Key Derivation Function Research Articles

Evaluation of password hashing schemes in open source web platforms

Nowadays, the majority of web platforms in the Internet originate either from CMS to easily deploy websites or by web applications frameworks that allow developers to design and implement web applications. Considering the fact that CMS are intended to be plug and play solutions and their main aim is to allow even non-developers to deploy websites, we argue that the default hashing schemes rarely are modified. Also, recent studies suggest that even developers do not use appropriate hash functions to protect passwords, since they may not have adequate security expertise. Therefore, the default settings of CMS and web applications frameworks play an important role in the security of password storage. This paper evaluates the default hashing schemes of popular CMS and web application frameworks. First, we formulate the cost time of password guessing attacks and next we investigate the default hashing schemes of popular CMS and web applications frameworks. We then apply our framework to perform a comparative analysis of the cost time of password guessing attacks between the various CMS and web application frameworks. Finally, considering that intensive hash functions consume computational resources, we analyze hashing schemes from a different perspective. That is, we investigate if it is feasible and under what conditions to perform slow rate denial of service attacks from concurrent login attempts. Through our study we have derived a set of critical observations. We have discovered that many CMS and web application frameworks use outdated hash functions, arbitrary number of hash iterations, while there is a lack of password policies and salt. Notably, the popular WordPress still uses MD5 with low number of hash iterations. Overall, we believe that the security status of the hashing schemes of CMS and web application frameworks calls for changes to the default settings from an opt-in to an opt-out security policy. More security audits and official library implementations are also required to accelerate the adoption of memory hard functions both by policy makers and the industry.

AuCPace: Efficient verifier-based PAKE protocol tailored for the IIoT

Increasingly connectivity becomes integrated in products and devices that previously operated in a stand-alone setting. This observation holds for many consumer applications in the so-called "Internet of Things" (IoT) as well as for corresponding industry applications (IIoT), such as industrial process sensors. Often the only practicable means for authentication of human users is a password. The security of password-based authentication schemes frequently forms the weakest point of the security infrastructure. In this paper we first explain why a tailored protocol designed for the IIoT use case is considered necessary. The differences between IIoT and the conventional Internet use-cases result in largely modified threats and require special procedures for allowing both, convenient and secure use in the highly constrained industrial setting. Specifically the use of a verifier-based password-authenticated key-exchange (V-PAKE) protocol as a hedge against public-key-infrastructure (PKI) failures is considered important. Availability concerns for the case of failures of (part of) the communication infrastructure makes local storage of access credentials mandatory. The larger threat of physical attacks makes it important to use memory-hard password hashing. This paper presents a corresponding tailored protocol, AuCPace, together with a security proof within the Universal Composability (UC) framework considering fully adaptive adversaries. We also introduce a new security notion of partially augmented PAKE that provides specific performance advantages and makes them suitable for a larger set of IIoT applications. We also present an actual instantiation of our protocol, AuCPace25519, and present performance results on ARM Cortex-M0 and Cortex-M4 microcontrollers. Our implementation realizes new speed-records for PAKE and X25519 Diffie-Hellman for the ARM Cortex M4 architecture.

Security of Password Hashing in Cloud

Though the History of using password in computing can be traced back to as far as mid of last century little focus has been implied on how to securely store and retrieve password to authenticate and authorize services to the end users. In this paper the current security of various password hashing schemes that are in use today will be investigated through practical proof of concept-GPU based, password hash dump cracking using the power of cloud computing. We will be providing comparison on different password hashing cracking time using the cloud GPU power in AWS. The focus of this paper is to show the possible use of cloud computing in cracking hash dumps and the way to countermeasures them by using secure hashing algorithm and using complex passwords.

Further Analysis of PRNG-Based Key Derivation Functions

The Internet of Things (IoT) is growing at a rapid pace. With everyday applications and services becoming wirelessly networked, security still is a major concern. Many of these sensors and devices have limitations, such as low power consumption, reduced memory storage, and reduced fixed point processing capabilities. Therefore, it is imperative that high-performance security primitives are used to maximize the lifetime of these devices while minimally impacting memory storage and timing requirements. Previous work presented a residue number system (RNS)-based pseudorandom number generator (PRNG)-based key derivation function (KDF) (PKDF) that showed good initial energy-efficient performance for the IoT devices. This paper provides additional analysis on the PRNG-based security and draws a comparison to a current industry-standard KDF. Subsequently, embedded software implementations were performed on an MSP430 and MSP432 and compared with the transport layer security (TLS) 1.3 hash-based message authentication code (HMAC) key derivation function (HKDF); these results demonstrate substantial computational savings for the PKDF approach, while both pass the NIST randomness quality tests. Finally, hardware translation for the PKDF is evaluated through the Mathworks’ HDL Coder toolchain and mapping for throughput and die area approximation on an Intel® Arria 10 FPGA.

A Survey: Cryptographic Hash Functions for Digital Stamping

The current study aims to examine a general overview of the application of hash functions in cryptography and study the relationships between cryptographic hash functions and uses of the digital signature. Functions of the cryptographic hash are an important tool applied in several sections of data security, and application of hash function is common and used for various purposes such as File Integrity Verification, Key Derivation, Time stamping, Password Hashing, Rootkit Detection and Digital Signature. Digital Signature is a code that is linked electronically with the document including the sender's identity. Therefore, the digital signature is of high value in verifying digital messages or documents. Cryptographic hash functions do not present without mathematics. The success of computer science is attributed to mathematics; in other words, it is because of mathematical science, that computer science was understood and could be explained to all. The study aims to teach the reader hash functions and its applications such as digital signature and to show in details some hash functions and their designing.

Towards incorporating honeywords in n‐session recording attack resilient unaided authentication services

Unaided authentication services provide the flexibility to login without being dependent on any external hardware. n-Session recording attack resilient unaided authentication services (n-SRRUASs) are known for setting high security standards against different client side threats. However, because of their authentication procedure, the authors have identified that these services cope poorly with handling the server side issues. Though modern days’ research heavily depends on the honeywords (or fake passwords) as a countermeasure of server side threats, they have shown that the honeywords cannot be directly applied to n-SRRUAS. The authors’ analysis shows that the idea of incorporating the honeywords directly into an n-SRRUAS is particularly difficult as it prevents the system from storing passwords after applying password-based key derivation function or in the form of a hashed string. In this study, they have proposed few generic principles for incorporating the honeywords into n-SRRUAS and show that the proposed principles are sufficient for incorporating the honeywords into any n-SRRUAS. Furthermore, with the help of an existing n-SRRUAS, they have shown that the proposed idea is truly implementable in practice to fill the existing gap.

Dynamic key password authentication

Passwords still remain the most popular method of user authentication. Passwords appear to be the easiest way of registration and logging into remote services such as websites. However, passwords also appear to be the most insecure authentication method. One of the most popular attack techniques aimed at compromising passwords is to leak their hashes directly from their storage location to be cracked offline. The paper presents an authentication method with passwords, which complicates carrying out the attacks that succeed in extracting information sufficient for password cracking. The authentication method is called dynamic key password authentication (DKAuth). The method is based on a password 'blurring' using a number of network hosts. The 'blurring' is performed by encryption of password hash with a key that is not stored anywhere. The key is divided into parts and distributed among a number of different hosts. The key is modified for every password and changes due to change of the number of hosts in the system. Storage and authentication of a dynamic key is arranged so that it can never be recovered completely, that is even assuming cracking or rearrangement of each and every host where DKAuth key data is stored, an adversary will not be able to recover hashes and will have to crack them by brute-force attack. Practical implementation of DKAuth as an authentication service for external websites demonstrated low time and computational requirements for user registration and authentication.

Dynamic key password authentication

Passwords still remain the most popular method of user authentication. Passwords appear to be the easiest way of registration and logging into remote services such as websites. However, passwords also appear to be the most insecure authentication method. One of the most popular attack techniques aimed at compromising passwords is to leak their hashes directly from their storage location to be cracked offline. The paper presents an authentication method with passwords, which complicates carrying out the attacks that succeed in extracting information sufficient for password cracking. The authentication method is called dynamic key password authentication (DKAuth). The method is based on a password 'blurring' using a number of network hosts. The 'blurring' is performed by encryption of password hash with a key that is not stored anywhere. The key is divided into parts and distributed among a number of different hosts. The key is modified for every password and changes due to change of the number of hosts in the system. Storage and authentication of a dynamic key is arranged so that it can never be recovered completely, that is even assuming cracking or rearrangement of each and every host where DKAuth key data is stored, an adversary will not be able to recover hashes and will have to crack them by brute-force attack. Practical implementation of DKAuth as an authentication service for external websites demonstrated low time and computational requirements for user registration and authentication.

Verifier-based anonymous password-authenticated key exchange protocol in the standard model.

Anonymous password-authenticated key exchange (APAKE) allows a client to authenticate herself and to establish a secure session key with a remote server via only a low-entropy password, while keeping her actual identity anonymous to the third party as well as to the server. Since that APAKE protocol enjoys both the convenience of password authentication and the advantage of privacy protection, researchers have paid much attention to them. However, most of the existing APAKE protocols are designed in the symmetric setting which does not take into consideration the threat of password file leakage. To mitigate the damage of server compromise, we propose a verifier-based anonymous password-authenticated key exchange protocol, in which the server holds a verifier corresponding to each client instead of the clear password. The construction of our protocol is built on standard cryptographic primitives such public key encryption, smooth projective hash functions and password hashing schemes. The resulting protocol is proved secure in the standard model, i.e., without resorting to random oracles. Comparisons with other similar schemes show that our protocol guarantees stronger security while enjoys considerable efficiency in terms of computational cost.

Optimizing a Password Hashing Function with Hardware-Accelerated Symmetric Encryption

Password-based key derivation functions (PBKDFs) are commonly used to transform user passwords into keys for symmetric encryption, as well as for user authentication, password hashing, and preventing attacks based on custom hardware. We propose two optimized alternatives that enhance the performance of a previously published PBKDF. This design is based on (1) employing a symmetric cipher, the Advanced Encryption Standard (AES), as a pseudo-random generator and (2) taking advantage of the support for the hardware acceleration for AES that is available on many common platforms in order to mitigate common attacks to password-based user authentication systems. We also analyze their security characteristics, establishing that they are equivalent to the security of the core primitive (AES), and we compare their performance with well-known PBKDF algorithms, such as Scrypt and Argon2, with favorable results.

Construction of a New Biometric-Based Key Derivation Function and Its Application

Biometric data is user-identifiable and therefore methods to use biometrics for authentication have been widely researched. Biometric cryptosystems allow for a user to derive a cryptographic key from noisy biometric data and perform a cryptographic task for authentication or encryption. The fuzzy extractor is known as a prominent biometric cryptosystem. However, the fuzzy extractor has a drawback in that a user is required to store user-specific helper data or receive it online from the server with additional trusted channel, to derive a correct key. In this paper, we present a new biometric-based key derivation function (BB-KDF) to address the issues. In our BB-KDF, users are able to derive cryptographic keys solely from their own biometric data: users do not need any other user-specific helper information. We introduce a security model for the BB-KDF. We then construct the BB-KDF and prove its security in our security model. We then propose an authentication protocol based on the BB-KDF. Finally, we give experimental results to analyze the performance of the BB-KDF. We show that our proposed BB-KDF is computationally efficient and can be deployed on many different kinds of devices.

Cryptanalytic time–memory trade-off for password hashing schemes

Increasing threat of password leakage from compromised password hashes demands a resource consuming password-hashing algorithm to prevent the precomputation of the password hashes. A class of password-hashing schemes (PHS) provides such a defense by making the design Memory hard. This ensures that any reduction in the memory consumed by the algorithm leads to an exponential increase in its runtime. The security offered by a memory-hard PHS design is measured in terms of its time–memory trade-off (TMTO) defense. Another important measure for a good PHS is its efficiency in utilizing all the available memory as quickly as possible, and fast running time when more than the required memory is available. In this work, we present a simple technique to analyze TMTO for a password-hashing scheme which can be represented as a directed acyclic graph (DAG). The nodes of the DAG correspond to the storage required by the algorithm and the edges correspond to the flow of the execution. Our proposed technique provides expected runtimes at varied levels of available storage utilizing the DAG representation of the algorithm. We show the effectiveness of our proposed technique by applying it on three designs from the “Password Hashing Competition" (PHC)—Argon2-Version 1.2.1 (the PHC winner), Catena-Version 3.2 and Rig-Version 2. Our analysis shows that Argon2i is not providing expected memory hardness which is also highlighted in a recent work by Corrigan-Gibbs et al. We analyze these PHS for performance under various settings of time and memory complexities. Our experimental results show (i) simple DAGs for PHS are efficient but not memory hard, (ii) complex DAGs for PHS are memory hard but less efficient, and (iii) combination of two simple graphs in the representation of a DAG for PHS achieves both memory hardness and efficiency.

Формирование функции хэширования паролей, стойкой к ускоренному перебору значений

Формирование функции хэширования паролей, стойкой к ускоренному перебору значений

Tolerating Sensitive-Leakage With Larger Plaintext-Space and Higher Leakage-Rate in Privacy-Aware Internet-of-Things

When executing a program or storing data in a medical Internet of Things (mIoT) system, physical side-channels analysis, such as recent-timing, cold-reboot, and virtual-machine attacks, might obtain partial information about internal sensitive medical data/states in memory that the attacker can gain partial privacy information. Leakage-resilient cryptography has led to better implementation of many cryptographic primitives that can be proven secure against attackers who can obtain limited sensitive information about private keys , randomness , and other internal states , and therefore prevents from breaking the security. In this paper, to tolerate the sensitive information leakage in mIoT, we first present a leakage-resilient public-key encryption mechanism that is semantically secure against adaptively chosen-ciphertext attacks in the presence of key leakage under standard decisional Diffie–Hellman assumption. Our construction employs a special universal hashing in multiplicative group to provide an efficient strong extractor, and a key derivation function to derive one or more symmetric keys from a single value. Also, the plaintext space of the scheme is extended to the full domain field of group so as to provide a larger space for the message. We emphasis that our scheme can be deployed in mIoT since the limited power and energy budgets, the communication and computation cost, and the leakage attack are taken into account. Using the first scheme as a building block, we also give a protocol construction to achieve the security resilient to randomness leakage and key leakage. Our schemes feature with a shorter key size and a larger plaintext space. Concretely, the private-key contains only four elements in the finite field, and the allowable key-leakage rate is 25%, which provides a higher leakage rate than Naor Segev (leakage rate is 16.7%) and its variants. It is worth highlighting of the construction resilient to both key leakage and randomness leakage, simultaneously, and is flexible to deploy in easy-to-attack outdoor nodes such as in medical IoT and smart grids, since in these nodes the private keys and randomness are either stored or generated in outdoor privacy-aware environments.

Reconsidering the Security Bound of AES-GCM-SIV

We make a number of remarks about the AES-GCM-SIV nonce-misuse resistant authenticated encryption scheme currently considered for standardization by the Crypto Forum Research Group (CFRG). First, we point out that the security analysis proposed in the ePrint report 2017/168 is incorrect, leading to overly optimistic security claims. We correct the bound and re-assess the security guarantees offered by the scheme for various parameters. Second, we suggest a simple modification to the key derivation function which would improve the security of the scheme with virtually no efficiency penalty.

Reconsidering the Security Bound of AES-GCM-SIV

We make a number of remarks about the AES-GCM-SIV nonce-misuse resistant authenticated encryption scheme currently considered for standardization by the Crypto Forum Research Group (CFRG). First, we point out that the security analysis proposed in the ePrint report 2017/168 is incorrect, leading to overly optimistic security claims. We correct the bound and re-assess the security guarantees offered by the scheme for various parameters. Second, we suggest a simple modification to the key derivation function which would improve the security of the scheme with virtually no efficiency penalty.

A SECURED EMBEDDED SCHEME BASED ON MULTI-CRYPTOGRAPHIC PROTOCOLS

Transmission of information via unsecured channel requires confidentiality, authorization and authentication as part of major factors that must be put into consideration. This work proposes a scheme that can take care of these major factors at once. The method involves a multi-level approach that comprises of a key exchange protocol, a message authentication code, a key derivation function and a symmetric encryption known as polyalphabetic substitution that makes use of a 94x94 Vigenere table. The four cryptographic techniques are combined to form an encryption protocol, coined MLES for a message to be securely transmitted. In order to test the functionality of MLES scheme, it was implemented using Java 1.8.0 and tested on a text data. The result shows a feasible protocol that can secure a message in steganography.

Comparison Between Experimental, Analytical and Simulation Model of Distributed Computation on ARM processors in High-Performance Computing

The paper presents a comparison between experimental, analytical and simulation model of distributed cryptographic computation regarding password recovery with SHA 1 password hashing. The aim of this paper is compare popular mobile ARM processors with their Intel Atom analogue and determine their usefulness in cryptographic computations from High Performance Computing (HPC) point of view. During the construction process of HPC cluster, three different versions of Raspberry Pi computers were used. Then the constructed model was applied to develop an analytical and simulation models that allow calculating most influential characteristics from HPC clusters administrator’s point of view. Reference model was constructed on Intel Atom processors.

A new efficient lightweight and secure image cipher scheme

The protection of multimedia content has become a key area of research, since very often a user’s privacy and confidentiality can be at risk. Although a large number of image encryption algorithms have recently emerged, only a subset of these algorithms are suitable for real applications. These algorithms however use non-integer operations such as chaotic solutions that introduce a sizeable overhead in terms of latency and resources, in addition to floating-point hardware that is costly to implement. Designing an efficient, lightweight, and secure image encryption algorithm is still a hard challenge; yet, it is crucial to have in order to meet the demands of recent multimedia applications running on energy-limited devices. In this paper, an efficient image encryption scheme based on a dynamic structure is proposed. The structure of the proposed cipher consists of two different lightweight rounds (forward and backward chaining blocks) and a block permutation process. In addition, a key derivation function is proposed to produce a dynamic key based on a secret key and a nonce. This key, according to its configuration, can be changed for each validate time (session) or for each new input image. Then, based on this key, the cipher layers are produced, which are an integer or a binary diffusion matrix and a substitution table S-box, together with a permutation table P-box. The proposed dynamic cipher is designed to provide high robustness against contemporary powerful attacks, and permits reducing the required number of rounds for achieving the lightweight property. Experimental simulations demonstrate the efficiency and robustness levels of the proposed scheme.

Password-Hashing Status

Computers are used in our everyday activities, with high volumes of users accessing provided services. One-factor authentication consisting of a username and a password is the common choice to authenticate users in the web. However, the poor password management practices are exploited by attackers that disclose the users’ credentials, harming both users and vendors. In most of these occasions the user data were stored in clear or were just processed by a cryptographic hash function. Password-hashing techniques are applied to fortify this user-related information. The standardized primitive is currently the PBKDF2 while other widely-used schemes include Bcrypt and Scrypt. The evolution of parallel computing enables several attacks in password-hash cracking. The international cryptographic community conducted the Password Hashing Competition (PHC) to identify new efficient and more secure password-hashing schemes, suitable for widespread adoption. PHC advanced our knowledge of password-hashing. Further analysis efforts revealed security weaknesses and novel schemes were designed afterwards. This paper provides a review of password-hashing schemes until the first quarter of 2017 and a relevant performance evaluation analysis on a common setting in terms of code size, memory consumption, and execution time.