Symmetric Hash Functions Research Articles

MD5( ) Bypassing Through SQL Injection

Web-based application attacks are growing dramatically in number and severity. They found that web applications that are poorly validated and verified are susceptible to attacks by the attacker. network related SQL attacks. The MD5 (message digest algorithm) hashing method is a one-way cryptographic function that accepts any text field as input and produces a fixed-length digest value that may be used to identify the original message as output. Most security experts advise replacing the MD hash algorithm with a much more secure message digest. ”Because of these collisions, a hacker or malicious user may construct files with almost the same exact hash as another, making it difficult to be certain that the file has not been interfered with. As a result, it should not be utilised for anything. Developers should instead use a Solid Cryptographic Hash function or a Symmetric Cryptographic Algorithm. this research paper demonstrates how md5 function in php can be bypassed when its parameter is set to ”TRUE” ie.,[ md5( ’x’, TRUE)], this makes the hashing value(x) to be raw bytes than hexa-coded value which is much more easier to inject a SQL Statement and retrieve the original String. The above is demonstrated using SQL Fiddle in which a sample php code value fields are hashed and when its md5() is set to TRUE ,how SQLI bypasses md5().The best approach for solving above problem is to use symmetric hash function like Sha1() , sha2(),CRC which does multiple layer of hashing and when using md5() not to set its parameter to” TRUE”.

Correcting “PALK: Password-based anonymous lightweight key agreement framework for smart grid”

Very recently in 2020, Khan et al. proposed an authentication scheme (PALK) for the smart grid infrastructure. Based on elliptic curve cryptography (ECC), symmetric hash functions and block cipher based encryption/decryption operations, the scheme was argued to work efficiently and securely in smart grid based infrastructure. However, in this paper, we prove that PALK has incorrect login and authentication phase; mainly, due to a superficial ECC operation involving the multiplication of two points over the curve. Moreover, in the scheme of Khan et al. the responding entity without knowing any clue of the initiator, uses the public key of the initiator for the completion of the authentication process, which is also not possible in the presence of multiple communicating devices. These design flaws lead to the situation, where the smart grid entities are unable to complete even a single cycle of authentication. Finally, we propose a quick solution to fix the pertinent flaws of the PALK. The security and correctness of the proposed solution iPALK is proved using formal BAN logic, automated tool ProVerif along with a brief discussion on the correctness of the scheme. The performance comparisons also show that the iPALK not only provides the correctness, but it is more efficient in terms of computation and communication costs.

Security and performance enhancement of fingerprint biometric template using symmetric hashing

There are several fingerprint template protection methods among them the most common method is the symmetric hashing of the fingerprint template. The main problems still unsolved in the case of symmetric hashing are the excessive drop in accuracy, the reversibility and the linkability of hashed template. The experimental analysis of the existing hash method point out that there is an excessive drop in accuracy of matching. In this paper a modified symmetric hash method is proposed in which a key value is used as a multiplication parameter. The modified symmetric hash function is a combination of salting and non invertible transformation. Systematic experimentation point out that the accuracy of matching of the modified symmetric hash method is much better than the existing method. The security of the modified hashed fingerprint template is analysed based on irreversibility and unlinkability and the modified hashed fingerprint templates are more secure than the hashed fingerprint templates.

Symmetric hash functions for secure fingerprint biometric systems

Securing biometrics databases from being compromised is an important research challenge that must be overcome in order to support widespread use of biometrics based authentication. In this paper we present a novel method for securing fingerprints by hashing the fingerprint minutia and performing matching in the hash space. Our approach uses a family of symmetric hash functions and does not depend on the location of the (usually unstable) singular points (core and delta) as is the case with other methods described in the literature. It also does not assume a pre-alignment between the test and the stored fingerprint templates. We argue that these assumptions, which are often made, are unrealistic given that fingerprints are very often only partially captured by the commercially available sensors. The Equal Error Rate (EER) achieved by our system is 3%. We also present the performance analysis of a hybrid system that has an EER of 1.96% which reflects almost no drop in performance when compared to straight matching with no security enhancements. The hybrid system involves matching using our secure algorithm but the final scoring reverts to that used by a straight matching system.