Substitution Attack Research Articles

An Algorithm Substitution Attack on Fiat-Shamir Signatures Based on Lattice

Many evidences have showed that some intelligence agencies (often called big brother) attempt to monitor citizens’ communication by providing coerced citizens a lot of subverted cryptographic algorithms and coercing them to adopt these algorithms. Since legalized services on large number of various applications and system architectures depend on digital signature techniques, in the context some coerced users who use double authentication preventing signatures to design some novel digital signature techniques, have some convincing dissertations to defuse requests from authorities and big brothers creating some corresponding subverted signatures. As rapid progress in quantum computers, National Security Agency advisory memorandum and announcement of National Institute of Standards and Technology procedures from standardization focus on some cryptographic algorithms which are post quantum secure. Motivated by these issues, we design an algorithm substitution attack against Fiat-Shamir family based on lattices (e.g., BLISS, BG, Ring-TESLA, PASSSign and GLP) that are proven post-quantum computational secure. We also show an efficient deterable way to eliminate big brother’s threat by leaking signing keys from signatures on two messages to be public. Security proof shows that our schemes satisfy key extraction, undetectability and deterability. Through parameters analysis and performance evaluation, we demonstrate that our deterring subverted Fiat-Shamir signature is practical, which means that it can be applied to privacy and protection in some system architectures.

A novel application on mutually orthogonal graph squares and graph-orthogonal arrays

<abstract> <p>Security of personal information has become a major concern due to the increasing use of the Internet by individuals in the digital world. The main purpose here is to prevent an unauthorized person from gaining access to confidential information. The solution to such a problem is by authentication of users. Authentication has a very important role in achieving security. Mutually orthogonal graph squares (MOGS) are considered the generalization of mutually orthogonal Latin squares (MOLS). Also, MOGS are generated from edge decompositions of complete bipartite graphs by isomorphic graphs. Graph-orthogonal arrays can be constructed by MOGS. In this paper, graph-orthogonal arrays are used for constructing authentication codes. These arrays are the encoding matrices of authentication tags. We introduce the concepts and basic theorems of MOGS, graph-orthogonal arrays, and authentication codes. After constructing graph-orthogonal arrays by MOGS, then there is an established mapping between graph-orthogonal arrays and message set. This manages us to construct perfect non-splitting and splitting Cartesian authentication codes. In both cases, we calculate the probabilities of successful impersonation attacks and substitution attacks. Besides that, the performance of constructed non-splitting and splitting authentication codes is analyzed. In the end, optimal authentication codes and secure authentication codes are constructed.</p> </abstract>

Subversion-Resistant and Consistent Attribute-Based Keyword Search for Secure Cloud Storage

Secure cloud search service allows resource-constrained clients to effectively search over encrypted cloud storage. Towards enabling owner-enforced search authorization, the notion of attribute-based keyword search (ABKS) has been introduced and widely deployed in practice. To enhance traditional security of ABKS, two state-of-the-art solutions are presented to address keyword guessing attacks or setup inconsistency for secret key. Nevertheless, they have not simultaneously considered the following threats to a data user: (i) inconsistent secret key/cipher-index caused by outside dishonest authority and/or data owner; (ii) algorithm substitution attacks (ASA) launched by inside adversarial eavesdropping. These attacks may unfortunately lead to cloud data breach and user information exposure. To tackle such outside and inside threats, we introduce subversion-resistance and consistency for secure and fine-grained cloud document search services. In particular, we propose a consistent ABKS system with cryptographic reverse firewalls (CRF). Technically, we refer to verifiable functional encryption and employ non-interactive zero-knowledge proofs of discrete logarithm equality to ensure strong input consistency for ABKS. In addition, we build a trusted CRF zone for sanitizing algorithm outputs against ASA attacks. Moreover, we formalize the security model and formally prove security of our system. To clarify practical performance, we implement state-of-the-art solutions and our system in real cloud environment based on Enron dataset. The results show that our system achieves more enhanced security properties without obviously sacrificing performance. In particular, our system achieves comparable time and storage cost for document-index encryption and document search, as compared to state-of-the-art solutions.

A Verifiable Symmetric Searchable Encryption Scheme Based on the AVL Tree

Abstract Verifiable symmetric searchable encryption is a keyword search technology that supports verification of search results. Many schemes improve search performance by dividing each keyword label into segments and storing them in a Trie-tree at the expense of high storage. And the index will degenerate into a linear linked list when all keyword labels have the same prefix except for the last segment. But it will greatly affect the search efficiency. In this paper, we propose a verifiable symmetric searchable encryption scheme based on the AVL Tree (abbreviated as VSSE-AVL), which uses complete keyword labels to build the index. Compared with the Trie-tree index, VSSE-AVL not only balances storage and search performance, but also avoids degradation. To verify the correctness and completeness of empty search results, we store path information in each leaf node and node with only one child node. Considering the substitution attack, we bind the file identifier and the file so that the client will find out once the server returns inconsistent search results. Rigorous security analysis shows VSSE-AVL satisfies privacy and verifiability. Compared with the verifiable SSE-2 with the same security, the experimental evaluation shows that our proposed scheme performs better on storage, search and verification.

Algorithm Substitution Attacks: State Reset Detection and Asymmetric Modifications

In this paper, we study algorithm substitution attacks (ASAs), where an algorithm in a cryptographic scheme is substituted for a subverted version. First, we formalize and study the use of state resets to detect ASAs, and show that many published stateful ASAs are detectable with simple practical methods relying on state resets. Second, we introduce two asymmetric ASAs on symmetric encryption, which are undetectable or unexploitable even by an adversary who knows the embedded subversion key. We also generalize this result, allowing for any symmetric ASA (on any cryptographic scheme) satisfying certain properties to be transformed into an asymmetric ASA. Our work demonstrates the broad application of the techniques first introduced by Bellare, Paterson, and Rogaway (Crypto 2014) and Bellare, Jaeger, and Kane (CCS 2015) and reinforces the need for precise definitions surrounding detectability of stateful ASAs.

Security and Challenges in Voice over Internet Protocols: A Survey

Voice over Internet Protocol (VoIP) an emerging new technologies is based on realtime communication of data by sending and receiving digital signals using Internet Protocols (IP). VoIP has become popular in business organization and scientific communities. Voice coder (Codec) named as coder and decoder, play an important role in packet switch network for transfer of audio and video data. A signalling protocol known as Session Initiation Protocol (SIP) is used for data communication between nodes in VoIP network. In this paper we survey on security related issues in VoIP communication system and covered several security attacks. We proceed with survey on all the problems that have big effects on VoIP security and challenges such as data manipulation, substitution attack, power backups, jitter, latency and delay. Finally, we conclude the paper with further research on security of VoIP communication system.

Semantic-driven watermarking of relational textual databases

In relational database watermarking, the semantic consistency between the original database and the distorted one is a challenging issue which is disregarded by most watermarking proposals, due to the well-known assumption for which a small amount of errors in the watermarked database is tolerable. We propose a semantic-driven watermarking approach of relational textual databases, which marks multi-word textual attributes, exploiting the synonym substitution technique for text watermarking together with notions in semantic similarity analysis, and dealing with the semantic perturbations provoked by the watermark embedding. We show the effectiveness of our approach through an experimental evaluation, highlighting the resulting capacity, robustness and imperceptibility watermarking requirements. We also prove the resilience of our approach with respect to the random synonym substitution attack.

Novel approach for multimodal feature fusion to generate cancelable biometric

Biometric systems provide various benefits over traditional pin-based authentication systems. However, the issue of data privacy and theft is of great concern. To resolve these issues, a novel cancelable multimodal biometric system is proposed that combines multiple traits by means of a projection-based approach. The proposed approach generates a cancelable biometric feature that is used to obtain revocable and noninvertible templates. Cancelable features are generated by projecting the feature points onto a random plane obtained using a user-specific key. The point of projection is then transformed into cylindrical coordinates and a combined cancelable feature is obtained. Extensive experiments are performed over 3 chimeric multimodal databases and results reveal high performance. The average DI and EER achieved by the proposed method are 16.63 and 0.004, respectively. Also, the proposed method is successfully analyzed for privacy concerns, namely revocability, non-invertibility, and unlinkability. Moreover, the proposed system demonstrated tolerance against various security attacks like brute force attacks, attacks via record multiplicity, and substitution attacks.

IDR Privacy Protection Based on Database Digital Watermarking

Background: In smart grid, a flexible demand response management mechanism is used to achieve the purpose of stabilizing the power grid, optimizing the power market, and rationally allocating resources. There are two types of demand response management in the demand response management mechanism: Price-based Demand Response (PDR) and Incentive-based Demand Response (IDR). Methods: The paper studied the problem of privacy protection in IDR, and proposed a method based on database digital watermark to protect user privacy. Segment the time, and then embed watermarks in the user’s consumption data of each time segment. At the end of each billing period, extract the watermarks from the data of each segment time, and then send the total consumption data of the user of this billing period to the power supply company. The power supply company only knows the total consumption data of the user, the company does not have any information regarding the users consumption data which can prevent them from snooping the user privacy. The proposed digital watermarking algorithm is based on K-Means clustering and wavelet transform, the K-Means algorithm is used to cluster the database tuple data, and then wavelet transform is carried out on the available attribute values within the clusters, and the watermark is embedded in the transformed attribute values. Results: The experimental results show that the proposed method is more robust when the database is under subset deletion attacks, subset substitution attacks and subset addition attacks. Besides, the computational cost is very low. Conclusion: The proposed digital watermark algorithm can embed the watermarks more decently and overcome the burden of watermark embedding caused by statistical feature control. Besides, the proposed method can protect the user privacy better than the other two methods.

Improved Proofs Of Retrievability And Replication For Data Availability In Cloud Storage

Abstract For a high level of data availability and reliability, a common strategy for cloud service providers is to rely on replication, i.e. storing several replicas onto different servers. To provide cloud users with a strong guarantee that all replicas required by them are actually stored, many multi-replica integrity auditing schemes were proposed. However, most existing solutions are not resource economical since users need to create and upload replicas of their files by themselves. A multi-replica solution called Mirror is presented to overcome the problems, but we find that it is vulnerable to storage saving attack, by which a dishonest provider can considerably save storage costs compared to the costs of storing all the replicas honestly—while still can pass any challenge successfully. In addition, we also find that Mirror is easily subject to substitution attack and forgery attack, which pose new security risks for cloud users. To address the problems, we propose some simple yet effective countermeasures and an improved proofs of retrievability and replication scheme, which can resist the aforesaid attacks and maintain the advantages of Mirror, such as economical bandwidth and efficient verification. Experimental results show that our scheme exhibits comparable performance with Mirror while achieving high security.

On the Security of Symmetric Encryption Against Mass Surveillance

For mass surveillance, the algorithm substitution attacks (ASAs) are serious security threats to the symmetric encryption schemes. At CRYPTO 2014, Bellare, Paterson, and Rogaway (BPR) formally developed the security notions of decryptability, undetectability, and surveillance and presented a unique ciphertext symmetric encryption scheme against all possible ASAs. At FSE 2015, Degabriele, Farshim, and Poettering (DFP) relaxed the correctness of decryptability and presented an input-triggered ASA, which meets the BPR security definitions but violates the security of the BPR unique ciphertext scheme. Hence, DFP refined the security notions of detectability and subversion resistance to remove their ASA from the BPR unique ciphertext scheme. At CCS 2015, Bellare, Jaeger, and Kane (BJK) also developed the security notion of key recovery to make the input-triggered ASA infeasible. We investigate ASAs on the symmetric encryption scheme. Our contribution is twofold. (1) We propose a new trigger ASA against the symmetric encryption scheme . Our proposed ASA cannot be captured by the BJK security definitions. Comparatively, the DFP security definitions can detect our proposed ASA. In the view of ASAs, this result demonstrates that the DFP security definitions are not identical to the BJK security definitions. (2) We improve the DFP definition of subversion resistance . DFP proved that the BPR unique ciphertext scheme defeats the input-triggered ASA under their subversion resistance definition. However, we show that the BPR unique ciphertext scheme fails to meet the DFP subversion resistance definition due to our proposed ASA. Therefore, an improved definition on subversion resistance is proposed to cover all existing trigger ASAs. We prove that the BPR unique ciphertext scheme is secure under our improved definition. Therefore, we believe that our improved definition is more suitable to evaluate the ASA security of the symmetric encryption scheme.

Strongly Secure Multiuser Communication and Authentication With Anonymity Constraints

We consider authentication of messages sent from transmitters to a receiver over a multiple access channel, where each transmitter shares a secret key with the legitimate receiver. Additionally, there exists a computationally unbounded opponent who has access to noisy observations of the messages transmitted and can initiate impersonation or substitution attacks. We require that the legitimate receiver must be able to authenticate the messages he receives with respect to predetermined groups of transmitters, but at the same time must be kept ignorant of the transmitter’s identity of a given message in a given group. We propose an information-theoretic formulation of these anonymity constraints as well as an authentication coding scheme for which the asymptotic probability of successful attack is shown to optimally scale with the length of the secret keys shared between each transmitter and the legitimate receiver. Our results quantify the positive impact of the multiple access setting compared to the single-user setting on the probability of successful attack.

Substitution Attacks against Message Authentication

This work introduces Algorithm Substitution Attacks (ASAs) on message authentication schemes. In light of revelations concerning mass surveillance, ASAs were initially introduced by Bellare, Paterson and Rogaway as a novel attack class against the confidentiality of encryption schemes. Such an attack replaces one or more of the regular scheme algorithms with a subverted version that aims to reveal information to an adversary (engaged in mass surveillance), while remaining undetected by users. While most prior work focused on subverting encryption systems, we study options to subvert symmetric message authentication protocols. In particular we provide powerful generic attacks that apply e.g. to HMAC or Carter–Wegman based schemes, inducing only a negligible implementation overhead. As subverted authentication can act as an enabler for subverted encryption (software updates can be manipulated to include replacements of encryption routines), we consider attacks of the new class highly impactful and dangerous.

A REVIEW PAPER ON IMAGE AUTHENTICATION SCHEME

Image authentication is one of the methods which can detect the any tampering data. The original grayscale document image is converted into stego image by adding the alpha channel plane. The stego image is in the Portable Network Graphics (PNG) format. This stego image is transmitted over the network. The authentication process is applied on the stego image on the receiver side. In the authentication process the data extracted from this stego image is compared with the data computed from the binary version of the stego image. If the data is matched the image is considered to be authentic. Else the tampered blocks are marked and the image is self-repaired using inverse secret sharing scheme.but in other methods they cannot resist the self substitution attack, the same-position-substitution attack, or the cut- off attack. Furthermore, those attacks can be completed by the popular image editing software Adobe Photoshop. We proposed security enhanced authentication scheme. Our proposed scheme is capable of repairing the content of the given stego-image if attacked by the methods mentioned above.

Channel Precoding Based Message Authentication in Wireless Networks: Challenges and Solutions

Due to the broadcast characteristic of the wireless medium, message impersonation and substitution attacks can possibly be launched by an adversary with low cost in wireless communication networks. As an ingenious solution, physical layer based message authentication can achieve perfect security by leveraging channel precoding techniques to meet high level security requirements. In this article, we focus on channel-precoding- based message authentication (CPC-based authentication) over a binary-input wiretap channel (BIWC). Specifically, message authentication with physical layer techniques is first reviewed. Then, a CPC-based authentication framework and its security requirements are presented. Based on the proposed framework, an authentication scheme with polar codes over a binary symmetric wiretap channel (BSWC) is developed. Moreover, a case study is provided as an example of message authentication with polar codes over BSWC. Finally, open research topics essential to CPC-based authentication are discussed.

Subversion in Practice: How to Efficiently Undermine Signatures

Algorithm substitution attack (ASA) on signatures can have severe consequences as the authentication services of numerous systems and applications rely on signature schemes. In this paper, we present a highly efficient ASA on the widely-used digital signature algorithm (DSA). Compared with the generic ASAs on signature schemes proposed in the literature, our attack provides fast and undetectable subversion, which can extract the user's private signing key by collecting the maximum three signatures arbitrarily. Moreover, our ASA is proven to be robust against state reset. We implemented the proposed ASA by replacing the original DSA in Libgcrypt (a popular cryptographic library used in many applications) with our subverted DSA. Our experiment shows that the user's private key can readily be recovered once the subverted DSA is used to sign messages. In our implementation, various measures have been considered to significantly reduce the possibility of detection through comparing the running time of the original DSA and the subverted one (i.e. timing analysis). To our knowledge, this is the first implementation of the ASA in practice, which shows that the ASA is a real threat rather than only theoretical speculation.

Key Substitution Attacks on Lattice Signature Schemes Based on SIS Problem

The notion of key substitution security on digital signatures in the multiuser setting has been proposed by Menezes and Smart in 2004. Along with the unforgeability of signature, the key substitution security is very important since it is a critical requirement for the nonrepudiation and the authentication of the signature. Lattice-based signature is a promising candidate for post-quantum cryptography, and the unforgeability of each scheme has been relatively well studied. In this paper, we present key substitution attacks on BLISS, Lyubashevsky’s signature scheme, and GPV and thus show that these signature schemes do not provide nonrepudiation. We also suggest how to avoid key substitution attack on these schemes.

Server notaries: a complementary approach to the web PKI trust model

Secure socket layer/transport layer security (TLS) is the de facto protocol for providing secure communications over the Internet. It relies on the web PKI model for authentication and secure key exchange. Despite its relatively successful past, the number of web PKI incidents observed have increased recently. These incidents revealed the risks of forged certificates issued by certificate authorities without the consent of the domain owners. Several solutions have been proposed to solve this problem but no solution has yet received widespread adoption due to complexity and deployability issues. In this study, the authors propose an effective solution for this problem that allows a TLS server to detect a certificate substitution attack against its domain across the Internet. The proposed solution is practical and allows a smooth and gradual transition. They also give a triangulation algorithm enabling the server to find out the origin of the attack. They conducted simulation experiments using real-world BGP data and showed that their proposal can be effective for detecting and locating attacks using relatively few vantage points over the Internet.

New methods of construction of cartesian authentication codes from geometries over finite commutative rings

Abstract In this paper, we construct some cartesian authentication codes from geometries over finite commutative rings. We only assume the uniform probability distribution over the set of encoding rules in order to be able to compute the probabilities of successful impersonation attack and substitution attack. Our methods are comfortable and secure for users, i.e., our encoding rules reduce the probabilities of successful impersonation attack and substitution attack.

Using IM-Visor to stop untrusted IME apps from stealing sensitive keystrokes

Third-party IME (Input Method Editor) apps are often the preference means of interaction for Android users’ input. In this paper, we first discuss the insecurity of IME apps, including the Potentially Harmful Apps (PHAs) and malicious IME apps, which may leak users’ sensitive keystrokes. The current defense system, such as I-BOX, is vulnerable to the prefix substitution attack and the colluding attack due to the post-IME nature. We provide a deeper understanding that all the designs with the post-IME nature are subject to the prefix-substitution and colluding attacks. To remedy the above post-IME system’s flaws, we propose a new idea, pre-IME, which guarantees that “Is this touch event a sensitive keystroke?” analysis will always access user touch events prior to the execution of any IME app code. We design an innovative TrustZone-based framework named IM-Visor which has the pre-IME nature. Specifically, IM-Visor creates the isolation environment named STIE as soon as a user intends to type on a soft keyboard, then the STIE intercepts,Android event sub translates and analyzes the user’s touch input. If the input is sensitive, the translation of keystrokes will be delivered to user apps through a trusted path. Otherwise, IM-Visor replays non-sensitive keystroke touch events for IME apps or replays non-keystroke touch events for other apps. A prototype of IM-Visor has been implemented and tested with several most popular IMEs. The experimental results show that IM-Visor has small runtime overheads.