HMAC Research Articles

Hashing and Message Authentication Code Implementation. An Embedded Approach

There are different methods by which a message hashing could be embedded in a communications network, therefore different approaches are described in this research to protect the hash value of a message. The structure of a cryptographically secure function (SHA-512) is presented along with the low-level algorithm sequence. Subsequently is detailed the Hash-based Message Authentication Code (HMAC) produced by concatenating a secret key and message, after which the composite message is hashed. However, the HMAC numerical structure and the specific operating algorithm are explained in detail to the logical gate level. Finally, several considerations regarding the low-level implementation of the code are concluded.

Hash Based Co-Operative Method To Handle Sybil Attack Sequences In Vehicular Ad Hoc Networks

Vehicular without any preparation arrange (VANETs) being stretched out to depict kept up for traffic control systems, stay away from misfortune oriented_ information relations, stopping and information correspondence in remote structure structures. Protection and security are generally two _concerns in vehicular _ad hoc systems. Dreadfully, _VANET have absolute best _privacy safeguarding ways to deal with oversee fragile Sybil assaults, where a malignant client can be familiar and indicate with be different vehicles. VANETs by making hallucination organized traffic deter. So that in this paper, we propose and develop Hash based Co-operative and Cryptographic Approach to handle Sybil attacks. This approach consists statistical approach to identify and verify vehicle information (id, ip address and where it is from and other details) and develop HMAC (Hash based Message Authentication Codes) encryption approach to detect Sybil attacks from forgery oriented attack sequences. Finally based on US map data available in VANET basic security web site, we generate different simulations to evaluate efficiency and feasibility of proposed approach. Our schema supports Sybil attacks detection without any support of outside positioning environment. Our experimental results show efficient result communication over detection of Sybil attacks in wireless network communication.

Secure key agreement based on ordered biometric features

In this work, we propose a novel secure key agreement protocol, Secure Key Agreement using Pure Ordered Biometrics (SKA-POB), in which the cryptographic keys are generated using an ordered set of biometrics, without any extra shared secret data or keys. The proposed approach is instantiated using iris biometrics. Our protocol makes use of hash functions and HMAC (Hash-based Message Authentication Code) as the only cryptographic primitives; thus, it is not cryptographically resource-hungry. We also propose and integrate a window-based comparison strategy and a window reset method in SKA-POB. This way, performance is maximized without sacrificing security. Furthermore, we propose an intelligent fake block generation and distribution strategy to hide the genuine blocks in transit, which increases the resistence of our proposed protocol against correlation attacks. SKA-POB protocol works in round manner, allowing to successfully terminate with key establishment as early as possible so that the complexity is reduced for both client and server sides. Additionally, we employ multi-criteria analyses for our proposed SKA-POB protocol and we provide verification results in terms of performance analysis together with randomness, distinctiveness and attack complexity through security analysis. Results show that highly random and computationally secure keys can be generated with almost no error and with very low complexity.

Using Blockchain for Improved Video Integrity Verification

A video record plays a crucial role in providing evidence for crime scenes or road accidents. However, the main problem with the video record is that it is often vulnerable to various video tampering attacks. Although visual evidence is required to conduct an integrity verification before investigations, it is still difficult for human vision to detect a forgery. In this paper, we propose a novel video integrity verification method (IVM) that takes advantage of a blockchain framework. The proposed method employs an effective blockchain model in centralized video data, by combining a hash-based message authentication code and elliptic curve cryptography to verify the integrity of a video. In our method, video content with a predetermined size (segments) is key-hashed in a real-time manner and stored in a chronologically chained fashion, thus establishing an irrefutable database. The verification process applies the same procedure to the video segment and generates a hash value that can be compared with the hash in the blockchain. The proposed IVM is implemented on a PC environment, as well as on an accident data recorder-embedded system for verification. The experimental results show that the proposed method has better detection capabilities and robustness toward various kinds of tampering, such as copy-move, insert, and delete, as compared to other state-of-the-art methods. An analysis based on execution time along with an increase in the number of blocks within the blockchain shows a minimal overhead in the proposed method.

Achieve Efficient and Verifiable Conjunctive and Fuzzy Queries over Encrypted Data in Cloud

Due to the high demands of searchability over encrypted data, searchable encryption (SE) has recently received considerable attention and been widely suggested in encrypted cloud storage. Typically, the cloud server is assumed to be honest-but-curious in most SE-based cloud storage systems, i.e., the cloud server should follow the protocol to return valid and complete search results to users. However, this trust assumption is not always true due to some unanticipated situations, such as misconfigurations and malfunctions. Therefore, the function of verifiability of search results becomes crucial for the success of SE-based cloud storage systems. For this reason, many verifiable SE schemes have been proposed; however, they either fail to support query operators “OR”, “AND”, “ <inline-formula><tex-math notation="LaTeX">$\ast$</tex-math></inline-formula> ” and “?” simultaneously, or require many time-consuming operations. Aiming at addressing this problem, in this paper, we propose a new verifiable SE scheme for encrypted cloud storage. The proposed scheme is characterized by integrating various techniques, i.e., bitmap index, radix tree, format preserving encryption, keyed-hash message authentication code and symmetric key encryption, for achieving efficient and verifiable conjunctive and fuzzy queries over encrypted data in the cloud. Detailed security analysis shows that our proposed scheme holds the confidentiality of data and verifiability of search results at the same time. In addition, extensive experiments are conducted, and the results demonstrate our proposed scheme is efficient and suitable for users to retrieve their data from the cloud to their mobile devices.

Correlation power attack on a message authentication code based on SM3

Hash-based message authentication code (HMAC) is widely used in authentication and message integrity. As a Chinese hash algorithm, the SM3 algorithm is gradually winning domestic market value in China. The side channel security of HMAC based on SM3 (HMAC-SM3) is still to be evaluated, especially in hardware implementation, where only intermediate values stored in registers have apparent Hamming distance leakage. In addition, the algorithm structure of SM3 determines the difficulty in HMAC-SM3 side channel analysis. In this paper, a skillful bit-wise chosen-plaintext correlation power attack procedure is proposed for HMAC-SM3 hardware implementation. Real attack experiments on a field programmable gate array (FPGA) board have been performed. Experimental results show that we can recover the key from the hypothesis space of 2256 based on the proposed procedure.

Stateless Authentication with JSON Web Tokens using RSA-512 Algorithm

Today's technology needs are getting higher, one of the technologies that continues to grow now is Web Service (WS). WS can increase service flexibility on a system. However, security at WS is one of the things that needs attention. One effort to overcome this problem is JWT (JSON Web Token). JWT is one of the authentication mechanisms in WS, with a standard signature algorithm, HMAC SHA256, RSA-256 or ECDSA. In this research we will discuss the performance of JWT RSA-512 which is implemented on SOAP and RESTful. Because based on previous research the speed performance of the 512-bit algorithm is better, but it is not yet known if applied to JWT. The test results show that the speed of the JWT RSA-512 token on the RESTful process is superior to 24.69% compared to SOAP. Then the speed of the authentication of JWT RSA-512 tokens, RESTful is superior to 11.64% compared to SOAP. Whereas in testing the size of JWT RSA-512 generated tokens, RESTful is only 1.25% superior to SOAP.

Vulnerabilities and Limitations of MQTT Protocol Used between IoT Devices

With the proliferation of smart devices capable of communicating over a network using different protocols, each year more and more successful attacks are recorded against these, underlining the necessity of developing and implementing mechanisms to protect against such attacks. This paper will review some existing solutions used to secure a communication channel, such as Transport Layer Security or symmetric encryption, as well as provide a novel approach to achieving confidentiality and integrity of messages. The method, called Value-to-Keyed-Hash Message Authentication Code (Value-to-HMAC) mapping, uses signatures to send messages, instead of encryption, by implementing a Keyed-Hash Message Authentication Code generation algorithm. Although robust solutions exist that can be used to secure the communication between devices, this paper considers that not every Internet of Things (IoT) device or network design is able to afford the overhead and drop in performance, or even support such protocols. Therefore, the Value-to-HMAC method was designed to maximize performance while ensuring the messages are only readable by the intended node. The experimental procedure demonstrates how the method will achieve better performance than a symmetric-key encryption algorithm, while ensuring the confidentiality and integrity of information through the use of one mechanism.

RF-PUF: Enhancing IoT Security Through Authentication of Wireless Nodes Using &lt;italic&gt;In-Situ&lt;/italic&gt; Machine Learning

Traditional authentication in radio-frequency (RF) systems enable secure data communication within a network through techniques such as digital signatures and hash-based message authentication codes (HMAC), which suffer from key-recovery attacks. State-of-the-art Internet of Things networks such as Nest also use open authentication (OAuth 2.0) protocols that are vulnerable to cross-site-recovery forgery (CSRF), which shows that these techniques may not prevent an adversary from copying or modeling the secret IDs or encryption keys using invasive, side channel, learning or software attacks. Physical unclonable functions (PUFs), on the other hand, can exploit manufacturing process variations to uniquely identify silicon chips which makes a PUF-based system extremely robust and secure at low cost, as it is practically impossible to replicate the same silicon characteristics across dies. Taking inspiration from human communication, which utilizes inherent variations in the voice signatures to identify a certain speaker, we present RF-PUF: a deep neural network-based framework that allows real-time authentication of wireless nodes, using the effects of inherent process variation on RF properties of the wireless transmitters (Tx), detected through in-situ machine learning at the receiver (Rx) end. The proposed method utilizes the already-existing asymmetric RF communication framework and does not require any additional circuitry for PUF generation or feature extraction. The burden of device identification is completely shifted to the gateway Rx, similar to the operation of a human listener’s brain. Simulation results involving the process variations in a standard 65-nm technology node, and features such as local oscillator offset and ${I}$ – ${Q}$ imbalance detected with a neural network having 50 neurons in the hidden layer indicate that the framework can distinguish up to 4800 Tx(s) with an accuracy of 99.9% [≈99% for 10000 Tx(s)] under varying channel conditions, and without the need for traditional preambles. The proposed scheme can be used as a stand-alone security feature, or as a part of traditional multifactor authentication.

Further Analysis of PRNG-Based Key Derivation Functions

The Internet of Things (IoT) is growing at a rapid pace. With everyday applications and services becoming wirelessly networked, security still is a major concern. Many of these sensors and devices have limitations, such as low power consumption, reduced memory storage, and reduced fixed point processing capabilities. Therefore, it is imperative that high-performance security primitives are used to maximize the lifetime of these devices while minimally impacting memory storage and timing requirements. Previous work presented a residue number system (RNS)-based pseudorandom number generator (PRNG)-based key derivation function (KDF) (PKDF) that showed good initial energy-efficient performance for the IoT devices. This paper provides additional analysis on the PRNG-based security and draws a comparison to a current industry-standard KDF. Subsequently, embedded software implementations were performed on an MSP430 and MSP432 and compared with the transport layer security (TLS) 1.3 hash-based message authentication code (HMAC) key derivation function (HKDF); these results demonstrate substantial computational savings for the PKDF approach, while both pass the NIST randomness quality tests. Finally, hardware translation for the PKDF is evaluated through the Mathworks’ HDL Coder toolchain and mapping for throughput and die area approximation on an Intel® Arria 10 FPGA.

Analysis and Implementation of Message Authentication Code (MAC) Algorithms for GOOSE Message Security

There is growing awareness towards cybersecurity threats in power systems. IEC 61850 standard facilitates communication between different Intelligent Electronic devices (IEDs) and eases interoperable operation with set data and message structures. An unwanted consequence of this standardized communication over ethernet is increased viability to cyber threats. The IEC 62351-6 standard stipulates the use of digital signatures for ensuring integrity in IEC 61850 message exchanges. However, the digital signatures result in higher computational times which makes it very difficult to use for Generic Object-Oriented Substation Events (GOOSE) messages. This short communication article proposes implementation of the Message Authentication Code (MAC) algorithms, such as Hash-based Message Authentication Code (HMAC) and Advanced Encryption Standard-Galois Message Authentication Code (AES-GMAC), for GOOSE message integrity. Lab tests are run to observe their timing performances and feasibility for GOOSE.

Certificate Based Authentication Mechanism for PMU Communication Networks Based on IEC 61850-90-5

Smart grids are becoming increasingly popular thanks to their ability to operate with higher precision and smaller margins. Dynamic operation control in smart grids can be achieved with phasor measurement unit (PMU) based wide area monitoring and control systems. The data communication requirements for the PMU based applications are well addressed in the IEEE C37.118.2 and IEC 61850-90-5 standards. Due to the higher probability of cyberattacks and the scale of their impact, data security is a critical requirement in PMU communication networks. The IEC 61850-90-5 communication standard addresses this security concern and proposes the HMAC (hash based message authentication code) with key distribution center (KDC) scheme for achieving information authentication and integrity. However, these IEC 61850-90-5 security recommendations do not consider the mechanism for attacks such as man-in-the-middle (MITM) attacks during KDC key exchanges. MITM attacks can be easily implemented and may have a large impact on the grid operation. This paper proposed an explicit certificate-based authentication mechanism to mitigate MITM attacks in PMU communication networks. The proposed certificate-based authentication mechanisms were implemented in real-time using Python-based terminals to observe their performance with different signature algorithms.

A comparative analysis of VLSI trusted virtual sensors

This paper analyzes three cryptographic modules suitable for digital designs of trusted virtual sensors into integrated circuits, using 90-nm CMOS technology. One of them, based on the keyed-hash message authentication code (HMAC) standard employing a PHOTON-80/20/16 lightweight hash function, ensures integrity and authentication of the virtual measurement. The other two, based on CAESAR (the Competition for Authenticated Encryption: Security, Applicability, and Robustness) third-round candidates AEGIS-128 and ASCON-128, ensure also confidentiality. The cryptographic key required is not stored in the sensor but recovered in a configuration operation mode from non-sensitive data stored in the non-volatile memory of the sensor and from the start-up values of the sensor SRAM acting as a Physical Unclonable Function (PUF), thus ensuring that the sensor is not counterfeit. The start-up values of the SRAM are also employed in the configuration operation mode to generate the seed of the nonces that make sensor outputs different and, hence, resistant to replay attacks. The configuration operation mode is slower if using CAESAR candidates because the cryptographic key and nonce have 128 bits instead of the 60 bits of the key and 32 bits of the nonce in HMAC. Configuration takes 416.8 µ s working at 50 MHz using HMAC and 426.2 µ s using CAESAR candidates. In the other side, the trusted sensing mode is much faster with CAESAR candidates with similar power consumption. Trusted sensing takes 212.62 µ s at 50 MHz using HMAC, 0.72 µ s using ASCON, and 0.42 µ s using AEGIS. AEGIS allows the fastest trusted measurements at the cost of more silicon area, 4.4 times more area than HMAC and 5.4 times more than ASCON. ASCON allows fast measurements with the smallest area occupation. The module implementing ASCON occupies 0.026 mm2 in a 90-nm CMOS technology.

An Enhanced Hash-based Message Authentication Code using BCrypt

An Enhanced Hash-based Message Authentication Code using BCrypt

Balancing Trade-off between Data Security and Energy Model for Wireless Sensor Network

&lt;p&gt;An extensive effort to evolve various routing protocol to ensure optimal data delivery in energy efficient way is beneficial only if there is additional means of security process is synchronized. However, the security process consideration introduces additional overhead thus a security mechanism is needed to accomplish an optimal trade-off that exists in-between security as well as resource utilization especially energy. The prime purpose of this paper is to develop a process of security in the context of wireless sensor networks (WSN) by introducing two types of sensor node deployed with different capabilities. The proposed algorithm Novel Model of Secure Paradigm (N-MSP) which is further integrated with WSN. However, this algorithm uses a Hash-based Message Authentication Code (HMAC) authentication followed by pairwise key establishment during data aggregation process in a WSN. The extensive simulation carried out in a numerical platform called MATLAB that depicts that the proposed N-MSP achieves optimal processing time along with energy efficient pairwise key establishment during data aggregation process&lt;/p&gt;

Design and Analysis of Stability-Guaranteed PUFs

The lack of stability is one of the limitations that constrain physical unclonable function (PUF) from being put in widespread practical use. In this paper, we propose a weak PUF and a strong PUF that are both completely stable. These PUFs are called locally enhanced defectivity physical unclonable function (LEDPUF). An LEDPUF is a pure functional PUF that does not require any kinds of correction schemes as conventional parametric PUFs do. The source of randomness of an LEDPUF is extracted from locally enhance defectivity without affecting other parts of the chip. In this paper, we construct a weak LEDPUF by forming arrays of directed self-assembly random connections, and the strong LEDPUF is implemented by using the weak LEDPUF as the key of a keyed-hash message authentication code. Our simulation and statistical results show that the entropy of the weak LEDPUF bits is close to ideal, and the inter-chip Hamming distances of both weak and strong LEDPUFs are about 50%, which means that these LEDPUFs are not only stable but also unique. We develop a new unified framework for evaluating the security of PUFs, based on password security, by using information theoretic tools of guesswork. The guesswork model allows us to quantitatively compare, with a single unified metric, PUFs with varying levels of stability, bias, and available side information. In addition, it generalizes other measures to evaluate the security level, such as min-entropy and mutual information. We evaluate the guesswork-based security of some measured static random access memory and ring oscillator PUFs as an example and compare them with an LEDPUF to show that the stability has a more severe impact on the PUF security than biased responses. Furthermore, we find the guesswork of two new problems: guesswork under the probability of attack failure and the guesswork of strong PUFs that are used for authentication.

Functional Graphs and Their Applications in Generic Attacks on Iterated Hash Constructions

We provide a survey about generic attacks on cryptographic hash constructions including hash-based message authentication codes and hash combiners. We look into attacks involving iteratively evaluating identical mappings many times. The functional graph of a random mapping also involves iteratively evaluating the mapping. These attacks essentially exploit properties of the functional graph. We map the utilization space of those properties from numerous proposed known attacks, draw a comparison among classes of attacks about their advantages and limitations. We provide a systematic exposition of concepts of cycles, deep-iterate images, collisions and their roles in cryptanalysis of iterated hash constructions. We identify the inherent relationship between these concepts, such that case-by-case theories about them can be unified into one knowledge system, that is, theories on the functional graph of random mappings. We show that the properties of the cycle search algorithm, the chain evaluation algorithm and the collision search algorithm can be described based on statistic results on the functional graph. Thereby, we can provide different viewpoints to support previous beliefs on individual knowledge. In that, we invite more sophisticated analysis of the functional graph of random mappings and more future exploitations of its properties in cryptanalysis.

Functional Graphs and Their Applications in Generic Attacks on Iterated Hash Constructions

We provide a survey about generic attacks on cryptographic hash constructions including hash-based message authentication codes and hash combiners. We look into attacks involving iteratively evaluating identical mappings many times. The functional graph of a random mapping also involves iteratively evaluating the mapping. These attacks essentially exploit properties of the functional graph. We map the utilization space of those properties from numerous proposed known attacks, draw a comparison among classes of attacks about their advantages and limitations. We provide a systematic exposition of concepts of cycles, deep-iterate images, collisions and their roles in cryptanalysis of iterated hash constructions. We identify the inherent relationship between these concepts, such that case-by-case theories about them can be unified into one knowledge system, that is, theories on the functional graph of random mappings. We show that the properties of the cycle search algorithm, the chain evaluation algorithm and the collision search algorithm can be described based on statistic results on the functional graph. Thereby, we can provide different viewpoints to support previous beliefs on individual knowledge. In that, we invite more sophisticated analysis of the functional graph of random mappings and more future exploitations of its properties in cryptanalysis.

Enhancing security for end users in cloud computing environment using hybrid encryption technique

In the era of cloud, anything and everything as a service facilitates number of remote user connected from anywhere, anytime and any form of access to the storage services. Today, Cloud storage has become an essential aspect of cloud computing, stores information and support any kind of applications. Applications like Internet of Things, Big Data analytics, Data warehousing, Databases, Backups and archive applications all rely on some form or the other on cloud storage architecture. Users may have a different variants of smart devices such as tablet, PCs, notebook and smart phones. Cloud storage provides an interlink between these smart devices. Enterprises prefer to use cloud storage because they provide cost-friendly and flexible alternatives on locally implemented hardware. However, business process in the cloud needs secured transaction, confidential files are sometimes exposed to risk of leakage, as cloud- stored data resides outside of the local infrastructure, thus vulnerable to security risks. Cloud storage providers provides enough security at their end, but there is no system that provides client level security while using public clouds. The proposed system will provide client level security using hybrid encryption techniques. Using AES (Advance Encryption Standard) in CBC Mode (Cipher Block Chaining) and HMAC-SHA-1 (Hash-based Message Authentication Code) with light weight methods enhances the strong encryption at client level security. Fusion of these algorithms adds extra layers of security to the cloud storage data. The proposed method enhances the security measures for any client users, using storage as a service offered by several cloud service providers.

Key Recovery Attacks on HMAC with Reduced-Round AES

Key Recovery Attacks on HMAC with Reduced-Round AES