Key Password Research Articles

Novel Dynamic S-Box Based on Password Key and Circle Map

Many cryptosystems and security techniques use substitution boxes to ensure the data’s secure communication. A new technique is presented for generating a robust S-box to fulfill security requirements. The AES algorithm represents a block cipher cryptographic algorithm. It was selected by the National Institute of Science and Technology as the optimal cryptographic algorithm in 2011. Through the study of the properties of original S-BOX, this algorithm has been subjected to a number of attacks (linear, differential, statistical, and interpolation), and original S-BOX has been static, which makes the attack strong and shows a weakness in the algorithm. It is necessary to make this algorithm more efficient and powerful through the improvement of the dynamic generation of the steps for the protection of textual data security. This paper proposes a dynamic S-Box based on the user's password key (8 chars), shifting, and a 1D circle map. The results in this work indicated that the suggested approach presents a secure S-BOX, which is considered to have 255 differences identified when 1 bit of the key is changed; therefore, about 99% of the S-Box has been changed. Also, an inverse table of S-Box (16*16) is generated via the S-Box output created from the above-mentioned suggestions for returning the values regarding the union of the column and the row for all the S-Box generated values. We examine the quality of our S-Box through various well-known performance parameters. All of the analysis yields very encouraging results, certifying that the generated S-box meets all criteria that are required for reliable and secure encryption. Just a few milliseconds are needed to implement it.

Rancangan Aplikasi Autentikasi Surat Digital dengan Metode One Time Password SHA-512 Berbasis Android

Some administrative procedures in many institutes are still carried out conventionally, which is deemed less efficient and takes much time. On the other hand, communication with other parties requires a process of exchanging information, so a system is needed to confirm the validity of the information. Therefore, a digital letter system that can prove the validity of the information gained through the digital media right from the party concerned is developing. This can be overcome using the authentication method. Adding One Time Password (OTP) as an authentication method that employs one temporary password key can be the solution. This study uses the One Time Password (OTP) method as a validation system and the SHA-512 algorithm as an OTP code generator to generate random codes. This system leverages android technology on mobile to ease access to the correspondence administration system to make it easier to visit with features that prioritize information and access speed. This application is implemented at the State Polytechnic of Sriwijaya to improve the administrative process to run more effectively. The black box testing revealed that all available menus and features were appropriate, and the application already had a system that functions according to user needs. Moreover, in the One Time Password generation test with the SHA-512 algorithm, it was determined that the average response time for generating the OTP code was 4.4 seconds in 15 trials, which can be considered fairly accurate.

A Survey of Commercial Password Detection Methods

Commercial password has been widely used in China's information services, and their role and importance in information security are gradually increasing. In recent years, as the application of quantum computing in computer technology becomes more and more extensive, the performance of computers continues to improve, and cryptographic penetration technology has emerged in an endless stream. Some known cryptographic algorithms are no longer secure in the new environment, such as the MD5 cryptographic algorithm with obvious security risks and the cracked RSA public key password algorithm, etc. Therefore, it is essential to detect and evaluate the security of commercial passwords. Based on a large number of literature at home and abroad and the practical work experience of Beijing Software Testing and Quality Assurance Center, this study comprehensively analyzes and combs the commercial password detection technology and forms a relatively complete research review on commercial password detection methods. The specific contents include traditional cryptanalysis methods, key penetration attack methods, side-channel attack methods, quantum computing cryptanalysis, etc. The research results provide important theoretical support for the commercial password security detection of the Winter Olympic information system, enhance the technical ability of the inspectors to the commercial password detection, and ensure the comprehensiveness of the information system security detection.

A Novel approach towards Implicit Authentication System by using Multi-share visual key Cryptography Mechanism

Currently huge amount of data used to stored, extracted and transacted via various stand alone and internet based applications. These applications are extended towards the verticals like huge databases, data warehouses, cloud computing services and various client-server applications. In all these applications important data used to float day in day out. Therefore preserving user authentication & access control is extremely important aspect of information security. Here an attempt is made to generate an implicit authentication system using multi-share visual key cryptography which will generate strong password keys by using images. Initially various images will be fused to form a resultant image than on this fused visual key cryptography will be performed which will provide multiple shares, out of these one of the share is selected to generate strong password strings/keys to accomplish the task of access control or user authentications.

Construction of Blockchain Product Technology Evaluation Index System

Blockchain products are more and more widely used. How to reasonably evaluate blockchain products has become a hot issue. The main work of this paper is to establish a set of general evaluation indicators for blockchain products, and analyze the needs of future software systems. Firstly, the paper analyzes the common five-tier architecture adopted by the current blockchain system, namely data layer, network layer, consensus layer, smart contract layer and application layer, and expounds the hierarchical characteristics and technical contents of each layer in detail; Then on this basis, a set of general evaluation indicators is proposed for the current common blockchain products, in which the evaluation indicators can be divided into six items: distributed ledger evaluation indicators, public key password evaluation indicators, point-to-point network technology evaluation indicators, consensus mechanism evaluation indicators, intelligent contract mechanism evaluation indicators and upper layer application evaluation indicators. The establishment of indicators can comprehensively evaluate the availability, security and system performance of blockchain products. Finally, based on the evaluation index, the functional and non functional analysis of the blockchain product evaluation system is carried out, which lays a good foundation for the realization of software in the future. The design of evaluation indicators and the functional analysis of the evaluation system will promote the standardization of blockchain products.

Cryptanalysis and improvement of mutual authentication protocol for real-time data access in industrial wireless sensor networks

Wireless Sensor Networks (WSNs) have a very large number of applications in different domains of the industry. One of those applications is the industrial use of WSN. Industrial Wireless Sensor Networks (IWSNs) are generally used in places which are isolated from human involvement. Thus their security and privacy are a major concern. Recently, Gope et al. have discussed a lightweight mutual user authentication protocol for IWSN. In this paper, we perform the security analysis of their scheme and find that their scheme is vulnerable to the following attacks: user device loss attack, stolen verifier attack, and denial of service attack. We also propose an improved scheme that overcomes these vulnerabilities. The proposed scheme uses the Physically Unclonable Function (PUF), Exclusive OR (XOR), and one-way cryptographic hash function operations, which are all lightweight cryptographic functions. The analysis of formal security in our scheme uses random oracle model to prove the safety of the user identity, password, and session key. Through the informal security, we show that our scheme resists many known attacks. The formal verification of security is done using ProVerif tool. In the performance analysis, we present that our scheme provides better security features than the other related schemes.

Network Security System with Optimized Randomized Multiple Key Exchange Algorithm

This paper illustrates three different algorithms to provide shared secret key for security of the system. The proposed three algorithms namely 1) Modified Simple Password Key Exchange Scheme 2) Modified Diffie-Hellman Key exchange Scheme 3) Modified Elliptic Curve Scheme are meant to provide shared secret key for authentication process. Enhancements in terms of memory requirement, storage and other security properties such as authentication among mutual users, fraud prevention, attack etc., prove the validity of the proposed algorithms in proving authentication for the cryptographic identification of networks.

Dynamic key password authentication

Passwords still remain the most popular method of user authentication. Passwords appear to be the easiest way of registration and logging into remote services such as websites. However, passwords also appear to be the most insecure authentication method. One of the most popular attack techniques aimed at compromising passwords is to leak their hashes directly from their storage location to be cracked offline. The paper presents an authentication method with passwords, which complicates carrying out the attacks that succeed in extracting information sufficient for password cracking. The authentication method is called dynamic key password authentication (DKAuth). The method is based on a password 'blurring' using a number of network hosts. The 'blurring' is performed by encryption of password hash with a key that is not stored anywhere. The key is divided into parts and distributed among a number of different hosts. The key is modified for every password and changes due to change of the number of hosts in the system. Storage and authentication of a dynamic key is arranged so that it can never be recovered completely, that is even assuming cracking or rearrangement of each and every host where DKAuth key data is stored, an adversary will not be able to recover hashes and will have to crack them by brute-force attack. Practical implementation of DKAuth as an authentication service for external websites demonstrated low time and computational requirements for user registration and authentication.

Dynamic key password authentication

Passwords still remain the most popular method of user authentication. Passwords appear to be the easiest way of registration and logging into remote services such as websites. However, passwords also appear to be the most insecure authentication method. One of the most popular attack techniques aimed at compromising passwords is to leak their hashes directly from their storage location to be cracked offline. The paper presents an authentication method with passwords, which complicates carrying out the attacks that succeed in extracting information sufficient for password cracking. The authentication method is called dynamic key password authentication (DKAuth). The method is based on a password 'blurring' using a number of network hosts. The 'blurring' is performed by encryption of password hash with a key that is not stored anywhere. The key is divided into parts and distributed among a number of different hosts. The key is modified for every password and changes due to change of the number of hosts in the system. Storage and authentication of a dynamic key is arranged so that it can never be recovered completely, that is even assuming cracking or rearrangement of each and every host where DKAuth key data is stored, an adversary will not be able to recover hashes and will have to crack them by brute-force attack. Practical implementation of DKAuth as an authentication service for external websites demonstrated low time and computational requirements for user registration and authentication.

Development of logistics centers on the example of the city and commune of Radom

The 21st century presents big challenges for enterprises that are caused by high customer requirements regarding the quality of services. Logistics centers are only a partial fulfilment of the client's expectations. The key password that is implemented is the "7W" principle. The article also presents the basic issues concerning the development of centers on the example of the city of Radom.

Encryption-Based Secure and Efficient Access Control to Out Sourced Data in Cloud Computing

The cloud stockpiling framework, comprising of capacity servers, gives long haul stockpiling administrations on the Internet. Maintaining the data in the cloud computing of third parties generates: serious concern about the confidentiality of data and the reduction of data management costs. Nonetheless, we should give security certifications to outside information. We plan and actualize a protected cloud stockpiling framework that gives secure, secure and available record security for document administration and secure information exchange. It includes foreign files with a file access policy, possibly deleting files, to avoid being denied to anyone with a file access policy. To achieve these security objectives, a set of password keys is implemented that maintain a host (s) or head (s) separately. We offer a twofold edge intermediary coding plan and incorporate it with a decentralized disposal code, which is detailed with a safely Cloud storage framework. The Cloud storage system not only provides a secure and stable search and storage of data, but also allows the user to transfer their data to the user of the backup to another user without the data being returned.

스마트폰 고유정보를 이용한 안전한 개인키 관리 방안

우리나라는 스마트폰 보급률이 83%로 성인인구 4,000만명 중 3,390만 명이 사용하고 있으며, 이러한 사용자 대부분이 공인인증서에 대한 안전성 문제가 지속적으로 제기됨에도 불구하고 공인인증서를 사용하고 있다. 이러한 안전성의 문제로 인해 SMS를 이용한 휴대폰 소유자 인증기술, 생체인증을 통한 본인 인증기술 등 다양한 인증기술들이 제안되고 있다. 그러나 아직까지도 공인인증서를 대체할 만한 안전하고 믿을 만한 인증체계가 제시되지 않고 있다. 또한 사용자가 제일 많은 공인인증서와 개인키에 대한 탈취 시도가 지속적으로 발생하고 있다. 이러한 이유로 인해 보안전문가들은 공인인증서와 개인키를 USB 플래시 드라이브, 보안토큰, 스마트폰에 저장하도록 권고한다. 하지만 보안전문가가 추천하는 외부 저장매체 중 스마트폰은 앱을 통해 악성코드가 쉽게 전파되고, 악성코드에 의한 인증서나 개인키 파일을 외부로 유출이 가능하다. 해커가 유출한 인증서와 개인키 파일과 함께 개인키 암호용 패스워드만 알아내면 언제든지 정당한 사용자로 위장할 수 있다. 이에 본 논문에서는 스마트폰의 고유정보와 사용자 패스워드를 조합하여 스마트폰에 저장된 개인키 파일의 안전한 관리 방안을 제안한다. 제안 방안을 활용하게 되면 스마트폰에 저장된 개인키와 인증서 파일이 공격자에게 탈취되더라도 스마트폰의 고유 정보를 획득할 수 없으므로 암호화된 개인키의 재사용이 불가능하다. 따라서 제안 방안을 공인인증 체계에 활용한다면 스마트폰 사용자에게 현재보다 훨씬 향상된 보안 서비스를 제공할 수 있을 것으로 예상한다. The 3390 million people, around 83% of the adult population in Korea use smartphone. Although the safety problem of the certificate has been occurred continuously, most of these users use the certificate. These safety issues as a solution to 'The owner of a mobile phone using SMS authentication technology', 'Biometric authentication', etc are being proposed. but, a secure and reliable authentication scheme has not been proposed for replace the certificate yet. and there are many attacks to steal the certificate and private key. For these reasons, security experts recommend to store the certificate and private key on usb flash drive, security tokens, smartphone. but smartphones are easily infected malware, an attacker can steal certificate and private key by malicious code. If an attacker snatchs the certificate, the private key file, and the password for the private key password, he can always act as valid user. In this paper, we proposed a safe way to keep the private key on smartphone using smartphone's unique information and user password. If an attacker knows the user password, the certificate and the private key, he can not know the smart phone's unique information, so it is impossible to use the encrypted private key. Therefore smartphone user use IT service safely.

Optical image encryption using password key based on phase retrieval algorithm

A novel optical image encryption system is proposed using password key based on phase retrieval algorithm (PRA). In the encryption process, a shared image is taken as a symmetric key and the plaintext is encoded into the phase-only mask based on the iterative PRA. The linear relationship between the plaintext and ciphertext is broken using the password key, which can resist the known plaintext attack. The symmetric key and the retrieved phase are imported into the input plane and Fourier plane of 4f system during the decryption, respectively, so as to obtain the plaintext on the CCD. Finally, we analyse the key space of the password key, and the results show that the proposed scheme can resist a brute force attack due to the flexibility of the password key.

On Security Analysis of Recent Password Authentication and Key Agreement Schemes Based on Elliptic Curve Cryptography

Secure and efficient mutual authentication and key agreement schemes form the basis for any robust network communication system. Elliptic Curve Cryptography (ECC) has emerged as one of the most successful Public Key Cryptosystem that efficiently meets all the security challenges. Comparison of ECC with other Public Key Cryptosystems (RSA, Rabin, ElGamal) shows that it provides equal level of security for a far smaller bit size, thereby substantially reducing the processing overhead. This makes it suitable for constrained environments like wireless networks and mobile devices as well as for security sensitive applications like electronic banking, financial transactions and smart grids. With the successful implementation of ECC in security applications (e-passports, e-IDs, embedded systems), it is getting widely commercialized. ECC is simple and faster and is therefore emerging as an attractive alternative for providing security in lightweight device, which contributes to its popularity in the present scenario. In this paper, we have analyzed some of the recent password based authentication and key agreement schemes using ECC for various environments. Furthermore, we have carried out security, functionality and performance comparisons of these schemes and found that they are unable to satisfy their claimed security goals.

Design and Realization of RSA Digital Signature System Based on Digital Certificate

Digital signature plays a more and more important role in e-commerce. The basic methods of digital signature are introduced and a digital signature scheme based on digital certificate is proposed in this paper. Digital certificate is generated after personal information is written. The effective data, RSA parameters and signature results are included in digital certificate. The related RSA parameters of private key certificate are encrypted by private key password. The digital digest is gotten through hash algorithm in this scheme. Digital signature is operated by using RSA parameters in private key certificate and the signature is verified by RSA parameters in public key certificate by verifier.

Elliptic Curve Cryptography in Securing Networks by Mobile Authentication

This paper proposes an enhanced authentication model, which is suitable for low-power mobile devices. It uses an Extended Password Key Exchange Protocols (2) and elliptic-curve-cryptosystem based trust delegation mechanism to generate a delegation pass code for mobile station authentication, and it can effectively defend all known attacks to mobile networks including the denial-of-service attack. Moreover, the mobile station only needs to receive one message and send one message to authenticate itself to a visitor's location register, and the model only requires a single elliptic-curve scalar point multiplication on a mobile device. Therefore, this model enjoys both computation efficiency and communication efficiency as compared to known mobile authentication models.

Elliptic Curve Cryptography in Securing Networks by Mobile Authentication

This paper proposes an enhanced authentication model, which is suitable for low-power mobile devices. It uses an Extended Password Key Exchange Protocols and elliptic-curve-cryptosystem based trust delegation mechanism to generate a delegation pass code for mobile station authentication, and it can effectively defend all known attacks to mobile networks including the denial-of-service attack. Moreover, the mobile station only needs to receive one message and send one message to authenticate itself to a visitor’s location register, and the model only requires a single elliptic-curve scalar point multiplication on a mobile device. Therefore, this model enjoys both computation efficiency and communication efficiency as compared to known mobile authentication models.

Design of new P2P-enabled Mobile-OTP system using fingerprint features

Security of ubiquitous computing systems is becoming more important along with extensive spread of the Internet applications. In this paper, we propose a key generation method for one-time password of Mobile-OTP systems by employing changed location and angle of fingerprint features. Fingerprint, as one powerful personal authentication tool, can create variable password keys for one-time use cyclic key permutation (CKP) of fingerprint features. Based on a set of simulations for the proposed random password key generation method, we evaluate the efficiency and strength of proposed modification for Mobile-OTP systems and describe application scenarios to support secure service.

A Small Subgroup Attack for Recovering Ephemeral Keys in Chang and Chang Password Key Exchange Protocol

Three-party authenticated key exchange protocol is an important cryptographic technique in the secure communication areas. Recently Chang and Chang proposed a novel three party simple key exchange protocol and claimed the protocol is secure, efficient and practical. Unless their claim, a key recovery attack is proposed on the above protocol by recovering the ephemeral keys. One way of recovering the ephemeral key is to solve the mathematical hard Discrete Logarithm Problem (DLP). The DLP is solved by using a popular Pohlig-Hellman method in the above key recovery attack. In the present study, a new method based on the small subgroup attack to solve the DLP is discussed to recover the ephemeral keys. Computation of DLP is carried out by two stages, such as the prior-computation and DLP computation. The prior-computation is performed on off-line and the DLP computation is performed on on-line. The method is analyzed on a comprehensive set of experiments and the ephemeral keys are recovered in reduced time. Also, the key recovery attack on Chang and Chang password key exchange protocol is implemented by using the new method to recover the ephemeral key.

Solving the Discrete Logarithm Problem for Ephemeral Keys in Chang and Chang Password Key Exchange Protocol

The present study investigates the difficulty of solving the mathematical problem, namely the DLP (Discrete Logarithm Problem) for ephemeral keys. The DLP is the basis for many public key cryptosystems. The ephemeral keys are used in such systems to ensure security. The DLP defined on a prime field <TEX>$Z^*_p</TEX> of random prime is considered in the present study. The most effective method to solve the DLP is the ICM (Index Calculus Method). In the present study, an efficient way of computing the DLP for ephemeral keys by using a new variant of the ICM when the factors of p-1 are known and small is proposed. The ICM has two steps, a pre-computation and an individual logarithm computation. The pre-computation step is to compute the logarithms of a subset of a group and the individual logarithm step is to find the DLP using the precomputed logarithms. Since the ephemeral keys are dynamic and change for every session, once the logarithms of a subset of a group are known, the DLP for the ephemeral key can be obtained using the individual logarithm step. Therefore, an efficient way of solving the individual logarithm step based on the newly proposed precomputation method is presented and the performance is analyzed using a comprehensive set of experiments. The ephemeral keys are also solved by using other methods, which are efficient on random primes, such as the Pohlig-Hellman method, the Van Oorschot method and the traditional individual logarithm step. The results are compared with the newly proposed individual logarithm step of the ICM. Also, the DLP of ephemeral keys used in a popular password key exchange protocol known as Chang and Chang are computed and reported to launch key recovery attack.