Hash Message Authentication Code Research Articles

Formal analysis of HMAC authorisation in the TPM2.0 specification

The Trusted Platform Module (TPM) is a system component that provides a hardware-based approach to establish trust in a platform. The latest TPM2.0 specification was accepted as the ISO standard in 2015. It offers functionality for key management by storing keys into the TPM's protected storage. The access to the TPM-resident key object is protected by the session-based authorisation mechanism. This mechanism is keyed to the object's authorisation value known as authValue and the session-bound secret value known as sessionKey. The new authValue introduced into the TPM is protected by the sessionbased encryption mechanism, which is also keyed on the sessionKey. In the authors' study, they conduct a formal analysis of the TPM2.0 HMAC (hash message authentication code) authorisation mechanism used in the key management. They first use the stateful applied π calculus to formalise the session-based HMAC authorisation and encryption mechanisms in a model of TPM2.0 API commands. They propose a threat model to formalise the secrecy and authentication properties. Then they discuss several attacking scenarios in practice where the sessionKey could be disclosed. They also instantiate their threat model according to specific attacking scenarios. By using the SAPIC tool and the tamarin prover, they automatically give out the analysis results of their models.

An Efficient Anonymous Batch Authentication Scheme Based on HMAC for VANETs

In vehicular ad hoc networks (VANETs), when a vehicle receives a message, the certificate revocation list (CRL) checking process will operate before certificate and signature verification. However, large communication sources, storage space, and checking time are needed for CRLs that cause the privacy disclosure issue as well. To address these issues, in this paper, we propose an efficient anonymous batch authentication scheme (ABAH) to replace the CRL checking process by calculating the hash message authentication code (HMAC). In our scheme, we first divide the precinct into several domains, in which road-side units (RSUs) manage vehicles in a localized manner. Then, we adopt pseudonyms to achieve privacy-preserving and realize batch authentication by using an identity-based signature (IBS). Finally, we use HMAC to avoid the time-consuming CRL checking and to ensure the integrity of messages that may get loss in previous batch authentication. The security and performance analysis are carried out to demonstrate that ABAH is more efficient in terms of verification delay than the conventional authentication methods employing CRLs. Meanwhile, our solution can keep conditional privacy in VANETs.

Mitigating Nat Holes Vulnerability in Teredo Clients

Tunneling is one of the key mechanisms which can help in the transition from the current IPv4 to IPv6 protocol. The function of automatic tunneling process is to encapsulate IPv6 packets into IPv4 packets. The main components involved in the tunelling mechanism are: Teredo, ISATAP, and 6to4. In some cases, however, these components have ceratain issues related to source routing, neighbor discovery and NAT holes problems. This paper aims to demonstrate how a serious problem related to the Teredo mechanism, called “Teredo NAT Holes” can be solved. The problem NAT Holes problem increases the attack surface in Teredo and thus causes the NAT service to become vulnerable to attacks. This research work proposes an approach called the Packet Authentication and Integrity Services (PAIS) that takes advantage of the Certificate Authentication (CA) that is combined with the Diffie-Hellman key exchange and Hash Message Authentication Code (HMAC) algorithms to provide a suitable solution for the problem. Here it is suggested that the proposed method needs to create the PAIS at the Tunnel’s starting point first, and then needs to verify it at the end point of the Tunnel, by recreating the value of md , which is subsequently inserted into the md field and compared against the md’ field in the packet. The proposed methodology adds md field in order to replace the next header in the packet header structure. The Diffie-Hellman algorithm is used for the key exchange. The IPv6 protocol supports loopback virtual network, and is used in the experimental test bed to validate the efficiency of the method. The experimental results show that the method offers good performance and is able to adequately mitigate NAT Holes issues in Teredo clients

A Secure Hash Message Authentication Code to Avoid Certificate Revocation List Checking in Vehicular Adhoc Networks

A secure hash message authentication code to avoid certificate revocation list checking is proposed for vehicular ad hoc networks (VANETs). The group signature scheme is widely used in VANETs for secure communication, the existing systems based on group signature scheme provides verification delay in certificate revocation list checking. In order to overcome this delay this paper uses a Hash message authentication code (HMAC). It is used to avoid time consuming CRL checking and it also ensures the integrity of messages. The Hash message authentication code and digital signature algorithm are used to make it more secure . In this scheme the group private keys are distributed by the roadside units (RSUs) and it also manages the vehicles in a localized manner. Finally, cooperative message authentication is used among entities, in which each vehicle only needs to verify a small number of messages, thus greatly alleviating the authentication burden. The security and performance analysis show that our scheme is more efficient in terms of authentication speed, while keeping conditional privacy in VANETs.

A Bilinear Pairing-Based Dynamic Key Management and Authentication for Wireless Sensor Networks

In recent years, wireless sensor networks have been used in a variety of environments; a wireless network infrastructure, established to communicate and exchange information in a monitoring area, has also been applied in different environments. However, for sensitive applications, security is the paramount issue. In this paper, we propose using bilinear pairing to design dynamic key management and authentication scheme of the hierarchical sensor network. We use the dynamic key management and the pairing-based cryptography (PBC) to establish the session key and the hash message authentication code (HMAC) to support the mutual authentication between the sensors and the base station. In addition, we also embed the capability of the Global Positioning System (GPS) to cluster nodes to find the best path of the sensor network. The proposed scheme can also provide the requisite security of the dynamic key management, mutual authentication, and session key protection. Our scheme can defend against impersonation attack, replay attack, wormhole attack, and message manipulation attack.

MAC Layer Based Certificate Authentication for Multiple Certification Authority in MANET

In this study, a novel Randomly Shifted Certification Authority Authentication protocol was used in ad hoc networks to provide authentication by considering the MAC layer characteristics. The nodes achieve authentication through the use of public key certificates issued by a CA, which assures the certificate’s ownership. As a part of providing key management, the active CA node transfers the image of the stored public keys to other idle CA nodes. Finally the current active CA randomly selects the ID of the available idle CA and shifts the CA ownership by transferring it. Revoking is done if any counterfeit or duplicate non CA node ID is found. Authentication and integrity is provided by preventing MAC control packets, and Enhanced Hash Message Authentication Code (EHMAC) can be used. Here EHMAC with various outputs is introduced in all control packets. When a node transmits a packet to a node with EHMAC, verification is conducted and the node replies with the transmitter address and EHMAC in the acknowledgement.

Efficient Privacy-Preserving Authentication for Vehicular Ad Hoc Networks

In this paper, we present an efficient privacy-preserving authentication scheme based on group signature for vehicular ad hoc networks (VANETs). Although group signature is widely used in VANETs to realize anonymous authentication, the existing schemes based on group signatures suffer from long computation delay in the certificate revocation list (CRL) checking and in the signature verification process, leading to high message loss. As a result, they cannot meet the requirement of verifying hundreds of messages per second in VANETs. In our scheme, we first divide the precinct into several domains, in which roadside units (RSUs) are responsible for distributing group private keys and managing vehicles in a localized manner. Then, we use a hash message authentication code (HMAC) to avoid time-consuming CRL checking and to ensure the integrity of messages before batch group authentication. Finally, we adopt cooperative message authentication among entities, in which each vehicle only needs to verify a small number of messages, thus greatly alleviating the authentication burden. The security and performance analysis show that our scheme is more efficient in terms of authentication speed, while keeping conditional privacy in VANETs.

An advanced security scheme based on clustering and key distribution in vehicular ad-hoc networks

Preservation of security is an essential requirement in vehicular ad hoc networks (VANETs) as vehicular communication is vulnerable to attacks. Attackers may exploit VANETs to send bogus information to deceive other vehicles which leads to serious issues. In this paper, we describe an advanced Secure scheme based on Clustering and Key Distribution (SCKD) among members and cluster-heads in VANET. The SCKD is a coordination based algorithm in which nodes are located within different clusters and their cluster heads are chosen from trusty nodes. For a secure end-to-end communication, our scheme deploys the proxy signature, blind proxy signature, hashed message authentication code, and symmetric cryptography. Results show that our scheme preserves security requirements including authentication, confidentiality, data-integrity, non-repudiation, and unforgeability. Since the cost and time computation of key generation and distribution decreases by SCKD compared with other algorithms, our algorithm will be applicable for VANETs.

PERFORMANCE EVALUATION OF CHAOTIC ENCRYPTION TECHNIQUE

Drastic growth in multimedia communication resulted to numerous security issues in the transmission of data. Moreover, the network used for the digital communication does not provide much security for the data transfer. During this time, tens of millions people using the internet options for essential communication and is being a tool for commercial field increased, So that security is an enormously important issue to deal with. We need to be protected confidentiality of data and provide secure connections for it. Hence we necessitate recognizing the different aspects of security and their applications. Many of these applications ranging from secure commerce, protecting passwords or pin and payments to private communications. As we know that, Cryptography is now becoming an essential aspect of the secure communication. Cryptography is the science of writing secret code with confident algorithm and key. The basic components of cryptography are encryption and decryption algorithms, digital signature and hashed message authentication code. We know that encryption is the synonym of cryptography. Different kinds of encryption are used in this modern era. Chaotic encryption is the type of the encryption which has adopted the concept of chaos. In this study, we are studying the history of cryptography until chaotic cryptography and analyzing the performance of chaotic encryption technique. The evaluation is performed in terms of encryption speed, the CPU utilization with time and the battery power consumption. The experimental results are specified the efficiency of the algorithms.

EMAP: Expedite Message Authentication Protocol for Vehicular Ad Hoc Networks

Vehicular ad hoc networks (VANETs) adopt the Public Key Infrastructure (PKI) and Certificate Revocation Lists (CRLs) for their security. In any PKI system, the authentication of a received message is performed by checking if the certificate of the sender is included in the current CRL, and verifying the authenticity of the certificate and signature of the sender. In this paper, we propose an Expedite Message Authentication Protocol (EMAP) for VANETs, which replaces the time-consuming CRL checking process by an efficient revocation checking process. The revocation check process in EMAP uses a keyed Hash Message Authentication Code ({HMAC}), where the key used in calculating the {HMAC} is shared only between nonrevoked On-Board Units (OBUs). In addition, EMAP uses a novel probabilistic key distribution, which enables nonrevoked OBUs to securely share and update a secret key. EMAP can significantly decrease the message loss ratio due to the message verification delay compared with the conventional authentication methods employing CRL. By conducting security analysis and performance evaluation, EMAP is demonstrated to be secure and efficient.

Digital Image Protection using Keyed Hash Function

Digital image authentication is an essential attribute for protecting digital image from piracy and copyright violator. Anti-piracy, digital watermarking, and ownership verification are some mechanisms evolving over the years for achieving digital image authentication. Cryptographic primitives, such as hash function, digital signature, and message authentication codes are being used in several applications including digital image authentication. Use of Least Significant Bit (LSB) is one of the classical approaches for digital image authentication. Although LSB approach is efficient, it does not provide adequate security services. On the other hand, digital signature-based image authentication provides better security, but with added computational cost in comparison with LSB approach. Furthermore, digital signature-based authentication approach requires managing public key infrastructure. Considering security weakness of LSB-based approach and cost overhead of public key based approach, the authors present a digital image authentication scheme using LSB and message authentication codes (MAC). The MAC-based approach for authenticating digital image is secure and efficient approach without public key management overhead. The authors also provide experimental results of the proposed scheme using MATLAB. The experimental results show that the proposed scheme is efficient and secure in comparisons with other schemes.

The Security in the Vehicular Ad Hoc Network (VANET) Using Expedite Message Authentication Protocol (EMAP)

A vehicular ad hoc network (VANET) uses cars as mobile nodes in a MANET to create a mobile network. In the vehicular ad hoc networks the security is an important concern. For security, Vehicular ad hoc networks (VANETs) adopt the Public Key Infrastructure (PKI) and Certificate Revocation Lists (CRLs). In the Public Key Infrastructure system, the authentication of a received message is performed by checking if the certificate of the sender is included in the current Certificate Revocation Lists (CRLs) and verifying the authenticity of the certificate and signature of the sender. But it takes more time for CRL checking process. So, in order to overcome this problem we use an efficient revocation check process in EMAP uses a keyed Hash Message Authentication Code (HMAC), where the key used in calculating the HMAC is shared only between non-revoked On-Board Units (OBUs). In addition, EMAP uses a novel probabilistic key distribution, which enables non-revoked OBUs to securely share and update a secret key. By using this method we significantly reduces the message loss ratio. But in this method generating and verifying such signatures can cause high computational overhead. So, to conquer this trouble we introduce an innovative technique called ASIA as an Accelerated Secure In-network Aggregation strategy that can accelerate message verifications and significantly reduce computational overhead while retaining satisfactory security. ASIA can largely accelerate message verifications and drastically reduce computational and communication overhead compared to existing schemes.

Securing AODV Routing Protocol in MANET Based on Cryptographic Authentication Mechanism

In mobile ad hoc wireless network (MANET), secure communication is more challenging task due to its fundamental characteristics like infrastructure less, wireless link, distributed cooperation, dynamic topology, lack of association, resource constrained and physical vulnerability of node. In MANET, attacks can be broadly classified in two categories: routing attacks and data forwarding attacks. Any action not following rules of routing protocols belongs to routing attacks. The main objective of routing attacks to mislead or disrupt normal functioning of network by advertising false routing updates. On the other hand data forwarding attacks include actions such as modification or dropping of data packet that does not disrupt routing protocol. In this thesis work, we proposed a method to secure ad hoc on-demand distance vector (AODV) routing protocol. The proposed method provides security for routing packets and can efficiently prevent the attacks such as black hole, modifying routing information and impersonation. The proposed method uses hashed message authentication code (HMAC) function which provides fast message verification and sender as well as intermediate nodes authentication. We simulate and compare the proposed method with original AODV and secure AODV (SAODV) protocol using network simulator tool (NS2). Simulation result shows that proposed method minimizes the time delay and network routing load involved in computation and verification of security fields during route discovery process and performs better than the original AODV protocol in the presence of malicious nodes performing black hole attack.

Message Authentication in Computationally Constrained Environments

RFID and wireless sensor networks exemplify computationally constrained environments, where the compact nature of the components cannot support complex computations or high communication overhead. On the other hand, such components should support security applications such as message integrity, authentication, and time stamping. The latter are efficiently implemented by hash message authentication codes (HMAC). As clearly stated in the literature, current approved implementations of HMAC require resources that cannot be supported in constrained components. An approach to implement a compact HMAC by the use of stream ciphering is presented in this paper.

Novel reversible watermarking scheme for authentication of military images

This paper presents a novel reversible watermarking scheme based on histogram modification for the authentication of military images. The Hash Message Authentication Code (HMAC) of the image is computed and embedded into the image for authentication. Based on a criterion, the distinct pixel values with Non-Zero Frequencies of the histogram are selected for embedding watermark bits and the preferred pixel values are stored as a key. This key is used for both the watermark extraction and the original image restoration. The bits of extracted HMAC from the marked image and HMAC of the restored image are compared for authentication.

Design and Performance Analysis of a Unified, Reconfigurable HMAC-Hash Unit

Hash functions are important security primitives used for authentication and data integrity. Among the most popular hash functions are MD5, SHA-1, and RIPEMD-160, which are all based on the function MD4. This similarity can be exploited for designing a unified engine to perform all three hash functions. Hash message authentication code (HMAC) is a shared-key security algorithm that uses these hash functions alternatively for IPSec authentication. Since some other security applications, such as digital signature, also use these three hash functions, it is prudent to design a unified, reconfigurable engine that can perform any one of them alone or with HMAC. In this work, we design an HMAC-hash unit that can be reconfigured to perform one of six standard security algorithms; namely, MD5, SHA-1, RIPEMD-160, HMAC-MD5, HMAC-SHA-1, and HMAC-RIPEMD-160. This paper applied pipelining and parallelism to the design of the HMAC-hash unit to improve throughput, especially for large message sizes. We achieved higher throughput than engines that integrated three hash functions or more and comparable throughput to those integrated only two hash functions.

A web transaction security scheme based on disposable credit card numbers

Today, an e-commerce transaction is performed by sending the client's credit card details over a SSL/TLS connection. This form of transaction raises many security threats. The most important one is the client authentication. Because the client normally does not have a public key certificate, the client's authentication is achieved only by the credit card details. In addition, these details are stored unencrypted in the merchant's database. A Disposable Credit Card Number (DCCN) is a technique to overcome these security threats. This paper presents a scheme for off-line generation of the DCCNs. The scheme uses a pre-shared secret key between the issuer and the client to generate Hashed Message Authentication Code for some selected data from the transaction. The scheme is secure and adds minimum overhead on the issuer and client. Furthermore, the generated DCCN has all the features of classical credit card details.