Key Derivation Function Research Articles

Connecting tweakable and multi-key blockcipher security

The significance of understanding blockcipher security in the multi-key setting is highlighted by the extensive literature on attacks, and how effective key size can be significantly reduced. Nevertheless, little attention has been paid in formally understanding the design of multi-key secure blockciphers. In this work, we formalize the multi-key security of tweakable blockciphers in case of general key derivation functions. We show an equivalence between blockcipher multi-key security and tweakable blockcipher security. Our equivalence connects two objects of study, the iterated Even–Mansour (EUROCRYPT 2012) and the iterated Tweakable Even–Mansour (CRYPTO 2015), which establishes that results in both areas are, to a certain extent, transferable. Using our novel equivalence relation, we derive new bounds for both constructions, pave the path towards the solution of two well-studied conjectures, and show that, contrary to common knowledge, key derivation functions need not necessarily be pseudorandom functions in order to provide security: for the iterated Even–Mansour universal hash functions suffice.

Stream cipher based key derivation function

A key derivation function (KDF) is used to generate one or more cryptographic keys from a private string together with some public information. To date, most of the existing KDF proposals are designed using hash functions and block ciphers. This paper proposes alternative designs for constructing KDFs using stream ciphers. We show that these designs are secure in relation to the adaptive chosen context information model with single salt (CCS) security model from Krawczyk based on the assumption that the underlying stream ciphers are secure. We simulate instances of these stream cipher based KDFs using three eStream finalists: Trivium, Sosemanuk and Rabbit. The simulation results indicate that the stream cipher based KDFs offer significant efficiency advantages (in terms of running time) over hash function and block cipher based KDFs.

Password-based key derivation function as one of Blum-Blum-Shub pseudo-random generator applications

The main objective of the research is the analysis of the practical applicability of the cryptographically secure software Blum-Blum-Shub pseudo-random number generator for different authentication and encryption tasks. It is shown that the considered pseudo-random sequence generator, which has a high computational complexity, can be effectively used in those cryptographic tasks, which require low key generation rate. An alternative way of implementing the Password-Based Key Derivation Function, which is based on the use of the Blum-Blum-Shub generator as a pseudo-random function, is proposed. The proposed algorithm allows to slow down dictionary and brute-force attacks. Experimental studies have shown that the developed algorithm allows to adaptively adjust the guaranteed minimum time of generating a cryptographic key for specific tasks of authentication and encryption.

Stream cipher based key derivation function

Stream cipher based key derivation function

Inhibiting and Detecting Offline Password Cracking Using ErsatzPasswords

In this work, we present a simple, yet effective and practical scheme to improve the security of stored password hashes, increasing the difficulty to crack passwords and exposing cracking attempts. We utilize a hardware-dependent function (HDF), such as a physically unclonable function (PUF) or a hardware security module (HSM), at the authentication server to inhibit offline password discovery. Additionally, a deception mechanism is incorporated to alert administrators of cracking attempts. Using an HDF to generate password hashes hinders attackers from recovering the true passwords without constant access to the HDF. Our scheme can integrate with legacy systems without needing additional servers, changing the structure of the hashed password file, nor modifying client machines. When using our scheme, the structure of the hashed passwords file, e.g., etc/shadow or etc/master.passwd , will appear no different than traditional hashed password files. 1 However, when attackers exfiltrate the hashed password file and attempt to crack it, the passwords they will receive are ErsatzPasswords—“fake passwords.” The ErsatzPasswords scheme is flexible by design, enabling it to be integrated into existing authentication systems without changes to user experience. The proposed scheme is integrated into the pam_unix module as well as two client/server authentication schemes: Lightweight Directory Access Protocol (LDAP) authentication and the Pythia pseudorandom function (PRF) Service [Everspaugh et al. 2015]. The core library to support ErsatzPasswords written in C and Python consists of 255 and 103 lines of code, respectively. The integration of ErsatzPasswords into each explored authentication system required less than 100 lines of additional code. Experimental evaluation of ErsatzPasswords shows an increase in authentication latency on the order of 100ms, which maybe acceptable for real world systems. We also describe a framework for implementing ErsatzPasswords using a Trusted Platform Module (TPM).

Perfect Rainbow Tradeoff with Checkpoints Revisited.

The rainbow tradeoff is an algorithm for inverting one-way functions that is widely used in practice to recover passwords from unsalted password hashes. An auxiliary technique referred to as checkpoints can be applied to the rainbow tradeoff to reduce the time taken for these inversions. Working out a rigorous theory that can explain and predict the effects of this technique involves delicate manipulations of the random function and is thus a challenging task. In this work, we compare three existing theoretical analyses of the checkpoint technique. We first demonstrate that the claims made by the three works are incompatible with each other. We then carry out experiments designed to highlight these incompatibilities, obtaining experimental evidences that show just one of the three analyses to be correct. Finally, we discuss the obscure theoretical errors made by the two inadequate analyses.

Security of weak secrets based cryptographic primitives via the Rényi entropy

In ideality, cryptographic primitives take for granted that the secret sources are derived from uniform distribution. However, in reality, we may only obtain some ‘weak’ random sources guaranteed with high unpredictability (e.g. biometric data, physical sources, and secrets with partial leakage). Formally, the security of cryptographic primitives is measured by the expectation of some function, called ‘perfect’ expectation in the ideal model and ‘weak’ expectation in the real model. The authors propose some elementary inequalities which show that the ‘weak’ expectation is not much worse than the ‘perfect’ expectation. The authors present how to overcome weak expectations dependent on the Renyi entropy other than the min and collision entropies by Dodis and Yu [TCC 2013]. The authors achieve these results by capturing on two approaches: one is by observing a new relationship between the collision entropy and other Renyi entropy, the other is by developing the connection between different moments of a variable. Furthermore, pseudorandom generator, and pairwise independent hash function family, the authors extend key derivation functions based on the Renyi entropy. The results are applied to all unpredictability applications and ‘square-friendly’ indistinguishability applications including CPA-secure symmetric-key encryption schemes.

Windows Password Vulnerability and Preventive Measures

With the rise in the use of the Internet, cyber crimes have also increased. One of the most prominent attack that can cause a breach in the security of sensitive system is hacking the password hashes. This paper discusses the window password hashes used in the Windows NT-based operating systems and the loopholes in them. The paper also covers various attacking techniques used by attackers in order to gain access to the password . The experiment carried out to identify and extract the password hashes from the volatile memory is also discussed. Finally the paper suggests mechanism for password protection.

Lyra2: Efficient Password Hashing with High Security against Time-Memory Trade-Offs

We present Lyra2, a password hashing scheme (PHS) based on cryptographic sponges. Lyra2 was designed to be strictly sequential for a given number of cores (i.e., not easily parallelizable beyond that number), providing strong security even against attackers using custom hardware or GPUs. At the same time, it is very simple to implement in software and allows legitimate users to fine tune its memory and processing costs according to the desired level of security against brute force password-guessing. Lyra2 is an improvement of the recently proposed Lyra algorithm, providing an even higher security level against different attack venues and overcoming some limitations of this and other existing schemes.

양자키분배와 RSA 암호를 활용한 이중키 설정 키유도함수

양자키분배와 RSA 암호를 활용한 이중키 설정 키유도함수

Verifiable attribute‐based proxy re‐encryption for secure public cloud data sharing

AbstractFor secure data sharing in the public cloud, attribute‐based encryption was introduced to simultaneously achieve data confidentiality and fine‐grained access control. In order to update access control of the attribute‐based encrypted data from delegation, attribute‐based proxy re‐encryption (AB‐PRE) was proposed accordingly. Most previous AB‐PRE schemes require that the proxy executes the re‐encryption honestly. However, the public cloud as a proxy may not meet the requirement because the encrypted data are delegated to the public cloud and out of control for data owners. In this paper, we introduce verifiability for AB‐PRE to check the correctness of the re‐encryption executed by the proxy. By introducing a commitment scheme and a key derivation function, we propose a generic construction of unidirectional single‐hop AB‐PRE with verifiable re‐encryption (AB‐VPRE) for both key‐policy and ciphertext‐policy settings, and the access structure can be monotonic and non‐monotonic. We prove the security and the verification soundness of our constructed AB‐VPRE scheme in the standard model and provide three instantiations. Compared with previous work on AB‐PRE, our proposed AB‐VPRE schemes require less computation and can efficiently detect the malicious behaviors of the proxy. Copyright © 2016 John Wiley & Sons, Ltd.

Phoney: protecting password hashes with threshold cryptology and honeywords

Password file disclosure has attracted a lot of attention recently. Once password files are stolen, attackers can quickly crack large numbers of passwords. In this paper, we propose Phoney, a system which employs a threshold cryptosystem to encrypt the password hashes in the password file and honeywords to confuse attackers. With the help of Phoney, attackers cannot get any password information easily even they steal the password files. All the password hashes are encrypted by our threshold cryptosystem. Even they are able to compromise the cryptosystem, attackers cannot identify the real password easily because of the false passwords (honeywords) deliberately added for each account to confuse the adversaries. In addition, attempts of submitting a honeyword will cause alarms to be set off. Experiments show that the time and storage cost of Phoney are acceptable, but the cracking search space is increased significantly.

Securing Cloud-Based Applications, Part 1

In the first article of a series on building software as a service (SaaS) applications with security in mind, the author discusses best practices for user authentication, including cloud-based authentication services, key derivation functions, and two-factor authentication options.

Separating invertible key derivations from non-invertible ones: sequential indifferentiability of 3-round Even–Mansour

Iterated Even---Mansour (IEM) scheme consists of a small number r of fixed n-bit permutations separated by $$r+1$$r+1 round-key additions. When the permutations are public, independent and random, and a common round key derived from the master key by an idealized non-invertible key derivation (KD) function is used, 5 rounds was proved sufficient to obtain (full) indifferentiability from ideal ciphers by Andreeva et al. (CRYPTO 2013). The KD can be a random oracle, or a Davies-Meyer construction from a random permutation. This work considers such IEM with non-invertible KD in the sequential indifferentiability model of Mandal et al. (TCC 2012). As results, this work shows that in both cases mentioned before, 3 rounds yields sequential indifferentiability from ideal ciphers. As Andreeva et al. has proved 3-round IEM with idealized invertible key derivations not sequentially indifferentiable (by exhibiting an attack), a definitive separation between IEM with invertible key derivations and IEM with non-invertible key derivations is established. This is the most important implication of the results in this work.

Cracking More Password Hashes With Patterns

It is a common mistake of application developers to store user passwords within databases as plaintext or only as their unsalted hash values. Many real-life successful hacking attempts that enabled attackers to get unauthorized access to sensitive database entries including user passwords have been experienced in the past. Seizing password hashes, attackers perform brute-force, dictionary, or rainbow-table attacks to reveal plaintext passwords from their hashes. Dictionary attacks are very fast for cracking hashes but their success rate is not sufficient. In this paper, we propose a novel method for improving dictionary attacks. Our method exploits several password patterns that are commonly preferred by users when trying to choose a complex and strong password. In order to analyze and show success rates of our developed method, we performed cracking tests on real-life leaked password hashes using both a traditional dictionary and our pattern-based dictionary. We observed that our pattern-based method is superior for cracking password hashes.

PRF-기반 키유도함수에서 카운터 입력 형태에 따른 증명가능 안전성

ABSTRACT The security of all cryptographic algorithms and protocols is b ased on the confidentiality of secret keys. Key management mechanism is an indispensable part of the cryptographic system and this deals with the generation, exchange, storage, use, and replacement of keys. Within the key management mechanism there are key derivation functions (KDFs) which derive one or more keys from a master key. NIST specifies three families of P RF-based KDFs in SP 800-108. In this paper, we examine the difference of security models between the KDFs and the encrypti on modes of operations. Moreover we focus on the provable security of PRF-based KDFs according to input types of counters , and show that the counter and feedback modes of KDFs using XOR of counters are insecure, while these modes using concatenation of counters are secure.Keywords: Key Derivation Functions, KDF, Provable Security, PRF, Encrypti on modes of operation. I.서 론 * 암호 알고리즘과 암호 프로토콜은 사용되는 키들의 접수일(2015년 3월 4일), 게재확정일(2015년 4월 27일)*본 연구는 2014년도 정부(미래창조과학부)의 재원으로 한국연구재단-차세대정보・컴퓨팅기술개발사업의 지원을

Group authenticated key exchange schemes via learning with errors

We propose a novel passively secure group key exchange GKE scheme via learning with errors LWE. Then, we extend it to a GKE scheme via ring-learning with errors. We show the security analysis of our GKE schemes based on the LWE assumption and the security property of secure sketch in the random oracle model. One of our innovative points is a simple and practical robust extractor that serves as the key derivation function. Based on our GKE scheme, we build a group authenticated key exchange scheme and then prove its security under the LWE assumption and the secure property of secure sketch in the random oracle model. The proposed scheme not only provides authenticated key exchange security and mutually authenticated security but also needs only two round communications to negotiate a shared session key. Copyright © 2015John Wiley & Sons, Ltd.

Enhanced Message Digest Version 5 Architecture for Secure Hashing

The message digest algorithm is a widely used cryptographic hash function. It produces a 128-bit hash value. It has been used in a variety of security applications and is also commonly used to check data integrity. However MD5 has been found not to be collision resistant. It is possible to find a pseudo-collision, that is, two different initialization vectors which produce an identical digest. Other attacks that have been found to be working on MD5 are rainbow, dictionary and brute-forcing attacks. The ability to find collisions has been greatly aided by the graphics processing unit (GPU). The solution to these collisions is a robust MD5 compression function. This research paper focused on enhancing the Merkle Damgard model construction, which is the core component of the hashing process. It involved adding an extra iteration so that instead of the current two -cycle looping, we have a three-cycle looping per message block. The aim is to make it computationally infeasible to reverse the hash function. In this way, make the whole MD5 algorithm would be made stronger. This algorithm could then be used for password hashing in an effort to make them robust. The new password hashing mechanism find applications in areas such as digital signatures and digital certificates.

Keeping Secrets on Low-Cost Chips

In the mass markets in which chips are integrated into everyday objects, the cost pressures are great, but so is the need for security. To help resolve the conflict between cost and security, a new strategy embeds cryptographic algorithms into a cryptographic protocol such that they only need to be protected against single-execution side-channel attacks. To do this, the strategy introduces a key derivation function that's particularly easy to implement and protect.

A pedagogical example of a stretched password-based key derivation function

This paper describes a teaching example of a stretched, pseudo password-based key derivation function. Specifically, this paper will highlight the use of the non-commutative dihedral group D16, digital roots, recurrence relations, modulo operation, and prime numbers in constructing recoverable stretched character string of any length given a weak password seed and a salt of arbitrary byte (octet) length. The algorithm described here can be used to introduce the above topics and their importance in further coursework, and be used as a relatively simple example which can lead to discussion on serious and very technical work in password stretching, random functions, hash functions, and password-based key derivation functions specifically, and cryptography in general.