Password Storage Research Articles

Memristors for Secret Sharing-Based Lightweight Authentication

User authentication is one of the most fundamental security problems that design effective ways of identifying single or multiple entities using shared information, signatures, or intrinsic properties of the user(s). Password-based authentication is standard in the computer systems; however, passwords usually have low entropy content, and therefore vulnerable to dictionary attacks. Furthermore, password storage and simultaneous multiparty authentication also pose security and privacy concerns. Secret sharing-based techniques during password enrollment are found to be helpful in securing key storage in the authentication server, and in assisting multiparty authentication without exposing individual identity. However, secret sharing techniques, such as Shamir’s secret sharing, are computationally expensive; therefore, its implementation in power-constrained systems is elusive. To address these problems, we have demonstrated how secure and lightweight user authentication techniques can be designed using several well-known properties of memristive devices. For developing our secret sharing-based computationally lightweight user authentication protocols, first, we define essential utility functions, such as Read State, SET Pulse Count, Preconditioning, and so on, for controlling conductive filament formation in memristive devices. Next, we demonstrate the implementation of hardware-dependent simple authentication protocols that can ensure secure key storage using secret sharing protocol derived from Shamir and Naor’s visual cryptographic constructs. Then, we lay out the required hardware design and discuss the potential attacks to these protocols and the corresponding countermeasures. We conclude that, under realistic attacking assumptions, the proposed protocols are secure. Finally, using PTM’s 65-nm MOSFET models and Stanford’s variation-aware memristor models, we perform HSPICE simulation of the secret-reconstruction and authentication units to demonstrate the reliability of the hardware designs against SET–RESET unbalance, noise, temperature fluctuations, and aging.

Comparison of Hash Function Algorithms Against Attacks: A Review

Hash functions are considered key components of nearly all cryptographic protocols, as well as of many security applications such as message authentication codes, data integrity, password storage, and random number generation. Many hash function algorithms have been proposed in order to ensure authentication and integrity of the data, including MD5, SHA-1, SHA-2, SHA-3 and RIPEMD. This paper involves an overview of these standard algorithms, and also provides a focus on their limitations against common attacks. These study shows that these standard hash function algorithms suffer collision attacks and time inefficiency. Other types of hash functions are also highlighted in comparison with the standard hash function algorithm in performing the resistance against common attacks. It shows that these algorithms are still weak to resist against collision attacks.

SplitPass: A Mutually Distrusting Two-Party Password Manager

Using a password manager is known to be more convenient and secure than not using one, on the assumption that the password manager itself is safe. However recent studies show that most popular password managers have security vulnerabilities that may be fooled to leak passwords without users’ awareness. In this paper, we propose a new password manager, SplitPass, which vertically separates both the storage and access of passwords into two mutually distrusting parties. During login, all the parties will collaborate to send their password shares to the web server, but none of these parties will ever have the complete password, which significantly raises the bar of a successful attack to compromise all of the parties. To retain transparency to existing applications and web servers, SplitPass seamlessly splits the secure sockets layer (SSL) and transport layer security (TCP) sessions to process on all parties, and makes the joining of two password shares transparent to the web servers. We have implemented SplitPass using an Android phone and a cloud assistant and evaluated it using 100 apps from top free apps in the Android official market. The evaluation shows that SplitPass securely protects users’ passwords, while incurring little performance overhead and power consumption.

Cara Pengawetan Ikan Mas (Cyprinus carpio L) Dengan Menggunakan Fermentasi Limbah Kubis (Brassica oleracea)

The research on the utilization of waste cabbage (Brassica oleracea) as a preservative tilapia (Oreochromis sp) with RAL factorial method with 2 replications.The first factor is the concentration of NaCl with a password (N) which consists of 4 levels, namely: N 1 = 1%, N 2 = 2%, N 3 = 3% , N 4 = 4%. Factor II is a password storage time (P) which consists of 4 levels, namely: P 1 = 1 days, P 2 =3 days, P 3 = 5 days, P 4 = 7 days.The parameters observed from the data analysis showed that NaCl concentration and storage time significantly affected the protein content, moisture content, organoleptic aroma, texture organoleptic tests,and organoleptic color not significant. Keywords : longdepository,concentration sodium chloride

NFC Secured Offline Password Storage

<p>In this paper is all about constructing a device called “One-WORD” that aims to solve this problem. One-word is an offline password keeper aimed at saving and encrypting the passwords in a more secure manner. The main device contains the encrypted passwords while a secure NFC smartcard and a personal pin-code allows the decryption. Even if an attacker is able to get hold the smartcard, or the device it is completely useless without the personal code. </p>

Secured miniaturized system-in-package contactless and passive authentication devices featuring NFC

RFID/NFC technology is widely spread nowadays and applications can be found in our everyday life, for example, in payment, transportation, logistics, healthcare, and access control. State-of-the-art contactless and passive authentication solutions implement relatively large coils outside of the chip. Therefore, the minimum size is in the order of a few square centimeters, which limits their use for tagging of certain small-sized goods. On top of that, those miniaturized solutions which are available today provide only limited security measures.Here we introduce miniaturized system-in-package contactless authentication devices. This novel solution integrates Infineon Technologies’ CIPURSETMmove IC, which is a state-of-the-art security solution featuring an open security standard, into embedded Wafer Level Ball Grid Array (eWLB) packages, together with HF-antennas, ferrites, as well as discrete elements that improve HF-coupling characteristics.The presented devices provide better HF-coupling characteristics than Coil-on-Chip approaches, which also enable verification of authenticity of tagged products through NFC-enabled smart phones. Thanks to the miniaturized package sizes of 3 × 3 mm, integration into high-priced products, casings, consumable materials, etc., can be achieved in a discreet way. Furthermore, the integrated CIPURSETM chip enables not only the anti-counterfeiting use-case, but also micropayment, ticketing, access control, and password storage in a secured way. Therefore, this miniaturized contactless authentication solution will open up whole new fields of applications.

Using Improved d-HMAC for Password Storage

Password storage is one of the most important cryptographic topics through the time. Different systems use distinct ways of password storage. In this paper, we developed a new algorithm of password storage using dynamic Key-Hashed Message Authentication Code function (d-HMAC). The developed improved algorithm is resistant to the dictionary attack and brute-force attack, as well as to the rainbow table attack. This objective is achieved by using dynamic values of dynamic inner padding d-ipad, dynamic outer padding d-opad and user’s public key as a seed.

Integrasi Login Tanpa Mengetik Password pada WordPress

Nowadays, almost everyone has an account on the internet, but some of them often use simple and guessable password, since a complex password is difficult to memorize. Surely, it will compromise the account security and system themselves. Therefore, an integrated login system without typing and remembering password is needed. This paper describes the development of an integrated login system that can perform authentication on a device without typing and remembering password by developing a WordPress plugin and a smartphone application. The development of the system has successfully shown the QR Code on the WordPress login page and automatically redirect the user to the admin page when the login process is done through scanning the QR code by using smartphone. Password only needs to be typed in the first login, and users do not have to retype it for the next login process. Android application development has resulted a password manager application that helps the users to manage the password and to have a secure password storage. Login integration without typing a password can improve account security and reduce the risk of man-in-the-middle and key-logger attack.

ANALYSIS AND IMPLEMENTATION OF CRYPTOGRAPHIC HASH FUNCTIONS IN PROGRAMMABLE LOGIC DEVICES / KRIPTOGRAFINIŲ MAIŠOS FUNKCIJŲ ĮGYVENDINIMO PROGRAMUOJAMOSIOS LOGIKOS LUSTUOSE TYRIMAS

In this day’s world, more and more focused on data protection. For data protection using cryptographic science. It is also important for the safe storage of passwords for this uses a cryptographic hash function. In this article has been selected the SHA-256 cryptographic hash function to implement and explore, based on fact that it is now a popular and safe. SHA-256 cryptographic function did not find any theoretical gaps or conflict situations. Also SHA-256 cryptographic hash function used cryptographic currencies. Currently cryptographic currency is popular and their value is high. For the measurements have been chosen programmable logic integrated circuits as they less efficiency then ASIC. We chose Altera Corporation produced prog-rammable logic integrated circuits. Counting speed will be investigated by three programmable logic integrated circuit. We will use programmable logic integrated circuits belong to the same family, but different generations. Each programmable logic integrated circuit made using different dimension technology. Choosing these programmable logic integrated circuits: EP3C16, EP4CE115 and 5CSEMA5F31. To compare calculations perfor-mances parameters are provided in the tables and graphs. Research show the calculation speed and stability of different programmable logic circuits. Vis daugiau dėmesio skiriama duomenų apsaugai – duomenų apsaugai skirta net atskira kriptografijos mokslo šaka. Taip pat yra svarbi slaptažodžių sauga, kurioje naudojamos kriptografinės maišos funkcijos. Darbe parinkta įgyvendinimui ir ištirta šiuo metu populiari bei saugi SHA-2 kriptografinė maišos funkcija. Ji naudojama kriptografinėse valiutose. SHA-2 kriptografinės funkcijos analizės metu nepavyko rasti teorinių spragų ar kolizijos atvejų. Tyrimams pasirinkti Altera programuojamos logikos integriniai grandynai, kurie efektyvumu nusileidžia tik specializuotiems integriniams grandynams. Skaičiavimo sparta ir stabilumas buvo tiriama trijuose programuojamos logikos integrinuose grandynuose, priklausančiuose tai pačiai šeimai ir pagamintais skirtingų kartų technologijomis – naudojant 65 nm, 60 nm ir 28 nm KMOP technologijas. Tirtų grandynų kodiniai žymenys EP3C16, EP4CE115 ir 5CSEMA5F31.

Extended results of Norwegian password security survey

Purpose – The purpose of this paper is to extend the results of a Norwegian password security survey. Research, especially in the early 21st century, has shown that education is needed to change people’s behaviour regarding password generation, management and storage. As our daily routines and duties have become more dependent on electronic services in the last decade, one could think that qualitative education is nowadays given to users. This survey is to verify that assumption. Methodology – A nation-wide demographic survey among employees in Norway with a sample of 1,003 respondents at the ages of 18-64 years was conducted in October 2012. Findings – The results show that the education or proper guidance seldom is given leading to the outdated users’ behaviour. Research limitations – The results of the study are limited to the employed only and they do not explain behaviour of students, teenagers or children. Social implications – During the current year, the results of the study have been discussed several times in national media and, hopefully, have an impact to employees’ behaviour. The results have also been used in the National Security Month campaign in October 2013. Originality/value – The questionnaire itself is not unique. However, the large amount of respondents gives higher value to the results.

Password-Free Login

Password-free login is a system that sets the user free from remembering the passwords used, so that the user can get an easy access to any website of his choice in a common password. The system is basically a password storage website that keeps all the login id’s and password in a single database. The advantage of the system is that even if in mere future the user happens to forget the login of a website that has been accessed a long time back, it can be easily retrieved by the user using the common login id details for the website. Thus, this website will set the user free from remembering the login details of any website. The details of the work done can be seen in detail in the further part of the paper. So, this website will set the user free by making him remember just a single login id and password which in turn will retrieve the required login id and its password. This system is really going to be a boon for the all kinds of users. The paper also discusses the security aspects of the website so that the system can be proved to be a robust and concrete one. The uniqueness of the system can be seen in the further detailed discussion.

Security Analysis of MD5 Algorithm in Password Storage

Hashing algorithms are commonly used to convert passwords into hashes which theoretically cannot be deciphered. This paper analyses the security risks of the hashing algorithm MD5 in password storage and discusses different solutions, such as salts and iterative hashing. We propose a new approach to using MD5 in password storage by using external information, a calculated salt and a random key to encrypt the password before the MD5 calculation. We suggest using key stretching to make the hash calculation slower and using XOR cipher to make the final hash value impossible to find in any standard rainbow table.

GSM Intelligent Home Security System Based on MCU

In order to improve the security of home, an intelligent home security alarm system based on Micro-programmed Control Unit (MCU) has been designed in this paper, which can monitor the doors and windows, and communicate with intrusion alarm system by using GSM. Practical measured results indicate that this system can complete the function of home security alarm, which has a strong practical popularize value.In order to improve the security of home, an intelligent home security system based on MCU has been designed in this paper, which realizes en-mg checking, password storage, sound/short message warning service and real-time monitoring through GSM network. The hardware and software designs are illustrated in the paper. Finally, the test is carried out and the results indicate that the functions of system have achieved the design goal.

A secure password storage policy

Discusses the necessity of computer access control mechanisms, particularly passwords, to protect information. Suggests that many organizations allow practices which compromise the security of their data. Highlights a policy on the proper storage of passwords and other security parameters which should form the foundation of an information security effort.

A microcomputer based terminal for assisting on-line information retrieval

The development of computer software to assist the searcher when carrying out on-line information retrieval procedures using a microcomputer in place of a normal ter minal is described. Criteria for selection of a microcomputer for this purpose are given. A Cifer 2684 microcomputer ter minal which is Z-80 based with CP/M was chosen. The software allows the storage of user IDs, passwords and search data on floppy disc files which can then be sent to a host computer using simple commands. Data coming from the host can also be stored on disc. The system cuts down the time to enter a search, simplifies logging-on, and the accuracy of data can be checked before going on-line. Library staff have adapted easily to the terminal.