoS performance. For LTE networks, we present the theoretical analysis of the proposed scheme to show that similar performance can also be achieved.

EAPSG: Efficient authentication protocol for secure group communications in maritime wideband communication networks

The maritime wideband communication network, which extends the operation of wireless access from land to sea, will significantly contribute to the maritime distress, urgency, safety, and general communications. The Worldwide Interoperability for Microwave Access (WiMAX) technology has been applied to establish a maritime wideband shore-side network infrastructure, to achieve large capacity data backhauls. However, in this scenario, many new security and privacy challenges are arising, e.g., the reduced time overhead for group access authentication due to limited time window vessels passing by infostations along the shore-side. In this paper, a simple and reliable group authentication framework is developed for dealing with security issues in this special maritime wideband communication scenario. Specifically, an efficient authentication protocol for secure group communications (EAPSG) in maritime wideband communication network is proposed based on the Elliptic Curve Diffie-Hellman (ECDH), to overcome the weakness existing in the prevailing protocols on land, i.e., user identity disclosure, the lack of perfect forward secrecy, and man-in-the-middle attacks. Meanwhile, EAPSG can reduce the communication overhead and computational complexity by designing group access authentication procedures. Compared with conventional EAP-AKA protocol used in WiMAX networks on land, our scheme enhances the security and provides better performance. Especially, the security of the proposed protocol was verified by Automated Validation of Internet Security Protocols and Applications (AVISPA), and detailed performance evaluations are also given. The results illustrate that the proposed EAPSG outperforms other existing schemes on land in terms of the delivery cost and the number of signaling messages.

ECDH-based Scalable Distributed Key Management Scheme for Secure Group Communication

With the popularity of group-oriented applications, secure and efficient communication among all group members has become a major issue. An efficient key management mechanism is the base and critical technology of secure group communications. A distributed grouporiented key management scheme without the participation of third parties is proposed in the paper. The scheme deploys Elliptic Curve Diffie-Hellman (ECDH) which is more lightweight compared to regular Diffie-Hellman. The approach includes group key establishment and rekeying algorithms when there are membership changes. By using a distributed architecture, the load of key management is reduced. Specifically, the scheme can be extended to hybrid architecture to provide better scalability. Consequently, the extended scheme is both fault-tolerant and efficient in terms of integrity and confidentiality. In all protocol suites, the shared group key is calculated by scalar multiplication. According to performance comparisons with other schemes, the proposed scheme dramatically reduces communication overhead and computational costs. Security analysis indicates that the proposal provides a number of desirable security properties, including group key secrecy, forward secrecy and backward secrecy.

An identity-based key agreement scheme for large scale sensor networks

To solve the problems of high memory occupation, low connectivity and poor resiliency against node capture, which existing in the random key pre-distribution techniques while applying to the large scale Wireless Sensor Networks (WSNs), an Identity-Based Key Agreement Scheme (IBKAS) is proposed based on identity-based encryption and Elliptic Curve Diffie-Hellman (ECDH). IBKAS can resist man-in-the-middle attacks and node-capture attacks through encrypting the key agreement parameters using identity-based encryption. Theoretical analysis indicates that comparing to the random key pre-distribution techniques, IBKAS achieves significant improvement in key connectivity, communication overhead, memory occupation, and security strength, and also enables efficient secure rekeying and network expansion. Furthermore, we implement IBKAS for TinyOS-2.1.2 based on the MICA2 motes, and the experiment results demonstrate that IBKAS is feasible for infrequent key distribution and rekeying for large scale sensor networks.

EAP-Based Group Authentication and Key Agreement Protocol for Machine-Type Communications

Machine to machine (M2M) communications, also called machine-type communications (MTC), has widely been utilized in applications such as telemetry, industrial, automation, and SCADA systems. The group-based MTC, especially when MTC devices belong to non-3GPP network, will face new challenge of access authentication. In this paper, we propose a group authentication and key agreement protocol, called EG-AKA, for machine-type communications combining elliptic curve Diffie-Hellman (ECDH) based on EAP framework. Compared with conventional EAP-AKA, our protocol guarantees stronger security and provides better performance. Detailed security analysis has shown that the proposed EG-AKA protocol is secure in terms of user and group identity protection and resistance to several attacks. Furthermore, formal verification implemented in AVISPA proves that the proposed protocol is secure against various malicious attacks. Moreover, performance evaluation demonstrates its efficiency in terms of the signaling overhead, the bandwidth consumption, and the transmission cost.