Online Dictionary Attacks Research Articles

A Novel Analysis of Advanced Visual Cryptography Techniques for Providing Security Against Web Attacks Using Support Vector Machine Technique

In today’s internet applications such as some real time application services like core banking and other public service oriented application have been major issue in authentication of user specification. To perform online dictionary attacks, passwords have been used for security and authentication mechanism. Present days, hacking of databases on web oriented applications is unavoidable to access them easily. Data maintenance is a complex task in internet applications. To solve these type of problems in internet applications, in this paper, we proposed a novel Integrated and Dynamic CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) (I&D CAPTCHA), which is extension version of existing CAPTCHA that valuated third party human attacks in internet applications based Visual Cryptography approach to discuss about authentication problem in real time applications. There is more number of methods presented for security in advanced pictures for insurance from inventive uninvolved or dynamic assaults in system correspondence environment. Like insightful Visual Cryptographic (VC) is a cutting edge strategy, which is utilized to mystery picture safely impart furthermore keep up to privacy. To proceed with difficulties of security in advanced picture information sharing, so in this paper we break down various VC security instruments for computerized picture information offering to regard tomystery information secrecy. Our examination give effective security answers for relative mystery advanced picture information imparting to correspondence progressively environment. Security aspects are main concepts in present days because of increasing statistical data storage. In Artificial Intelligence (AI) oriented applications, it is very difficult in terms of protection to increasing new aspects in real time world. So we also plan a Novel and Advanced Security system to enable solution for basic AI problems in this paper. This framework mainly works based on Captcha as visual security passwords (CaRP); it is two way communication plan which means that, it is the combination of Captcha and visual security plan. Our approach mainly worked with image security with respect to selection of passwords based on random way. In this paper, we also propose AMODS, an adaptive system that periodically updates the detection model to detect the latest unknown attacks. We also propose an adaptive learning strategy, called SVM HYBRID, leveraged by our system to minimize manual work. Our system out performs existing web attack detectionmethods, with an F-value of 94.79% and FP rate of 0.09%. The total number of malicious queries obtained by SVM HYBRID is 2.78 times that by the popular Support Vector Machine Adaptive Learning (SVMAL) method. The malicious queries obtained can be used to update the Web Application Firewall (WAF) signature library.

The Weaknesses of the Virtual Password Authentication Protocol with Cookie

Password-based authentication protocols are susceptible to various attacks. Recently, Sood, Sarje, and Singh proposed an inverse cookie-based virtual password authentication protocol. Their protocol is practical and easy to implement. They claim that their scheme is secure to against various attacks, include online dictionary attack, offline dictionary attack, eavesdropping attack, denial of service attack, phishing attack, pharming attack, man-in-the-middle attack, replay attack, leak of verifier attack, message modification or insertion attack, and brute force attack. However, we find that some weaknesses of Sood et al.’s scheme. In this article, we will show that Sood et al.’s scheme is vulnerable to the on-line guessing password attack and the denial of service attack.

Provably Secure Gateway Threshold Password-Based Authenticated Key Exchange Secure against Undetectable On-Line Dictionary Attack

Provably Secure Gateway Threshold Password-Based Authenticated Key Exchange Secure against Undetectable On-Line Dictionary Attack

An Enhanced Password-based Group Key Agreement Protocol with Constant Rounds

In PKC 2006, Abdalla et al. proposed a password-based group key exchange protocol with constant rounds and proved that protocol could resist the offline dictionary attacks in the random-oracle a nd ideal-cipher models. Then they proposed an open problem whether an adversary can test more than one password in the same session with online dictionary attack. To answer this question, they presented an online dictionary attack against their own protocol and declared that this new method is invalid to their protocol. In this paper, based on Abdalla et al.'s attack, we propose a modified attack and apply it to their protocol. The result shows, under the same assumption, our attack can test more than one password. We analyze the reason of this problem and develop a countermeasure to recover it. Finally, a security analysis in the random-oracle and ideal-ciph er models is presented to the enhanced protocol.

Cryptanalysis and Improvement of a Password-Based Authenticated Three-Party Key Exchange Protocol

Protocols for password-based authenticated key exchange (PAKE) in the three-party setting must be designed to be secure against dictionary attacks even in the presence of a malicious insider. In this work, we revisit the three-party PAKE protocol proposed by Kim and Choi in 2009, and demonstrate that the protocol is vulnerable to an insider offline dictionary attack (which allows an adversary to impersonate a legitimate party and initiate transactions). We also show that due to the vulnerability, Kim and Choi’s protocol is rendered insecure in the in distinguish ability-based security model of Bellare, Pointcheval and Rogaway (2000). We propose an improved three-party PAKE protocol which is resistant to all classes of dictionary attacks, including insider offline dictionary attacks and undetectable online dictionary attacks.

Cryptanalysis of a new protocol of wide use for email with perfect forward secrecy

This paper considers security analysis of a cross-realm client-to-client password-authenticated key exchange C2C-PAKE protocol with indirect communication structure that was proposed for secure email. The protocol does not need any public key infrastructure PKI and was designed to enable senders and recipients of emails to register at different mail servers. However, mail servers require sharing of secret keys in advance. Protocol designers claimed many security attributes including perfect forward secrecy and resilience to dictionary and replay attacks. However, in this paper, we show that the protocol does not provide forward secrecy and is vulnerable to offline dictionary attack, undetectable online dictionary attack, replay attack, and password-compromise impersonation attack. The protocol has also some other defects that are explained in the paper. Copyright © 2014 John Wiley & Sons, Ltd.

Password-only authenticated three-party key exchange proven secure against insider dictionary attacks.

While a number of protocols for password-only authenticated key exchange (PAKE) in the 3-party setting have been proposed, it still remains a challenging task to prove the security of a 3-party PAKE protocol against insider dictionary attacks. To the best of our knowledge, there is no 3-party PAKE protocol that carries a formal proof, or even definition, of security against insider dictionary attacks. In this paper, we present the first 3-party PAKE protocol proven secure against both online and offline dictionary attacks as well as insider and outsider dictionary attacks. Our construct can be viewed as a protocol compiler that transforms any 2-party PAKE protocol into a 3-party PAKE protocol with 2 additional rounds of communication. We also present a simple and intuitive approach of formally modelling dictionary attacks in the password-only 3-party setting, which significantly reduces the complexity of proving the security of 3-party PAKE protocols against dictionary attacks. In addition, we investigate the security of the well-known 3-party PAKE protocol, called GPAKE, due to Abdalla et al. (2005, 2006), and demonstrate that the security of GPAKE against online dictionary attacks depends heavily on the composition of its two building blocks, namely a 2-party PAKE protocol and a 3-party key distribution protocol.

Password-only authenticated three-party key exchange with provable security in the standard model.

Protocols for password-only authenticated key exchange (PAKE) in the three-party setting allow two clients registered with the same authentication server to derive a common secret key from their individual password shared with the server. Existing three-party PAKE protocols were proven secure under the assumption of the existence of random oracles or in a model that does not consider insider attacks. Therefore, these protocols may turn out to be insecure when the random oracle is instantiated with a particular hash function or an insider attack is mounted against the partner client. The contribution of this paper is to present the first three-party PAKE protocol whose security is proven without any idealized assumptions in a model that captures insider attacks. The proof model we use is a variant of the indistinguishability-based model of Bellare, Pointcheval, and Rogaway (2000), which is one of the most widely accepted models for security analysis of password-based key exchange protocols. We demonstrated that our protocol achieves not only the typical indistinguishability-based security of session keys but also the password security against undetectable online dictionary attacks.

Dictionary Attacks against Password-Based Authenticated Three-Party Key Exchange Protocols

A three-party password-based authenticated key exchange (PAKE) protocol allows two clients registered with a trusted server to generate a common cryptographic key from their individual passwords shared only with the server. A key requirement for three-party PAKE protocols is to prevent an adversary from mounting a dictionary attack. This requirement must be met even when the adversary is a malicious (registered) client who can set up normal protocol sessions with other clients. This work revisits three existing three-party PAKE protocols, namely, Guo et al.’s (2008) protocol, Huang’s (2009) protocol, and Lee and Hwang’s (2010) protocol, and demonstrates that these protocols are not secure against offline and/or (undetectable) online dictionary attacks in the presence of a malicious client. The offline dictionary attack we present against Guo et al.’s protocol also applies to other similar protocols including Lee and Hwang’s protocol. We conclude with some suggestions on how to design a three-party PAKE protocol that is resistant against dictionary attacks.

Enhancing a Dynamic user Authentication scheme over Brute Force and Dictionary attacks

The most universal computer authentication method is to use alpha numerical user names and passwords. This technique has been shown to have significant drawbacks. For example, users tend to pick passwords that can be simply guessed. Conversely, if a password is stiff to guess, then it is often tough to memorize. To tackle this setback, some researchers have urbanized authentication methods that use pictures as passwords. In this paper, we accomplish complete assessment of the obtainable graphical password techniques. We classify these techniques into two categories: recognition-based and recall based approaches. We discuss the strengths and boundaries of every scheme and mention the future study directions in this area. In this paper, we are conducting widespread assessment of existing graphical image password authentication technique. Also we are here proposing a new technique for graphical authentication moving towards rather advance we have been added some features like sending text to registered number and as well as registered email ids. so, in this way security is going to be increase more and more. For generating sms we are going to use some embedded devices like gsm modem. In this way we are going to increase the authentication of our application. Index terms : Online password secure attacks , brute force and dictionary attacks, password collections,

A Secured Protocol For Preventing Online Dictionary Attack

The use of passwords is a major point of vulnerablility in computer security as passwords are often easy to guess by automated programs running dictionary attacks. Several attempts have been made by researchers in order to counter online dictionary attack but with one drawback or the other, for example storing passwords in plain text, denial of service and so on. This paper employs Diffie-Hellman Key Exchange Scheme to impose more challenges to the attackers with three guesses as against one in the referenced protocol. Two way hash functions were used to generate two indices which were encrypted so that the attackers would not be able to compromise with the Server. The new scheme requires a high computatioal time of 1.743years as against 1.6625years proposed by other researchers for discouraging online dictionary attacks.Keywords: authentication, identification, hash functions, online dictionary attacks, disrcete logarithm theorem.

A Password attack on S-3 PAKE Protocol

Recently Chung et al proposed three party authenticated key exchange protocol. Lo et al demonstrated that Chung et al protocol is vulnerable to undetectable online dictionary attack and proposed a modified protocol. Unfortunately, this paper shows that Lo et al protocol is not secure and suffers from undetectable online password guessing attack.

An Improved Dynamic Password based Group Key Agreement against Dictionary Attack

Key exchange protocol is fundamental for establishing secure communication channels over public networks. Password-based key exchange protocols allow parties to share secret key in an authentic manner based on an easily memorizable password. Recently, a password-based group key agreement based on Joux’s tripartite key agreement is proposed to improve the performance when users join or leave the group. In this paper, we employ an online dictionary attack on this protocol to show that such kind of modification cannot achieve the basic security of password based group key agreement. With this method, an adversary can test several passwords in one session, which leads the key space reduces greatly to the potential adversaries. To fill the gaps, we propose an improved protocol, which can avoid this attack. Finally, we prove the security of our protocol under the random oracle and ideal cipher model.

Revisiting Defenses against Large-Scale Online Password Guessing Attacks

Brute force and dictionary attacks on password-only remote login services are now widespread and ever increasing. Enabling convenient login for legitimate users while preventing such attacks is a difficult problem. Automated Turing Tests (ATTs) continue to be an effective, easy-to-deploy approach to identify automated malicious login attempts with reasonable cost of inconvenience to users. In this paper, we discuss the inadequacy of existing and proposed login protocols designed to address large-scale online dictionary attacks (e.g., from a botnet of hundreds of thousands of nodes). We propose a new Password Guessing Resistant Protocol (PGRP), derived upon revisiting prior proposals designed to restrict such attacks. While PGRP limits the total number of login attempts from unknown remote hosts to as low as a single attempt per username, legitimate users in most cases (e.g., when attempts are made from known, frequently-used machines) can make several failed login attempts before being challenged with an ATT. We analyze the performance of PGRP with two real-world data sets and find it more promising than existing proposals.

Cryptanalysis of a three-party password-based authenticated key exchange protocol using Weil pairing

Recently, Zeng et al. proposed a three-party password-based authenticated key exchange protocol, in which two users could generate a common secret key with the help of the server. Although Zeng et al. claimed that their protocol could withstand various attacks, we point out that their protocol cannot resist impersonation attacks and undetectable online dictionary attacks. The analysis shows Zeng et al.'s protocol is insecure for practical applications.

Anonymous gateway-oriented password-based authenticated key exchange based on RSA

A gateway-oriented password-based authenticated key exchange (GPAKE) is a three-party protocol, which allows a client and a gateway to establish a common session key with the help of an authentication server. To date, most of the published protocols for GPAKE have been based on Diffie-Hellman key exchange. In this article, we present the first GPAKE protocol based on RSA, then prove its security in the random oracle model under the RSA assumption. Furthermore, our protocol can resist both e-residue and undetectable on-line dictionary attacks. Finally, we investigate whether or not a GPAKE protocol can achieve both client anonymity and resistance against undetectable on-line dictionary attacks by a malicious gateway. We provide an affirmative answer by adding client anonymity with respect to the server. Preprint submitted to EURASIP JWCN October 16, 2011 to our basic protocol.

Gateway-oriented password-authenticated key exchange protocol in the standard model

A gateway-oriented password-based authenticated key exchange (GPAKE) is a 3-party protocol, which allows a client and a gateway to establish a common session key with the help of an authentication server. GPAKE protocols are suitable for mobile communication environments such as GSM (Global System for Mobile Communications) and 3GPP (The Third Generation Partnership Project). To date, most of the published protocols for GPAKE have been proven secure in the random oracle model. In this paper, we present the first provably-secure GPAKE protocol in the standard model. It is based on the 2-party password-authenticated key exchange protocol of Jiang and Gong. The protocol is secure under the DDH assumption (without random oracles). Furthermore, it can resist undetectable on-line dictionary attacks. Compared with previous solutions, our protocol achieves stronger security with similar efficiency.

Simple three-party password authenticated key exchange protocol

Three-party password authenticated key exchange (3PAKE) protocol plays a significant role in the history of secure communication area in which two clients agree a robust session key in an authentic manner based on passwords. In recent years, researchers focused on developing simple 3PAKE (S-3PAKE) protocol to gain system efficiency while preserving security robustness for the system. In this study, we first demonstrate how an undetectable on-line dictionary attack can be successfully applied over three existing S-3PAKE schemes. An error correction code (ECC) based S-3PAKE protocol is then introduced to eliminate the identified authentication weakness.

Inverse Cookie-based Virtual Password Authentication Protocol

Password is the most commonly used authentication technique to authenticate the users on the web. Password based authentication protocols are susceptible to dictionary attacks by means of automated programs because most of the user chosen passwords are limited to the user's personal domain. In this paper, we propose an inverse cookie based virtual password authentication protocol that preserves the advantages of basic password authentication and simultaneously increasing the efforts required for online dictionary attacks. The Web server stores the cookie on the client's computer when the client has not submitted correct identity and password for its authentication to the Web server. The legitimate client can easily authenticate itself to the Web server from any computer irrespective of whether that computer contains cookie or not. However, the computational efforts required from the attacker during login on to the Web server increases with each login failure. The client generated virtual password is different for the same user in different sessions of Secure Socket Layer (SSL) protocol. The concept used in this paper is to combine traditional password authentication with a challenge that is easy to answer by the legitimate client and the computational cost of authentication increases for the attacker with each login failure. Therefore, even the automated programs can not launch online dictionary attacks on the proposed protocol. This protocol provides better protection against different types of attacks launched by the attacker. The proposed protocol is easy to implement and it removes some of the deficiencies of previously suggested password based authentication protocols.

Gateway-Oriented Password-Authenticated Key Exchange Based on RSA

Gateway-oriented password-based authenticated key exchange(GPAKE) protocal is a three-party protocol,which allows a client and a gateway to establish a common session key with the help of an authentication server.To date,most of the published protocols for GPAKE were based on Diffie-Hellman key exchange.This paper presents the first provably-secure GPAKE protocol using RSA.It is based on the protocol PEKEP of Zhang and is provably-secure in the random oracle model under the RSA assumption.Furthermore,the proposed protocol can resist both e-residue and undetectable on-line dictionary attacks.