Article

Design of Improved Password Authentication and Update Scheme based on Elliptic Curve Cryptography

Authors:
  • Indian Institute of Technology, Dhanbad, India
To read the full-text of this research, you can request a copy directly from the authors.

Abstract

Secured password authentication and update of passwords are two essential requirements for remote login over unreliable networks. In this paper, an elliptic curve cryptography (ECC) based technique has been proposed that not only satisfies the above two requirements, but also provides additional security requirements that are not available in some schemes proposed so far. For instances, the Peyravian and Zunic’s scheme does not provide the protection against the password guessing attack, server spoofing attack and data eavesdropping attack. Although some modifications to remove these attacks have been proposed by Hwang and Yeh, Lee et al., it has been found that some attacks like replay attack, server spoofing attack, data eavesdropping attack, etc. are still possible. Subsequently, Hwang and Yeh’s scheme is further improved by Lin and Hwang, which has been analyzed in this paper and certain security flaws have been identified. We have attempted to remove these security flaws and proposed an ECC-based scheme that in addition to the secured password authentication and password update, it protects several related attacks efficiently. As a proof of our claim, the detailed security analysis of the proposed scheme against the attacks has been given. One advantage of the proposed scheme is that it generates an ECC-based common secret key that can be used for symmetric encryption, which requires lesser processing time than the time required in the public key encryption-based techniques.

No full-text available

Request Full-text Paper PDF

To read the full-text of this research,
you can request a copy directly from the authors.

... So the computational cost of the proposed scheme is 18T h + 6T en∕d . Table 6 and Figure 6 show the results of comparing the computational time of our proposed method with the work of Kumari et al, 4 Kalra and Sood, 15 Sureshkumar et al, 34 Sureshkumar et al, 35 Islam and Biswas, 36 and Sureshkumar et al. 37 As shown in the table and figure, our proposed scheme outperforms the other two schemes. Specifically, the total computation time of our scheme is 0.7890 ms, while it is 58.8264 ms for Kumari 36 and 81.0939 ms for Sureshkumar et al. 37 Also, as shown in Table 4, our scheme can withstand almost all security threats, compared to other methods. ...
... Table 6 and Figure 6 show the results of comparing the computational time of our proposed method with the work of Kumari et al, 4 Kalra and Sood, 15 Sureshkumar et al, 34 Sureshkumar et al, 35 Islam and Biswas, 36 and Sureshkumar et al. 37 As shown in the table and figure, our proposed scheme outperforms the other two schemes. Specifically, the total computation time of our scheme is 0.7890 ms, while it is 58.8264 ms for Kumari 36 and 81.0939 ms for Sureshkumar et al. 37 Also, as shown in Table 4, our scheme can withstand almost all security threats, compared to other methods. In other words, our scheme is successful in achieving a delicate balance between the security and the performance while incurring the minimum computational cost. ...
... As a result, our proposed scheme outperforms the two related schemes in terms of achieving all security requirements while showing the best computational performance. Table 7 and Figure 7 demonstrate the comparison of communication cost (in terms of number of bits exchanged) of the proposed scheme with the schemes of Kumari et al, 4 Kalra and Sood, 15 Sureshkumar et al, 34 Sureshkumar et al, 35 Islam and Biswas, 36 and Sureshkumar et al, 37 in login and authentication phase. Based on previous studies, 22,32,38 the communication cost of sending identity is considered to be 160 bits, the time stamp is 32 bits, encryption/decryption operations are 128 bits, elliptic curve point multiplication is 320 bits, the realm is 32 bits, and random number and output hash function are 32 and 160 bits, respectively. ...
Article
Internet of Things (IoT) is a newly emerged paradigm where multiple embedded devices, known as things, are connected via the Internet to collect, share, and analyze data from the environment. In order to overcome the limited storage and processing capacity constraint of IoT devices, it is now possible to integrate them with cloud servers as large resource pools. Such integration, though bringing applicability of IoT in many domains, raises concerns regarding the authentication of these devices while establishing secure communications to cloud servers. Recently, Kumari et al proposed an authentication scheme based on elliptic curve cryptography (ECC) for IoT and cloud servers and claimed that it satisfies all security requirements and is secure against various attacks. In this paper, we first prove that the scheme of Kumari et al is susceptible to various attacks, including the replay attack and stolen‐verifier attack. We then propose a lightweight authentication protocol for secure communication of IoT embedded devices and cloud servers. The proposed scheme is proved to provide essential security requirements such as mutual authentication, device anonymity, and perfect forward secrecy and is robust against security attacks. We also formally verify the security of the proposed protocol using BAN logic and also the Scyther tool. We also evaluate the computation and communication costs of the proposed scheme and demonstrate that the proposed scheme incurs minimum computation and communication overhead, compared to related schemes, making it suitable for IoT environments with low processing and storage capacity. In this article, we propose a lightweight authentication scheme for IoT that can satisfy various security requirements, including perfect forward secrecy and device anonymity, and is robust against various attacks, including replay, Denning‐Sacco, denial‐of‐service, stolen‐verifier, and impersonation attacks. We formally verify the security of the proposed protocol using BAN logic and Scyther tool. We also evaluate its computation and communication costs and prove that the proposed scheme incurs minimum computation and communication overhead, compared to related schemes.
... Li [19] points out that the Islam and Biswas's scheme [18] cannot resist the off-line password guessing attack, stolen-verifier attack, and insider attack and overcomes its drawbacks in his scheme. Lee et al. [20] discover that both the original and modified schemes [18,19] are vulnerable to the insider attack and they have overcome this problem in their scheme. ...
... In authentication schemes, the security is of prime concerned; therefore, paying a little more cost for gaining more security is justifiable. Server Side Das et al. [9] 2PM + 1H 2P + 1PA + 1H Juang et al. [10] 2PM + 1BP + 1EN + 3H +3C 1PM + 1BP + 2EN + 4H +3C Islam et al. [18] 3PM + 1EN + 1PA + 2H 2PM +2BP + 1EN + 1PA + 2H Awasthi [13] 3PM + 2PA + 1EN 1PM + 2BP +1EN Lee et al. [20] 4H + 1PA + 3PM +4C +EN 2BP + 1EN +1PM +2H + 1PA Tang et al. [21] 3H + 2PM +10C + 1X 3H + 1PM + 9C Chaturvedi et al. [ In Table 2, we have presented the computational cost of our scheme along with other related schemes [8][9][10]13,17,18,[20][21][22]. Here, PM, PA, H, C, BP, EN, X, E represent the time Complexity of point multiplication on the Elliptic Curve, point addition on Elliptic Curve, Hash function, Concatenation, Pairing operation, Enc/Dec, XOR operation and Exponentiation, respectively. ...
... In authentication schemes, the security is of prime concerned; therefore, paying a little more cost for gaining more security is justifiable. Server Side Das et al. [9] 2PM + 1H 2P + 1PA + 1H Juang et al. [10] 2PM + 1BP + 1EN + 3H +3C 1PM + 1BP + 2EN + 4H +3C Islam et al. [18] 3PM + 1EN + 1PA + 2H 2PM +2BP + 1EN + 1PA + 2H Awasthi [13] 3PM + 2PA + 1EN 1PM + 2BP +1EN Lee et al. [20] 4H + 1PA + 3PM +4C +EN 2BP + 1EN +1PM +2H + 1PA Tang et al. [21] 3H + 2PM +10C + 1X 3H + 1PM + 9C Chaturvedi et al. [ In Table 2, we have presented the computational cost of our scheme along with other related schemes [8][9][10]13,17,18,[20][21][22]. Here, PM, PA, H, C, BP, EN, X, E represent the time Complexity of point multiplication on the Elliptic Curve, point addition on Elliptic Curve, Hash function, Concatenation, Pairing operation, Enc/Dec, XOR operation and Exponentiation, respectively. ...
Article
The bilinear pairing, also known as Weil pairing or Tate pairing, is widely used in cryptography and its properties help to construct cryptographic schemes for different applications in which the security of the transmitted data is a major concern. In remote login authentication schemes, there are two major requirements: i) proving the identity of a user and the server for legitimacy without exposing their private keys and ii) freedom for a user to choose and change his password (private key) efficiently. Most of the existing methods based on the bilinear property have some security breaches due to the lack of features and the design issues. In this paper, we develop a new scheme using the bilinear property of an elliptic point and the biometric characteristics. Our method provides many features along with three major goals. a) Checking the correctness of the password before sending the authentication message, which prevents the wastage of communication cost; b) Efficient password change phase in which the user is asked to give a new password after checking the correctness of the current password without involving the server; c) User anonymity - enforcing the suitability of our scheme for applications in which a user does not want to disclose his identity. We use BAN logic to ensure the mutual authentication and session key agreement properties. The paper provides informal security analysis to illustrate that our scheme resists all the security attacks. Furthermore, we use the AVISPA tool for formal security verification of our scheme.
... However, because of the characteristic of elliptic curve cryptography(ECC), it can maintain lower computational cost while supporting high security performance, which meets all requirements of security authentication. In 2012, Islam and Biswas [11] proposed an improved ECC-based password authentication scheme which can remedy the security weakness of Lin-Hwang [12] such that impersonation attack and stolen-verifier attack. However, in that year, Li [13] claimed that [11] cannot resist the inside attack, password guessing attack and stolen verifier attack, and fulfilled these pitfalls by proposing an improved anonymity authentication scheme in smart card. ...
... In 2012, Islam and Biswas [11] proposed an improved ECC-based password authentication scheme which can remedy the security weakness of Lin-Hwang [12] such that impersonation attack and stolen-verifier attack. However, in that year, Li [13] claimed that [11] cannot resist the inside attack, password guessing attack and stolen verifier attack, and fulfilled these pitfalls by proposing an improved anonymity authentication scheme in smart card. Nevertheless, Wang and He [5] investigated and revealed some loopholes in that scheme, which is prone to card loss attack and desynchronization attack. ...
... However, in the practical threats, there is a great possibility that the user will lose the smart card whatever theft by adversary or lose accidently. Hence, in the recent works [5], [11], [13], the smart card loss attack is taken into consideration. However, it is worth noting that, the adversary cannot extract the stored secret data in smart card even if they can somehow obtain the card in aforesaid assumptions. ...
Article
Full-text available
Smart card is indispensable part in our daily life, which brings us many conveniences including e-commerce and m-commerce service. However, because of the limited computation resource, the remote authentication between smart card and server is vulnerable to be attacked over insecure communication channel. Until now, many authentication schemes are proposed with their own pros and cons. Note that most of them are based on Elliptic curve cryptography, which are vulnerable to the card lose attack and desynchronization attack, where some schemes add a random number in verifier-value to resist the card lose attack and store both the old and new pseudo-identities between authenticator and the corresponding authenticated party to withstand desynchronization attack. However, the random number stored in card memory can be extracted and the new conversation may be blindly blocked by adversary. Hence, in this paper, we propose a novel authentication protocol that can utilize physical unclonable function(PUF) and elliptic curve cryptography(ECC) to protect the random number and support offline updating if online updating is blocked, which can be proven safe in formal security analysis. Meanwhile, we also introduce the robust PUF to prevent the modification of help data. Finally, our scheme is efficient by comparing with other related schemes in computation and communication overhead.
... In 1981, Lamport [9] proposed the first password-based authentication scheme using password tables to authenticate remote users over insecure network. Since then, many password authentication schemes [3,4,5,6,8,7,11,12,13,14,15,17] have been proposed and analyzed thoroughly by the cryptographic community. A password based remote user authentication scheme consists three components: remote user, remote server and an insecure channel to connect them. ...
... However, many scholars have pointed that Yang et al.'s scheme was vulnerable to the forged login attacks [2,3,12]. Recently, quite a number of password authentication schemes with smart cards have been proposed [4,8,13]. Although, many remote user authentication schemes with smart cards have been proposed, none of them could solve all possible problems and withstand all possible attacks. ...
... In a real environment, it is a common practice that many users use same passwords to access different applications or servers for their convenience of remembering long passwords and ease-of-use whenever required [4]. However, if the system manager or a privileged insider A of the server S knows the passwords of user U i he may try to impersonate U i by accessing other servers where U i could be a registered user. ...
Article
Password authentication schemes are one of the most commonly used solution to protect resources in net- work environment from unauthorized access. Since, their first introduction in [9], many password authentications schemes have been proposed and analysed by crypto community. Contribution of the present paper is two-folded. At first it presents the cryptanalysis results of Ramasamy et al.'s RSA based password authentication scheme [11] and shows that it is vulnerable to privileged insider attack, password guessing attack and Impersonation attack. Secondly, modifications to the scheme were suggested to overcome the vulnerabilities. Formal security analysis of the proposed scheme was presented using BAN logic. In addition to being secure the modified scheme facilitate password update and mutual authentication. Effciency comparison of the modified scheme is presented.
... However, this scheme was prone to impersonation attack. Islam and Biswas (2013) analyzed the scheme proposed in Lin and Hwang (2003) and identified that it suffered from various attacks such as, insider attack, impersonation attack, stolen-verifier attack, many logged in users attack and known session specific temporary information attack. To eliminate these security flaws, the authors developed an ECC based improved password authentication and updated scheme. ...
... To eliminate these security flaws, the authors developed an ECC based improved password authentication and updated scheme. The authors in Islam and Biswas (2013) claimed that their proposed scheme brought a considerable improvement in scheme Lin and Hwang (2003). Moreover, the work described in Islam and Biswas (2013) removed many of the security weaknesses of the scheme Zhu et al. (2008) and established that the proposed scheme Islam and Biswas (2013) was protected from all related attacks. ...
... The authors in Islam and Biswas (2013) claimed that their proposed scheme brought a considerable improvement in scheme Lin and Hwang (2003). Moreover, the work described in Islam and Biswas (2013) removed many of the security weaknesses of the scheme Zhu et al. (2008) and established that the proposed scheme Islam and Biswas (2013) was protected from all related attacks. Afterwards, Li (2013) analyzed the scheme described in Islam and Biswas (2013) and pointed out that it could get affected by stolen verifier attack, password guessing attack and insider attack. ...
Article
Full-text available
Long term evolution (LTE) and LTE-Advanced networks support highly developed authentication and encryption mechanisms. However, these systems still suffer from various security problems such as replay attack, impersonation attack, known key attack, eavesdropping attack and so on. To mitigate these security weaknesses, an improved authentication and security scheme has been proposed for LTE/LTE-A networks. The proposed scheme employs Elliptic Curve Cryptography (ECC), Elliptic Curve Diffie–Hellman (ECDH) and Salsa20 algorithm to improve end to end security and provide faster data transmission for 4G environment. The proposed scheme uses several powerful encryption techniques and also provides proper mutual authentication between User Equipment (UE) and Message Management Entity (MME). The performance of the proposed system has been compared with LTE-A and existing systems in terms of several security attributes and performance parameters. The comparative results show that the proposed scheme outperforms LTE-A as well as other existing schemes.
... In order to maintain less computation and communication overhead, recently many two-factor authentication schemes based on ECC have been proposed[7][8][9][10][11][12]. In 2013, Islam et al.[7]proposed an ECC based password authentication and key agreement using smart card in remote login environment. ...
... In order to maintain less computation and communication overhead, recently many two-factor authentication schemes based on ECC have been proposed[7][8][9][10][11][12]. In 2013, Islam et al.[7]proposed an ECC based password authentication and key agreement using smart card in remote login environment. Unfortunately, in the same year Li[8]pointed out that Islam et al. scheme cannot resist offline password guessing attack, stolen verifier attack and insider attack. ...
... Protecting the network servers from any unsafe user is largely indispensable, in case of the distributed environment [3]. As per the current literature and the real-time situations, the passwords are found to serve as the primary authentication approach in almost all applications [1,23,28]. From its existence in 1981, the researchers have centred their theme around this approach, particularly during the past ten years [5,6,10,19,21,22]. Password authentication using smart card is one among the two-factor authentication techniques of the distributed environment, which is effortless with increased level of robustness [2]. ...
... Depending on k ij and using Eqs. (28) and (29), the computation of C 3 and h 3 takes place in a respective manner. Later, these values help in the construction of the message M 5 that is to be transmitted to the MS. ...
Article
Full-text available
The distributed environment insists the protection of servers, while information sharing is achieved. The conventional biometrics-based password authentication mechanisms use single server, which can be compromised easily. The dual stage authentication mechanism has been already proved for its security over the single stage authentication mechanism in our previous work. In this paper, the protocol is improved to establish communication between the authentication server and the master server through a secure link. Since the hashed messages are prone to collision attacks, the proposed scheme uses elliptic curve cryptography-based ciphers for establishing connection at the initial stage. The security analysis of the proposed authentication scheme with secure server – server communication link reveals the robustness and the security features, which are offered over our previous as well as the conventional authentication mechanisms.
... In 1981, Lamport first proposed the notion of passwordoriented remote user validation method. Later several researchers have proposed authentication schemes focusing on various parameters like password, smart card [1][2][3][4][5][6][7][8][9][10], biometric [10], Elliptic Curve Cryptography [1][2][3][4][5][6][7][8][9][10]. In 2014 Wang et al [3] has proposed an ECC based anonymous remote user authentication scheme and claimed that their scheme preserves user anonymity and prevents credential leakage. ...
... In 1981, Lamport first proposed the notion of passwordoriented remote user validation method. Later several researchers have proposed authentication schemes focusing on various parameters like password, smart card [1][2][3][4][5][6][7][8][9][10], biometric [10], Elliptic Curve Cryptography [1][2][3][4][5][6][7][8][9][10]. In 2014 Wang et al [3] has proposed an ECC based anonymous remote user authentication scheme and claimed that their scheme preserves user anonymity and prevents credential leakage. ...
Conference Paper
As networking and wireless communication technologies advance more rapidly, it give rise to a quick change in the m-commerce land scape. The insecure public internet as an access medium resulted in lots of cryptographic attacks on wireless transactions. Due to this, there is an extreme demand for light weight and secure authentication protocols. In this context, few researchers have proposed E.C.C based authentication schemes to validate the legitimacy of the user connecting to remote server. Recently Islam et al has proposed a dynamic ID based authentication scheme using E.C.C and claimed that their scheme is secure and flexible. In this manuscript, we will illustrate that their scheme is susceptible to offline password guessing attack and user impersonation attack. We then communicate a secure and robust authentication scheme, which is resistant to all cryptographic attacks and light weight. We have analyzed security strengths of our scheme formally using random oracle model and game theory.
... Using polar transformation the segmented iris is transformed to a rectangular form. In [20] Elliptic Curve Cryptography scheme is used. It authorizes login clients and remote server with a secure and privacy preserving authentication. ...
Article
Full-text available
Password endorsement in the smart card acting a significant task in unconfident networks. Security slanting protocols used for endorsement between consumer and far-off server include a strapping covert password. But the present security slanting protocols are very expensive. Also the users desire to use easily memorize password. So the hackers can easily estimate the password leading to password guessing attack. The two password guessing attacks are online attack and offline attack. In this paper we proposed IRE Scheme for iris recognition using ECC for encryption and decryption for security, discretion and user friendly.
... In [7] a dynamic ID based authentication is used to provide privacy and efficiency. In [9] Islam-Biswas's scheme is used to exclude the Lin-Hwang's scheme weakness and the security. In [11] Wang Chang scheme is used, by attaining the timestamp the hacker can login as a user. ...
Article
Full-text available
Now-a-days smart card plays a major role in the world, due to its high security and privacy. But with the existing password endorsement method through an unsecure communication canal, a hacker can guess the password. Our proposed enhanced endorsement scheme with Elliptic Curve Cryptography provides better security, confidential and privacy. The scheme is susceptible to offline password guessing attack such as spidering, stolen-verifier and key stroke dynamics.
... An authentication factor is a piece of information used to authenticate or verify the identity of a user [4]. These factors can be categorized in three groups [17,18]: those based on the knowledge factor (what the client knows, like text passwords [5][6][7] or graphical passwords [8][9][10]), those based on the possession factor (what the client owns, dependent of a physical possession, like smart cards [11][12][13]) and those based on the inherence factor (who the client is, biometrics, like face recognition [14], fingerprints [15] and keystroke dynamics [16]). Although there are other factors proposed in literature, such as the use of a person's social networks [19] and location-based authentication [20], the three above are the most used and well-known factors. ...
Article
Context There is a great variety of techniques for performing authentication, like the use of text passwords or smart cards. Some techniques combine others into one, which is known as multi-factor authentication. There is an interest in knowing existing authentication techniques, including those aimed at multi-factor authentication, and the frameworks that can be found in literature that are used to compare and select these techniques according to different criteria. Objective This article aims to gather the existing knowledge on authentication techniques and ways to discern the most effective ones for different contexts. Method A systematic literature review is performed in order to gather existing authentication techniques proposed in literature and ways to compare and select them in different contexts. A total of 515 single-factor and 442 multi-factor authentication techniques have been found. Furthermore, 17 articles regarding comparison and selection criteria for authentication techniques and 8 frameworks that help in such a task are discussed. Results A great variety of single-factor techniques has been found and smart card-based authentication was shown to be the most researched technique. Similarly, multi-factor techniques combine the different single-factor techniques found and the combination of text-passwords and smart cards is the most researched technique. Usability, security and costs are the most used criteria for comparing and selecting authentication schemes, whereas the context is given an important remark as well. No framework among the ones found analyzed in detail both single-factor and multi-factor authentication techniques for the decision-making process. Conclusion The review shows that a vast research has been done for authentication techniques, although its use in some contexts has not been researched as much. The lack of works regarding the comparison and selection of authentication techniques is observed.
... The basics of ECC relevant to the present study is mentioned in this section. The ECC algorithm performs better cryptography with improved security [12][13][14][15][16][17][18][19][20][21], when it is compared with conventional cryptographic methods like DH, RSA and DSA. ...
Article
Full-text available
At present, the sensor-cloud infrastructure is gaining popularity, since it offers a flexible, open and reconfigurable configuration over monitoring and controlling application. It handles mainly the user data, which is quite sensitive and hence the data protection in terms of integrity and authenticity is of greater concern. Thus, security is a major concern in such system, inclusive of intruders, who tries to access the infrastructure. In this paper, an improved encryption protocol for secured session keying between the users using a trusted services proposed over sensor-cloud architecture. This technique uses modified Elliptical Curve Cryptography (ECC) algorithm to improve the authentication of sensor nodes in the network. Further, Abelian group theory is designed to convert intruder deduction problem to linear deduction problem to resolve the complexity associated with manipulation of finding the intruders in the network.This helps to reduce the computational complexity of generating a secured message transmission and increased possibility to find the intruders in the network. The experimental validation with the proposed ECC in terms of computational cost proves that the proposed method attains lower computational cost and improved detection of intruders in the network. Also, the technique seems efficient and can be applied on practical cases, where other ECC algorithms fails while implementing it on a real time basis. © 2018 Springer Science+Business Media, LLC, part of Springer Nature
... In this article, single-factor authentication techniques will be addressed as authentication schemes, whereas multi-factor authentication techniques will be addressed as multi-factor authentication methods. Examples of knowledge-based authentication schemes are text passwords [9][10][11] and graphical passwords [12][13][14], whereas examples of possession-based schemes are smart cards [15][16][17] and of inherencebased schemes are biometrics, such as face biometrics [18], fingerprints [19] and behavioral biometrics [20]. On the other hand, some examples of multi-factor authentication are the combination of the knowledge and possession factors [21,22], the combination of the knowledge and inherence factors [23,24], the combination of the possession and inherence factors [25,26] and the combination of all three well-known factors [27,28]. ...
Article
Full-text available
Context There are many techniques for performing authentication, such as text passwords and biometrics. Combining two factors into one technique is known as multi-factor authentication. The lack of a proper method for comparing and selecting these techniques for their implementation in software development processes is observed. Objective The article presents a recommendation Framework proposal for comparing and selecting authentication techniques in a software development process. Method Knowledge from academy is obtained through a systematic literature review and experience from industry is gathered using a survey and interviews. The results of these two techniques are used to generate a Framework proposal, which is validated afterwards, through an expert panel and the case study method. Results A recommendation Framework is generated, which recommends the most appropriate authentication schemes and methods for software applications based on criteria identified in literature and industry, categorized by usability, security and costs, plus the context for which the application is intended. The Framework's validity is ascertained by confirming that its recommendations are on line with those on industry, based in the results from the developed case studies. A tool prototype was created in order to help using the Framework in software development processes. Conclusion The proposed Framework helps to cover the observed gap in literature, helping software developers to compare and select the most appropriate authentication techniques for their applications.
... 5. Performance analysis. In this paper, we make a comparison to elliptic curve cryptography(ECC) [19], cyclic elliptic curve points sequence(CECPS) [20], Elliptic Curve Cryptography with Symmetric Algorithm(ECCSA) [21] with our scheme(SKECE) to demonstrate the security of our new scheme as table3. A 1 to A 8 are the security attribute descried in above section. ...
Article
Data encryption scheme has been used widely in network communication. It mainly contains two encryption schemes: symmetric key encryption and asymmetric key encryption. Symmetric key encryption has the fast encryption character, while it cannot transmit key in unsafe channel due to the same encryption key and decryption key. On the contrary, asymmetric key encryption has the different encryption key and decryption key. But its encryption speed is too slow. Especially, the above schemes cannot effectively conduct secure password authentication and password update under unstable network environment when user logins remote management. To solve this question, we propose a mixed symmetric key and elliptic curve encryption scheme for password authentication and update. Our new scheme is composed of four stages: registration, password authentication, password update and session key distribution. In addition, it provides defence to answer various attack such as password guessing attack, server spoofing attack, data eavesdropping and replay attack. What's more, the new method generates a common symmetric key encryption, which needs less convergence time than traditional asymmetric key encryption. Finally, we give the performance and efficiency analysis for this new scheme. Also there are comparison experiments with the latest encryption schemes to demonstrate the effectiveness of our new method.
... The next protocol we analyze is due to Hui et al. [38]. In that paper, after pointing out the weakness of the password change phase of Islam et al. [39] and after the evaluation of several other password authentication schemes, [38] have presented a new password-based authentication and update scheme using ECC and showed that it can resist various attacks. However, in this work, the protocol is shown to be inherently vulnerable to clogging, weak authentication and SQL injection attacks. ...
... This attack is one of the most applicable attacks to password based authentication protocols [12]. In our cloud based platform, we don't store password in the users table. ...
Article
Full-text available
Today with the significant development of Information technology, the telemedicine concept has gained great popularity. Telemedicine has enabled healthcare team such as doctors and nurses to monitor patient's status carefully. Security and privacy issues always act as an obstacle to development of telemedicine. In this paper, we proposed a platform to ensure security and privacy of medical data. We utilized cloud computing and mobile computing in the proposed scheme. Cloud computing in combination with mobile computing has enabled healthcare team to monitor patient's status continuously. Also in order to provide security and privacy, we adopted elliptic curve cryptosystem and Identity management. Performance and security analysis of proposed scheme show our platform compared to previous similar schemes has more performance and security. Our proposed scheme is robust against many security attacks.
... Therefore, design of secure protocol is required to provided a secure protocol so that the confidentiality of the messages are preserved. In order to enhance securities and to other functionalities, numerous authenticated security protocols using smart-card have designed in recent times for single-server environments [5][6][7][8][9][10][11][12][13][14][15] and for multi-server environments [16][17][18][19][20][21][22][23][24][25][26]. ...
Article
Full-text available
At the present time, application of online communication systems are rapidly increasing and most of the clients depend on a set of servers to fulfill their daily needs. In order to access these servers, a client (user) needs to register to each server with different login credentials. To circumvent this situation, the concept of multi-server authentication has been adopted, where a user can access all the servers using a single login credential. In this paper, a two-factor multi-server authentication protocol, which is proposed by Leu and Hsieh, is analyzed and observed that the forgery attack and the off-line password-guessing attack can be made on it. Further, the off-line password-guessing attack and other security threats are found in similar kind of multi-server authentication protocol, which is designed by Li et al. This paper mainly focuses on enhancing the securities of the previously mentioned protocols and thus proposed a new protocol. We have employed formal and informal security analysis to analyze the proposed protocol. The performance of our protocol is also compared with the related protocols. It can also be noted that the designed protocol accomplishes mutual authentication, session key verification, and identity and password change phases. Copyright
... Hwang and Li [14] designed the first authentication scheme by using both the password and the smart card. Compared with previous authentication schemes [9]- [11], [15], [16], no verifier table is needed in their scheme. Therefore, Hwang and Li's scheme has better security. ...
Article
With the exponential increase of the mobile devices and the fast development of cloud computing, a new computing paradigm called mobile cloud computing (MCC) is put forward to solve the limitation of the mobile device's storage, communication, and computation. Through mobile devices, users can enjoy various cloud computing services during their mobility. However, it is difficult to ensure security and protect privacy due to the openness of wireless communication in the new computing paradigm. Recently, Tsai and Lo proposed a privacy-aware authentication (PAA) scheme to solve the identification problem in MCC services and proved that their scheme was able to resist many kinds of existing attacks. Unfortunately, we found that Tsai and Lo's scheme cannot resist the service provider impersonation attack, i.e., an adversary can impersonate the service provider to the user. Also, the adversary can extract the user's real identity during executing the service provider impersonation attack. To address the above problems, in this paper, we construct a new PAA scheme for MCC services by using an identity-based signature scheme. Security analysis shows that the proposed PAA scheme is able to address the serious security problems existing in Tsai and Lo's scheme and can meet security requirements for MCC services. The performance evaluation shows that the proposed PAA scheme has less computation and communication costs compared with Tsai and Lo's PAA scheme.
... This scheme not able to resist the replay attack and the impersonation attacks. To improved security in the mutual authentication, several schemes [7][8][9][10][11] are proposed with different hash collision resistant functions and elliptic curves. In these schemes each entity has to maintain a verifier table to achieve the mutual authentication. ...
Article
Full-text available
Due to expeditious advancement in the cloud computing architecture, stakeholders are migrating and relaying on different third party cloud service providers. Moreover, the user applications, data and processes are running out of the premises. Thus wherever it is running on thirty party's environment, the security becomes an issue. Especially, public cloud environment mandates savior security and access control mechanisms to safeguard the cloud services and its outsourced assets in a seamless and transparent manner. An effective authentication is the basis, topmost prioritized and emergence one for the secure cloud communications. We reviewed, analyzed and found that recently proposed schemes are insecure against the service provider impersonation and Ephemeral Secret Leakage (ESL) attacks and also not able to support mutual authentication. As a result, in this article a secure and lightweight mutual authentication scheme is proposed based on tokenization and time-based dynamic nonce generation. Our investigation restricts the external and internal malicious users from accessing cloud-based critical information. The proposed protocol not only meets intended mutual authentication, but also provides security strength against the impersonation and ephemeral secret leakage attacks.
... In other words, even though cipher text, cryptography/decoder algorithm should be presented, decoding of message is assumed to be impossible. [Figure 2.1] shows private key encryption system process12. ...
... Thus, this attack is infeasible in the improved protocol. On the other hand, as in practical situations, the user tries to use a simple and weak passwords for easy memorization; the password brute force attack is becoming an important concern in any passwordbased authentication protocol [26]. Hence, for a highsecurity level, we can propose to replace password-based authentication by the fingerprints authentication, which is becoming increasingly popular in recent years. ...
Article
Radio frequency identification technology is one of the modern popular emerging technologies proven to advance a wide range of applications in both academia and industry. However, potential security risks, privacy issues, and efficiency are still open challenges that must be addressed seriously to achieve enhanced protection. In this paper, we show that the Akgün et al. protocol remains unsafe and imperfect in terms of the security issue and database identification efficiency. We, first, demonstrate that the Akgün et al. protocol suffers from a stolen/lost reader attack, which could expose users to some life threatening situations and unwanted collection of sensitive private information. Second, we found that all indexing identification-based protocols and exceptionally the Akgün et al. protocol cannot be used properly when the collision of tag index occurs, which exhibits a low efficiency in the database entry identification process. As the Akgün et al. protocol is almost perfect, it is worthy to be enhanced. Therefore, towards a complete and secure mobile radio frequency identification authentication protocol, we propose efficient solutions that could overcome the aforementioned security problem and offer high identification efficiency using efficient anticollision procedure based on dynamic linked list data structure principle. Via informal and formal security analysis, we show that the improved version is insensitive to the most common attacks and is more efficient than the existing schemes in the literature. Copyright
... There are few key agreement protocols available in the literature (Reddy et al. 2019;Hassan et al. 2018;Chen et al. 2019;He et al. 2018He et al. , 2019He et al. , 2020. Among the few key agreement protocols, an ECC based effective and secure authentication scheme for sharing and updating the password used in remote login systems was developed by Hafizul Islam et al. (2013). In this protocol, between the client and server a secure key is established and this key is named as session key. ...
Article
Full-text available
A most prominent and emerging technology namely the Internet of Things (IoT) enables legitimate users to access and monitor the sensors installed in various units of the industry. Such access and monitoring is facilitated using a secure authenticated key agreement (AKA) protocol. However, the complexity arises during the establishment of an effective session key agreement protocol to allow users to communicate securely with the sensors placed in the industrial IoT (IIoT). Few key agreement protocols existing in the literature have proved to perform the task effectively. Nevertheless, such protocols suffer from increased computation and communication cost. Hence, the motivation is to develop an efficient key agreement protocol that could over perform the existing protocols. Therefore, this research paper proposes an efficient key agreement protocol which is computationally and communication efficient. Moreover, the proposed key agreement protocol permits the users to securely communicate with the sensors. The proposed work focuses on twin dimensions. The first dimension is to reduce the computational complexity while sharing the mutual session key among the users and sensors. The second dimension focuses on decreasing the communicational cost. This is achieved by minimizing the amount of information communicated among the users and sensors. Subsequently, the proposed protocol is a hybrid methodology in which there are two working layers through which the session key is established. In the first layer, a mutual secret key is generated using a well-known elliptic curve cryptography (ECC) technique and this is shared among the users and the gateway node (GWN). In the second layer, the key generated in the above layer is used and the user initiates the key agreement process, wherein the GWN and sensors are generating a mutual session key using a group key. The simulated results of the proposed work clearly depicts the substantial reduction of computational and communicational complexities.
... The drawback is additional cost are needed to provide the feature of forward secrecy and to achieve user privacy. In [7] Elliptic Curve Cryptography scheme is used. It authorizes login clients and remote server with a secure and privacy preserving authentication. ...
Article
Full-text available
Password authentication in the smart card plays an important role in insecure networks. Security slanting protocols used for authentication between user and remote server include a brawny covert password. But the existing security slanting protocols are very costly. Also the users desire to use easily memorize password (ie., feeble password). So the hackers can easily guess the password leading to password guessing attack. The two password guessing attacks are online attack and offline attack. In this paper we proposed PGAE scheme for encryption and PGAD scheme for decryption. The PGAE and PGAD based on Elliptic Curve Cryptography provide better security, privacy and user friendly.
... Islam et al. [28] improved upon the scheme put forward by Lin et al. [29] that had a passwordbased authentication mechanism based on ECC. But H. Debitao along with fellow researchers [30] later discovered that the scheme was not safe from password guessing attacks, stolen verifier attacks as well as the insider attacks. ...
Article
Full-text available
Upgradation of technologies for sustainable smart cities has led to rapid growth in Internet of Things (IoT) applications, including e-healthcare services wherein smart devices collect patient data and deliver it remotely to the servers in real-time. Despite its enormous benefits, IoT in healthcare has not received much attention primarily due to the risk of unauthorized access to confidential medical information enabled by the vulnerable wireless channel for communication. Besides, tiny IoT devices have limited computing power and storage capabilities that prevent administrators from using complex and resource-hungry security protocols. The cyber attacks on the Internet of Healthcare applications (IoHA) could result in fatalities, decreased revenue, and reputation loss, hence endangering sustainability. The existing security protocols are unsuitable due to the cost complexities that necessitate developing new security protocols for resource-constrained and heterogeneous IoT networks. We introduce a confidentiality and anonymity-preserving scheme for critical infrastructures of IoT to conquer cyber threats for sustainable healthcare. This paper proposes Zero-Knowledge Proofs (ZKP) based Authenticated Key Agreement (AKA) protocol for IoHA. ZKP-AKA uses zero-knowledge proofs, physically unclonable function, biometrics, symmetric cryptography, message digest, etc., for accomplishing the protocol's objective at minimal computation, storage, and communication expenses. ZKP-AKA retains data integrity, confidentiality, anonymity, and safety from significant cyber threats.
... First, the high frequency of data collection may cause great risks to location privacy, allowing attackers to track smart devices. Moreover, the identities of fog nodes and smart devices may also be impersonated by an attacker to transmit malicious data or illegally collect data [11], [15]- [17], [23]. In recent years, many researchers have proposed security and privacy issues in the fog computing environment [5], [9], [12], [25], [26], [28]. ...
Article
Full-text available
Fog-driven IoT architecture located between IoT devices and the centralized cloud infrastructure is introduced to extend computing, storage and network services to the edge of the Internet and therefore resources and services of the fog nodes are available and are closer to the end user and end device for providing mobility, low latency and location awareness. However, the paradigm of fog computing due to its inherited properties from cloud as inherits its security and privacy concerns such as spoofing, message replay, impersonation, man-in-the middle and physical capturing of IoT devices etc. To address these concerns in fog computing services, in this paper, a lightweight anonymous authentication and secure communication scheme is proposed and it only used secure one-way hash function and bitwise XOR operations when cloud, fog and user mutually authenticate each other. After the successful authentication, both fog-based participants can agree on a session key to encrypt the subsequent communication messages. The security can be ensured during authentication process by using the Burrows-Abadi-Needham (BAN) logic and the performance comparisons with existing schemes demonstrate that the proposed scheme is secure and highly efficient.
... Chang [15] proposed a certificateless short signature scheme based on bilinear pairings, which could resist public key replacement adversary attacks. Islam [16] proposed an efficient short signature scheme based on certificate, which improved the operation efficiency by reducing double-line pair operation. Wang [17] proposed an efficient certificateless short signature scheme based on bilinear pairings, and gave the security proof of the scheme. ...
Article
In the traditional public key cryptosystem based on certificates, the issuance and management of usercertificates are realized through the authoritative certificate center, but amount of time is spent in thetransmission and verification of user public key certificates. After a malicious user obtaining legitimate users’private keys, he can select a secret value and signature process to generate the final private key, public key and signature. And he will announce that he is the legal user, while others are unable to distinguish this process. This is the defect of traditional digital signature scheme without certificate. Therefore, this paper proposes a certificateless short signature scheme based on integrated neural networks and elliptic curve cryptography for secure data fusion analysis. The security of the solution is based on Inv-CDH problem. The complete securityproof is given under the stochastic predictor model. It is proved that the new model can resist existence forgery in adaptive selective message attack with new adversary. Experiment results show that the calculation amount of our proposed certificateless short signature scheme is small and the efficiency is high compared with other state-of-the-art schemes.
... However, this scheme has the defect that cannot resist tracking attacks and forgery attacks. Then, Islam et al. [3] proposed an advanced scheme based on ECDLP, which has made improvements to the previous problems, and it can effectively resist tracking attacks. However, this scheme needs to update the database during the identity authentication phase, which increases the cost of the back-end server and does not have the feature of mutual authentication. ...
Article
Full-text available
With the rapid development of the Internet of Things (IoT) technology, it has been widely used in various fields. IoT device as an information collection unit can be built into an information management system with an information processing and storage unit composed of multiple servers. However, a large amount of sensitive data contained in IoT devices is transmitted in the system under the actual wireless network environment will cause a series of security issues and will become inefficient in the scenario where a large number of devices are concurrently accessed. If each device is individually authenticated, the authentication overhead is huge, and the network burden is excessive. Aiming at these problems, we propose a protocol that is efficient authentication for Internet of Things devices in information management systems. In the proposed scheme, aggregated certificateless signcryption is used to complete mutual authentication and encrypted transmission of data, and a cloud server is introduced to ensure service continuity and stability. This scheme is suitable for scenarios where large-scale IoT terminal devices are simultaneously connected to the information management system. It not only reduces the authentication overhead but also ensures the user privacy and data integrity. Through the experimental results and security analysis, it is indicated that the proposed scheme is suitable for information management systems.
... Proof Assume that an adversary intercepts the message request I D a , η, γ, ϑ, T a sent from I a to I b , it cannot get η, since computing r a is equivalent to solve Elliptic Curve Discrete Logarithm Problem (ECDLP) [22]. What is more, he will not be able to get γ , because he will not be able to compute α since r a and d a are secret and are only known by I a . ...
Article
Full-text available
The need to establish a secure communication for most applications of Internet of Things (IoT) has become increasingly crucial. Nevertheless, one of the major issues of such networks is how to establish cryptographic keys between all IoT objects to ensure secure data exchange. Several key management schemes have been suggested in the literature to achieve this goal, but they must be revised and innovated, while taking into account the limited resources of IoT objects. Likewise, the IoT presents a system where objects belonging to the physical world, are connected to the Internet, and have the capacity to measure, communicate, and act around all over the world. Nevertheless, some information available to IoT objects is private, hence the need to ensure an access control whose aim is to guarantee that the information be accessible only to those whose the access is allowed. In this paper, we propose a scheme involving two basic modules, namely key management, and access control. The key management module is designed to ensure both the generation and storage of symmetric keys for IoT objects in a completely distributed manner without resorting to a central authority. In contrast, the access control module is used to impose an access control policy so as to prevent unauthorized access to services provided by a particular IoT object. The latter is ensured thanks to the existing cooperation between the TGOs servers of different domains in the IoT. Through assessments based on security analysis, we demonstrate that the proposed scheme is more secure than the existing ones. Simulations were also performed to validate the proposed solution by comparing it with some relevant concurrent schemes. The obtained results are not only encouraging, but also very favorable for the proposed scheme.
... It is used for private interchange of plaintext utilizing a symmetric key encryption algorithm. The performance examines of the proposed method is endorsed that the protection of data against impersonation attacks [23]. Murali et al. proposed a framework based on both traditional and quantum cryptography for cloud computing. ...
Article
Full-text available
In the Hybrid cloud deployment model, security is essential to restrict access while using resources such as virtual machine, platform, and application. Many protocols were developed to provide security via the cryptography technique, but these protocols rarely considered the trust factor which is an essential factor for cloud security. The existing Elliptic Curve Cryptography and Diffie Hellman key distribution mechanism failed to stress the trust factor, and further, they have provided not only higher complexity but also lower security and reliability. The proposed method comprised two stages: first stage, Group Creation using the trust factor and develop key distribution security protocol. It performs the communication process among the virtual machine communication nodes. Creating several groups based on the cluster and trust factors methods. The second stage, the ECC (Elliptic Curve Cryptography) based distribution security protocol is developed. The proposed Trust Factor Based Key Distribution Protocol reduced error rate, improve the key computation time and maximize resource utilization.
... In other words, it generates secure templates in the form of a set of non-invertible binary strings from the biometric data using userspecific random numbers [67]. 3. Elliptic curve [20,59]: ...
Article
Full-text available
Electronic Medical Record (EMR) systems is a part of e-healthcare system, which is developing rapidly. In this, it is possible to deliver medical services among multiple participants over a network without physical presence. Since sensitive data is transmitted over public channels, it is very much required to maintain the secrecy of that data. This is achieved by mutual authentication between the participants. For this, various schemes for authentication with smart cards have been proposed. Han et al. proposed one such biometrics-based scheme for the same purpose using hash functions along with symmetric key encryption and elliptic curve cryptography. From cryptanalysis of their scheme, we have pointed out weaknesses viz. no user anonymity, user and server impersonation, man-in-the-middle attack. These security issues have been presented in this article. To overcome these attacks, a scheme has been proposed in this article. Since it does not use symmetric key encryption, the proposed scheme reduces the computational complexity as can be seen in the comparison provided. The security analysis of the proposed scheme, along with BAN (Burrows-Abadi-Needham) logic has been explained in detail. Comparison of the proposed scheme with related schemes with respect to computation cost, execution time and performance is demonstrated. This proves that the proposed scheme performs well in terms of security as well as computational efficiency.
... Client's program tries to communicate with the server's program over insecure networks like Internet [1]. In the process, the identity and a secret password of a client are used for mutual authentication and access control. ...
... The basics of ECC relevant to the present study is mentioned in this section. The ECC algorithm performs better cryptography with improved security [12][13][14][15][16][17][18][19][20][21], when it is compared with conventional cryptographic methods like DH, RSA and DSA. ...
... It is used for private interchange of plaintext utilizing a symmetric key encryption algorithm. The performance examines of the proposed method is endorsed that the protection of data against impersonation attacks [23]. Murali et al. proposed a framework based on both traditional and quantum cryptography for cloud computing. ...
Article
Full-text available
In the Hybrid cloud deployment model, security is essential to restrict access while using resources such as virtual machine, platform, and application. Many protocols were developed to provide security via the cryptography technique, but these protocols rarely considered the trust factor which is an essential factor for cloud security. The existing Elliptic Curve Cryptography and Diffie Hellman key distribution mechanism failed to stress the trust factor, and further, they have provided not only higher complexity but also lower security and reliability. The proposed method comprised two stages: first stage, Group Creation using the trust factor and develop key distribution security protocol. It performs the communication process among the virtual machine communication nodes. Creating several groups based on the cluster and trust factors methods. The second stage, the ECC (Elliptic Curve Cryptography) based distribution security protocol is developed. The proposed Trust Factor Based Key Distribution Protocol reduced error rate, improve the key computation time and maximize resource utilization. 1. Introduction. Cloud computing has emerged as a pivoted new field, differentiated from conventional computing by its focus on software as services, platform as services and infrastructure as services, these services are implemented by Cloud deployment models such as public cloud, private cloud or hybrid cloud. Cloud computing has added to the advances in computational and correspondence innovations-making financially achievable the combination of various clusters of heterogeneous network resources and services which, thus, have prompted the improvement of extensive large scale distributed system. A group key exchange protocol permits a set of people to agree upon a shared secret session key over an internet network [1, 2]. Cloud computing virtual resource can be characterized into three types such as compute, storage and network. Compute resource permit you to start virtual machines on cloud infrastructure. The main challenges of task scheduling in compute clouds are its highly dynamic environment, where the computing resources have their availability, access policies, security, reliability, etc. [3, 4]. Cloud computing has often jointly supported collaborative computing projects on the internet. Maximum of these projects have stringent security requirements. The capabilities for cloud systems and networks, such as broadband capabilities and distributed intelligence can greatly enrich reliability and efficiency, but they might also create much vulnerability if not deployed with the appropriate security controls. Providing security for such a large system may seem an unfathomable task, and if done incorrectly, can leave utilities open to cyber-attacks [5, 6]. Communicate among the group of members in securely and tried to reduce the complexity of informing the group key. The secure communications in the group or large group are more complex than Peer-to-peer communication because of the adaptability issue of the group key. Specifically, the expense of key establishment and renovating are generally pertinent to the size of the group and consequently turns into a performance bottleneck in attain scalability. To address this issue, our proposed approach named as the trust factor based key distribution protocol that combines the features of ECC key exchange protocol with the trust factor. ECC and Diffie Hellman key exchange protocols do not consider the trust factor in that which is relating to a "firm belief " with a treat like trustworthiness, reliability, and ability of the element for multicast communication in distributed computing [7, 8]. The primary goal of a cloud environment is increasing the domain to domain interactions, a secure environment and to ensuring the confidentiality of others. To achieve this "trust," notion needs to be considered so that the trustworthiness makes the geographically distributed method more reliable and attractive. The trust
... This is a property of an efficient communication protocol where an old password is required and matched when changing the password [45]. The password is not sent on the communication channel in plain [46]. The password is always verified at the end-user before communicating it to the server. ...
Article
Full-text available
E-Healthcare is an emerging field that provides mobility to its users. The protected health information of the users are stored at a remote server (Telecare Medical Information System) and can be accessed by the users at anytime. Many authentication protocols have been proposed to ensure the secure authenticated access to the Telecare Medical Information System. These protocols are designed to provide certain properties such as: anonymity, untraceability, unlinkability, privacy, confidentiality, availability and integrity. They also aim to build a key exchange mechanism, which provides security against some attacks such as: identity theft, password guessing, denial of service, impersonation and insider attacks. This paper reviews these proposed authentication protocols and discusses their strengths and weaknesses in terms of ensured security and privacy properties, and computation cost. The schemes are divided in three broad categories of one-factor, two-factor and three-factor authentication schemes. Inter-category and intra-category comparison has been performed for these schemes and based on the derived results we propose future directions and recommendations that can be very helpful to the researchers who work on the design and implementation of authentication protocols.
Article
Recently, Li proposed a new password authentication and user anonymity scheme based on elliptic curve cryptography. In this paper, we will show that Li’s scheme is vulnerable to the impersonation attack and the denial of service attack. Moreover, we also point out that there is an error in his scheme. To overcome the weaknesses of Li’s scheme, we proposed an efficient password authentication scheme based on elliptic curve cryptography. The proposed scheme improves the security and efficiency of the authentication process.
Article
Full-text available
As the most prevailing two-factor authentication mechanism, smart-card-based password authentication has been a subject of intensive research in the past two decades, and hundreds of this type of schemes have wave upon wave been proposed. In most of these studies, there is no comprehensive and systematical metric available for schemes to be assessed objectively, and the authors present new schemes with assertions of the superior aspects over previous ones, while overlooking dimensions on which their schemes fare poorly. Unsurprisingly, most of them are far from satisfactory – either are found short of important security goals or lack of critical properties, especially being stuck with the security-usability tension. To overcome this issue, in this work we first explicitly define a security model that can accurately capture the practical capabilities of an adversary and then suggest a broad set of twelve properties framed as a systematic methodology for comparative evaluation, allowing schemes to be rated across a common spectrum. As our main contribution, a new scheme is advanced to resolve the various issues arising from user corruption and server compromise, and it is formally proved secure under the harshest adversary model so far. In particular, by integrating " honeywords " , traditionally the purview of system security, with a " fuzzy-verifier " , our scheme hits " two birds " : it not only eliminates the long-standing security-usability conflict that is considered intractable in the literature, but also achieves security guarantees beyond the conventional optimal security bound.
Chapter
Password as an easy-to-remember credential plays an important role in remote user authentication schemes, while drawing from a space so small that an adversary may exhaustively search all possible candidate passwords to guess the correct one. In order to enhance the security of the password authentication scheme, smart card is introduced as the second factor to construct two-factor authentication scheme. However, we find out that two latest smart-card-based password authentication schemes are vulnerable to offline password guessing attacks under the definition of secure two-factor authentication. Furthermore, in order to show the serious consequence of offline password guessing attacks, we illustrate that the password compromise impersonation attacks as further threats are effective to break down the authentication schemes. Finally, we conclude the reasons why these weaknesses exist and present our improved ideas to avoid these problems in the future.
Conference Paper
The use of online messaging systems to exchange information has changed due to the ability to share text, video and pictures almost immediately. Also it has become an excellent alternative for transmitting data with certain reserve levels in places or where voice signals and other forms of communication are not of high quality and/or availability, creating gaps in critical information security systems. This article describes the inherent risk of use messaging apphcations for transmission of classified information, based on user needs, but with a concept of organizational use. The analyzed elements are usability, privacy of contacts and content, data security, safe storage of information, traceability of messages, lifespan of the message, information storage encryption protocols and channel codification. Because of this, in this project, a survey has been conducted in regards to acceptable requirements applicable to these technologies in the work sector. This has led to the design of a set of applications from a usability standpoint while ensuring adequate and flexible security levels. Work completed in this research included aspects of design and architecture of a XMPP messaging system, privacy of information, use of local databases and storage of information according to relevant corporate security policies and agreements, biometric recognition systems for authentication encryption protocols.
Article
This paper proposes a dual-stage biometrics-based authentication mechanism using smart card. It is considered the improvement over the conventional single-stage biometrics-based authentication mechanism, which exploits only one server for authentication, whereas the proposed scheme exploits two servers. The user authentication is performed in one server and hence it is called an authentication server. The credentials of the authentication server are stored in the second server, called the master server. The master server facilitates the authentication by providing required credentials to the authentication server. Both the security analysis and complexity analysis are conducted between the proposed and the conventional schemes. The analysis results show that the proposed scheme is secure than the conventional schemes with negligible computational complexity.
Article
Recently, Om et al. proposed three-factor remote user authentication protocol using ElGamal cryptosystem and ensured that it is withstands to various kinds of security attacks. But, the authors review carefully Om et al.'s scheme and discover that it unable to resist three attacks (like password guessing; denial of service; and user impersonation). Moreover, their protocol is not facilitating user anonymity. To solve these security vulnerabilities, the authors devise a secure and robust anonymous identity based authentication scheme for multi-server environment. The authentication proof of the proposed scheme has validated using BAN (Burrows-Abadi-Needham) logic, which confirms the protocol facilitates mutual authentication and session-key negotiation securely. Informal security analysis also confirms that it is well protected against various security attacks. In addition, the proposed work is compared along with other schemes (in the context of smart card storage and computation costs as well as execution time).
Article
Elliptic Curve Digital Signature Algorithm (ECDSA) is a public key cryptographic algorithm based on the hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP), it is used to ensure users’ authentication, data integrity and transactions non-repudiation. However, its weakness is to derive the signer’s private key in case he uses the same random number for to generate two signatures for two different messages. Firstly, in this paper we present the ECDSA and analyse its variants proposed in the literature.Also, we propose a new improvement technique for ECDSA of Liao and Shen and ECDSA of Chande and Lee. We intend to do so by introducing the unknown parameters which are used in the verification of the signature. Our aim is to overcome the problem which has not been explained in ECDSA schemes of both Liao and Shen and Chande and Lee.
Article
Full-text available
In sports competitions, depending on the conditions such as excitement, stress, fatigue, etc. during the match, negative situations such as disability or loss of life may occur for players and spectators. Therefore, it is extremely important to constantly check their health. In addition, some strategic analyzes are made during the match. According to the results of these analyzes, the technical team affects the course of the match. Effects can have positive and sometimes negative results. In this article, fog computing and an Internet of Things (IoT) based architecture are proposed to produce new technical strategies and to avoid disabilities. Players and spectators are monitored with sensors such as blood pressure, body temperature, heart rate, location etc. The data obtained from the sensors are processed in the fog layer and the resulting information is sent to the devices of the technical team and club doctors. In the architecture based on fog computing and IoT, priority processes are computed with low latency. For this, a task management algorithm based on priority queue and list of fog nodes is modified in the fog layer. Authentication and data confidentiality are provided with the Federated Lightweight Authentication of Things (FLAT) method used in the proposed model. In addition, using the Software Defined Network controller based on blockchain technology ensures data integrity.
Article
Cloud computing is a new technology in the market. In cloud computing user can access their files or data from anyplace using internet. There are several benefits of cloud computing like increase throughput, reduce costs, improve accessibility and requires less training but on the other hand it has some security issues. In that, identifying authorized user is a major issue. The user wanting to access the data or services needs to be registered and before every access to data or services; his/her identity must be authenticated for authorization. There are several authentication techniquesincluding traditional and biometric. T his Surveyexplains the various Authentication Schemes that arebeing practiced. The methodologies of the authentication schemes are discussed, their success and failures arestudied and the various attacks that breaks them are traced.
Article
Full-text available
Cryptanalysis of a variant of Peyravian-Zunic's password authentication scheme was discussed. This scheme is based on the collision-resistant hash function. It was found that this scheme is vulnerable to the guessing attack, the server attack and the server data eavesdropping attack.
Conference Paper
Full-text available
We discuss the use of elliptic curves in cryptography. In particular, we propose an analogue of the Diffie-Hellmann key exchange protocol which appears to be immune from attacks of the style of Western, Miller, and Adleman. With the current bounds for infeasible attack, it appears to be about 20% faster than the Diffie-Hellmann scheme over GF(p). As computational power grows, this disparity should get rapidly bigger.
Article
Full-text available
Recently, Hwang and Yeh proposed an improvement on the Peyravian-Zunic password scheme. The Hwang-Yeh scheme comprises a password authentication protocol, a password change protocol, and can also provide key distribution. Though the Hwang-Yeh scheme repaired several security problems of the Peyravian-Zunic scheme, it has several security problems: the password change protocol in the Hwang-Yeh scheme is vulnerable to a denial of service attack; and it does not provide the forward secrecy property in session key distribution. Furthermore, we shall fix the Hwang-Yeh scheme to avoid these problems.
Conference Paper
Full-text available
Article
Full-text available
Two-party authenticated key agreement protocol is used to authenticate entities and establish session keys in an open network in order to provide secure communications between two parties. Several security attributes are highly desired for such protocols, such as perfect forward secrecy (the corruption of long-term keys of all the entities should not compromise any session key), PKG forward secrecy (the corruption of the PKG's master key in the ID-based system should not compromise the established session keys), and known session-key specific temporary information secrecy (The exposure of private temporary information should not compromise the secrecy of generated session keys). In 2005, Choie et al. proposed three identity-based authenticated key agreement protocols from pairings. Our analysis shows that they all didn't provide protection against known session-key specific temporary information attack and some of them are vulnerable against man-in-the-middle attack, such as the key replicating attack. We analyze some of the attacks under the BR93 security model.
Article
Full-text available
In an internet environment, such as UNIX, a remote user has to obtain the access right from a server before doing any job. The procedure of obtaining acess right is called a user authentication protocol. User authentication via user memorable password provides convenience without needing any auxiliary devices, such as smart card. A user authentication protocol via username and password should basically withstand the off-line password guessing attack, the stolen verifier attack, and the DoS attack. Recently, Peyravian and Zunic proposed one password transmission protocol and one password change protocol. Later, Tseng et al. (2001) pointed out that Peyravian and Zunic's protocols can not withstand the off-line password guessing attack, and therefore proposed an improved protocol to defeat the attack. Independently, Hwang and Yeh also showed that Peyravian and Zunic's protocols suffer from some secury flaws, and an improved protocol was also presented. In this paper, we show that both Peyravian and Zunic's protocols and Tseng et al.'s improved protocol are insecure against the stolen verifier attack. Moreover, we show that all Peyravian and Zunic's, Tseng et al.'s, and Hwang and Yeh's protocols are insecure against DoS attack.
Article
Full-text available
This paper examines how monitoring power consumption signals might breach smart-card security. Both simple power analysis and differential power analysis attacks are investigated. The theory behind these attacks is reviewed. Then, we concentrate on showing how power analysis theory can be applied to attack an actual smart card. We examine the noise characteristics of the power signals and develop an approach to model the signal-to-noise ratio (SNR). We show how this SNR can be significantly improved using a multiple-bit attack. Experimental results against a smart-card implementation of the Data Encryption Standard demonstrate the effectiveness of our multiple-bit attack. Potential countermeasures to these attacks are also discussed.
Article
Full-text available
In this paper, we use the ten security requirements proposed by Liao et al. for a smart card based authentication protocol to examine five recent work in this area. After analyses, we found that the protocols of Juang et al., Hsiang et al., Kim et al., and Li et al. all suffer from offline password guessing attack if the smart card is lost, and the protocol of Xu et al.¡s is subjected to an insider impersonation attack.
Article
In 2002, Hwang and Yen showed that Peyravian-Zunic's password authentication schemes are not secure and proposed an improvement by using the server public key. Since applying the server public key results in the additional burden, we propose secure password authentication schemes without using the server public key in this paper.
Article
We discuss analogs based on elliptic curves over finite fields of public key cryptosystems which use the multiplicative group of a finite field. These elliptic curve cryptosystems may be more secure, because the analog of the discrete logarithm problem on elliptic curves is likely to be harder than the classical discrete logarithm problem, especially over GF ( 2 n ) {\text {GF}}({2^n}) . We discuss the question of primitive points on an elliptic curve modulo p , and give a theorem on nonsmoothness of the order of the cyclic subgroup generated by a global point.
Article
Peyravian and Zunic (2000) presented two schemes for protecting password transmission and password change respectively. Like the traditional authentication scheme using passwords, the two new schemes are also vulnerable to attacks like guessing attacks, server spoofing, and server data eavesdropping. This paper will give demonstrations on what have caused to these drawbacks, and more of that, two improved schemes are also proposed which are free from worries of those possible attacks.
Article
A method of user password authentication is described which is secure even if an intruder can read the system's data, and can tamper with or eavesdrop on the communication between the user and the system. The method assumes a secure one-way encryption function and can be implemented with a microcomputer in the user's terminal.
Article
Count data often contain many zeros. In parametric regression analysis of zero-inflated count data, the effect of a covariate of interest is typically modelled via a linear predictor. This approach imposes a restrictive, and potentially questionable, functional form on the relation between the independent and dependent variables. To address the noted restrictions, a flexible parametric procedure is employed to model the covariate effect as a linear combination of fixed-knot cubic basis splines or B-splines. The semiparametric zero-inflated Poisson regression model is fitted by maximizing the likelihood function through an expectation–maximization algorithm. The smooth estimate of the functional form of the covariate effect can enhance modelling flexibility. Within this modelling framework, a log-likelihood ratio test is used to assess the adequacy of the covariate function. Simulation results show that the proposed test has excellent power in detecting the lack of fit of a linear predictor. A real-life data set is used to illustrate the practicality of the methodology.
Article
Many password authentication schemes have been proposed for electronic commerce environment; however, none of them is secure enough. Hwang and Yeh proposed an improvement on the Peyravian-Zunic password authentication scheme including protected password transmission and password change. We demonstrate that the Hwang-Yeh scheme is also vulnerable to several kinds of attacks though the scheme has repaired some security problems of the Peyravianis-Zunic scheme. Furthermore, we propose an improved scheme to enhance security of their scheme in the paper. Based on collision-resistant hash function, the proposal employs techniques of salting, time stamp and trusted computing to be free from worries of possible common attacks, such as replay attack, guessing attack, stolen-verifier attack, denial of service attack, impersonation attack, and server spoofing attack. According to security analysis over insecure networks, the proposed scheme is the most secure scheme among the Peyravian-Zunic scheme, the Hwang-Yeh scheme, the Peyravian-Jeffries scheme, and the Wang-Zhang scheme.
Article
We consider the semilinear heat equation with globally Lipschitz non-linearity involving gradient terms in a bounded domain of ℝn . In this paper, we obtain explicit bounds of the cost of approximate controllability, i.e., of the minimal norm of a control needed to control the system approximately. The methods we used combine global Carleman estimates, the variational approach to approximate controllability and Schauder’s fixed point theorem.
Conference Paper
We show that finding an efficiently computable injective homomorphism from the XTR subgroup into the group of points over GF(p 2) of a particular type of supersingular elliptic curve is at least as hard as solving the Diffie-Hellman problem in the XTR subgroup. This provides strong evidence for a negative answer to the question posed by S. Vanstone and A. Menezes at the Crypto 2000 Rump Session on the possibility of efficiently inverting the MOV embedding into the XTR subgroup. As a side result we show that the Decision Diffie-Hellman problem in the group of points on this type of supersingular elliptic curves is efficiently computable, which provides an example of a group where the Decision Diffie-Hellman problem is simple, while the Diffie-Hellman and discrete logarithm problem are presumably not. The cryptanalytical tools we use also lead to cryptographic applications of independent interest. These applications are an improvement of Joux's one round protocol for tripartite Diffie-Hellman key exchange and a non refutable digital signature scheme that supports escrowable encryption. We also discuss the applicability of our methods to general elliptic curves defined over finite fields.
Article
In 2000, a remote user authentication scheme using smart cards was proposed and the masquerade attacks were proved successful on this scheme. Recently, Kumar has suggested the idea of check digits to overcome the above attacks with a new scheme that removes these threats well. In this paper it is pointed out that the weakness still exists in Kumar’s scheme, and the intruder can login to the remote system through having some information. A new scheme which can overcome these attacks and appears more secure and efficient than Kumar’s is presented.
Conference Paper
Cryptosystem designers frequently assume that secrets will be manipulated in closed, reliable computing environments. Unfortunately, actual computers and microchips leak information about the operations they process. This paper examines specific methods for analyzing power consumption measurements to find secret keys from tamper resistant devices. We also discuss approaches for building cryptosystems that can operate securely in existing hardware that leaks information.
Conference Paper
We propose a fully functional identity-based encryption scheme (IBE). The scheme has chosen ciphertext security in the random oracle model assuming an elliptic curve variant of the computational Diffie-Hellman problem. Our system is based on the Weil pairing. We give precise definitions for secure identity based encryption schemes and give several applications for such systems.
Conference Paper
Remote user authentication scheme is a mechanism which allows a server to authenticate a remote user over insecure channel. Recently, Goriparthi et al. made an enhancement based on Das et al.'s remote user authentication scheme using bilinear pairings. The scheme has the merits of no verification table, freely changing password and preventing the forgery attack and the replay attack. This paper, however, demonstrates that Goriparthi et al.'s improved scheme is vulnerable to the insider attack, the denial-of-service attack, and the server spooling attack.
Article
Recently, Wang et al. showed that two new verifier-free remote user password authentication schemes, Ku-Chen's scheme and Yoon et al.'s scheme, are vulnerable to an off-line password guessing attack, a forgery attack, and a denial-of-service attack, and then proposed an improved scheme for the real application in resource-limited environments. Unfortunately, we find that Wang et al.'s scheme is still vulnerable to an impersonation attack and an off-line password guessing attack. In addition, Wang et al.'s scheme is not easily reparable and is unable to provide perfect forward secrecy. Finally, we propose an improved scheme with better security strength.
Article
In this paper, we present a secure method for protecting passwords while being transmitted over untrusted networks. We also present a secure method for changing an old password to a new password. The proposed solutions do not require the use of any additional keys (such as symmetric keys or public/private keys) to protect password exchanges. Unlike existing solutions, the proposed schemes do not use any symmetric-key or public-key cryptosystems (such as DES, RC5, RSA, etc.). Our schemes only employ a collision-resistant hash function such as SHA-1.
Article
In this paper, we propose an efficient biometric-based remote user authentication scheme using smart cards, in which the computation cost is relatively low compared with other related schemes. The security of the proposed scheme is based on the one-way hash function, biometrics verification and smart card. Moreover, the proposed scheme enables the user to change their passwords freely and provides mutual authentication between the users and the remote server. In addition, many remote authentication schemes use timestamps to resist replay attacks. Therefore, synchronized clock is required between the user and the remote server. In our scheme, it does not require synchronized clocks between two entities because we use random numbers in place of timestamps.
Article
Recently, Liao and Wang proposed a secure dynamic ID based remote user authentication scheme for multi-server environment, and claimed that their scheme was intended to provide mutual authentication, two-factor security, replay attack, server spoofing attack, insider and stolen verifier attack, forward secrecy and user anonymity. In this paper, we show that Liao and Wang's scheme is still vulnerable to insider's attack, masquerade attack, server spoofing attack, registration center spoofing attack and is not reparable. Furthermore, it fails to provide mutual authentication. To remedy these flaws, this paper proposes an efficient improvement over Liao–Wang's scheme with more security. The computation cost, security, and efficiency of the improved scheme are well suited to the practical applications environment.
Article
Recently, Yoon and Yoo proposed a remote user authentication scheme which is an improvement on Lee–Kim–Yoo’s method. However, we find out that Yoon–Yoo’s scheme easily reveals a user’s password and is vulnerable to both masquerading user attack and masquerading server attack. Yoon–Yoo’s scheme is also exposed to stolen verifier attack, because it has to maintain a user database in a remote server. This paper proposes a new remote user authentication scheme that resolves all aforementioned problems, while keeping the merits of Yoon–Yoo’s scheme.
Article
Password authentication has been adopted as one of the most commonly used solutions in network environment to protect resources from unauthorized access. Recently, Lee–Kim–Yoo [S.W. Lee, H.S. Kim, K.Y. Yoo, Improvement of Chien et al.'s remote user authentication scheme using smart cards, Computer Standards & Interfaces 27 (2) (2005) 181–183] and Lee-Chiu [N.Y. Lee, Y.C. Chiu, Improved remote authentication scheme with smart card, Computer Standards & Interfaces 27 (2) (2005) 177–180] respectively proposed a smart card based password authentication scheme. We show that these two schemes are both subject to forgery attacks provided that the information stored in the smart card is disclosed by the adversary. We also propose an improved scheme with formal security proof.
Article
In 2002, Chien et al. proposed an efficient remote authentication scheme using smart cards, in which only few hashing operations are required. Later, Ku et al. gave an improved scheme to repair the security pitfalls found in Chien et al.'s scheme. Also Yoon et al. presented an enhancement on Ku et al.'s scheme. In this paper, we show that both Ku et al.'s scheme and Yoon et al.'s scheme are still vulnerable to the guessing attack, forgery attack and denial of service (DoS) attack. In addition, their schemes lack efficiency when users input wrong passwords. To remedy these flaws, this paper proposes an efficient improvement over Ku et al.'s and Yoon et al.'s schemes with more security. The computation cost, security, and efficiency of the improved scheme are embarking for the real application in the resource-limited environment.
Article
Remote user authentication based on passwords over untrusted networks is the conventional method of authentication in the Internet and mobile communication environment. Typical secure remote user access solutions rely on pre-established secure cryptographic keys, public-key infrastructure, or secure hardware. In this paper, we present secure password-based protocols for remote user authentication, password change, and session key establishment over insecure networks. The proposed protocols do not require the use of any additional private- or public-key infrastructure.
Article
The work presents a digital signature scheme on the elliptic curve cryptosystem, which is integrated with the identification scheme by Popescu [C. Popescu, An identification scheme based on the elliptic curve discrete logarithm problem, The 4th International Conference on High-Performance Computing in the Asia-Pacific Region, vol. 2 (2000) 624–625] using a one-way hash function. For making the trade-off of performance and security stand to benefit most, the proposed scheme is constructed on the elliptic curve cryptosystem. The scheme protects the signer from chosen-message attack and also identifies a forged signature.
Article
Remote user authentication based on passwords over untrusted networks is the conventional method of authentication in the Internet and mobile communication environments. Typical secure remote user access solutions rely on pre-established secure cryptographic keys, public-key infrastructure, or secure hardware. Recently, Peyravian and Jeffries proposed password-based protocols for remote user authentication, password change, and session key establishment over insecure networks without requiring any additional private- or public-key infrastructure. In this paper we point out security flaws of Peyravian–Jeffries’s protocols against off-line password guessing attacks and Denial-of-Service attacks.
Article
For providing a secure distributed computer environment, efficient and flexible user authentication and key agreement is very important. In addition to user authentication and key agreement, identity privacy is very useful for users. In this paper, we propose an efficient and flexible password authenticated key agreement scheme using bilinear pairings. The main merits include: (1) there is no need for any password or verification table in the server; (2) users can choose or change his own password freely; (3) both the server and a user can authenticate each other; (4) it can protect the user’s privacy; (5) the user and the server can generate a session key; (6) it does not have a serious synchronization-clock problem; (7) even if the secret information stored in a smart card is compromised, it can prevent the offline dictionary attack.
Article
In 2003, Shen, Lin and Hwang proposed a timestamp-based password authentication scheme using smart card. In the scheme the remote server does not need to store the passwords or verification tables for users’ authentication, and the scheme also provides a timestamp-based mutual authentication method to prevent the forged login attack and the forged server attack. However, this authentication scheme has been found to be vulnerable to forged login attack; an attacker could impersonate legitimate users to login and access the remote server. To solve this problem, an improved scheme will be proposed in this paper, which is based on nonce instead of timestamp and can withstand the existing forged attacks. The security analysis shows that the improved scheme still keeps the features of the non-storage data model authentication scheme, will not add additional computation cost to the smart card, and is more secure and more applicable than Shen’s scheme.
Conference Paper
Abstract Certificateless public key cryptography,(CL-PKC) was proposed,to overcome,the weak- nesses of the public key infrastructure (PKI) and identity-based cryptography,(ID-PKC). In PKI, certificates are used to provide the authenticity of public keys. However, a PKI faces many challenges in practice, such as the scalability of the infrastructure and certifi- cate management (distribution, revocation, storage, and validation costs). ID-PKC does not use certificates, but employs a key generation center (KGC) that will know every user’s private key. Hence, the KGC will also be able to trace each user transaction and may cause loss of privacy if it’s not trusted. In CL-PKC, on the other hand, the KGC does not have this information. Thus, CL-PKC is often considered a cross between PKI and ID-PKC. In their seminal paper on CL-PKC, Al-Riyami and Paterson (AP) proposed a certifi- cateless authenticated,key agreement,protocol. Key agreement,protocols are one of the fundamental primitives of cryptography, and allow two or more parties to establish se- cret keys securely in the presence of an eavesdropping adversary. AP’s protocol, the only
Conference Paper
We show that flnding an e‐ciently computable injective homomorphism,from the XTR subgroup,into the group of points over GF(p,) of a particular type of supersingular elliptic curve is at least as hard as solving the Di‐e-Hellman problem in the XTR subgroup. This provides strong evidence for a negative answer to the question posed by S. Vanstone and A. Menezes at the Crypto 2000 Rump,Session on the possibility of e‐ciently inverting the MOV embedding into the XTR subgroup. As a side result we show that the Decision Di‐e-Hellman problem in the group of points on this type of supersingular elliptic curves is e‐ciently computable, which provides an example of a group where the Decision Di‐e-Hellman problem is simple, while the Di‐e-Hellman and discrete logarithm problem are presumably not. The cryptanalytical tools we use also lead to cryptographic applications of independent interest. These applications are an improvement of Joux’s one round protocol for tripartite Di‐e-Hellman key exchange and a non refutable digital signature scheme,that supports escrowable encryption. We also discuss the applicability of our methods to general elliptic curves deflned over flnite flelds.
Conference Paper
Nowadays, digital signature schemes are widely used in electronic commerce. Thus, various digital signature schemes are proposed to make the electronic transactions more convenient. In 2007, Chung et al. proposed an ID-based digital signature scheme on elliptic curve cryptosystem (ECC). They claimed that their scheme is secure because it is based upon the difficulty of elliptic curve discrete logarithm problem (ECDLP). However, we find that their scheme has a security flaw, and thus we propose a feasible attack on Chung et al.psilas scheme in this paper. The proposed attack is based on the technique for solving the linear Diophantine equation. Using the proposed technique, an attacker can easily obtain the signer's secret key without facing the difficulty of ECDLP. Therefore, Chung et al.'s scheme cannot prevent from our attack such that it is not secure.
Conference Paper
In their seminal paper on certificateless public key cryptography, Al-Riyami and Paterson (AP) proposed a certificateless authenticated key agreement protocol. Key agreement protocols are one of the fundamental primitives of cryptography, and allow users to establish session keys securely in the presence of an active adversary. AP's protocol essentially requires each party to compute four bilinear pairings. Such operations can be computationally expensive, and should therefore be used moderately in key agreement. In this paper, we propose a new certificateless authenticated two-party key agreement protocol that only requires each party to compute two pairings. We analyze the security of the protocol and show that it achieves the desired security attributes. Furthermore, we show that our protocol can be used to establish keys between users of different key generation centers.
Article
In 2000, Peyravian and Zunic proposed an efficient hash-based password authentication scheme that can be easily implemented. Later, Lee, Li, and Hwang demonstrated that Peyravian-Zunic's scheme is vulnerable to an off-line guessing attack, and then proposed an improved version. However, Ku, Chen, and Lee pointed out that their scheme can not resist an off-line guessing attack, a denial-of-service attack, and a stolen-verifier attack. Recently, Yoon, Ryu, and Yoo proposed an improved scheme of Lee-Li-Hwang's scheme. Unfortunately, we find that Yoon-Ryu-Yoo's scheme is still vulnerable to an off-line guessing attack and a stolen-verifier attack. Furthermore, their scheme can not achieve backward secrecy. Herein, we first briefly review Yoon-Ryu-Yoo's scheme and then describe its weaknesses.
Article
Recently, Lee et al. proposed an improvement on Peyravian and Zunic scheme to make the protocol withstand the guessing attack. However, their scheme suffers from a denial of service attack. In this paper, we show that an attacker can easily prevent the normal use of communication facilities by performing the attack. We also propose an enhancement of the scheme to isolate such a problem.
Article
Many password authentication schemes employ hash functions as their basic building blocks to achieve better efficiency. In 2000, Peyravian and Zunic proposed a hash-based password authentication scheme that is efficient and can be easily implemented. Recently, Lee, Li, and Hwang demonstrated that Peyravian-Zunic's hash-based password authentication scheme is vulnerable to the off-line guessing attack, and then proposed an improved version. In this article, we show that their improved scheme is still vulnerable to the off-line guessing attack, the denial-of-service attack, and the stolen-verifier attack.
Article
Recently, Peyravian and Zunic proposed a simple but efficient password authentication system. Their scheme is based on the collision-resistant hash function, such as SHA-1. Their scheme did not use any cryptosystems (such as DES, RSA, etc.). However, their scheme is vulnerable to guess attack. An attacker can easily obtain a user's password by guessing attack and then impersonate the user to login and access resources in the server. To overcome the vulnerability of their scheme, we propose an improved scheme to enhance security of their scheme in this article.
Article
In the study, the digital multi-signature scheme, constructed by the integration of one-way hash function and identification scheme, are proposed based on the elliptic curvyecryptosystem (ECC). To the efficiency in performance, the ECC has been generally regarded as positive; and the security caused by the Elliptic Curve Discrete Logarithm Problem (ECDLP) is highly also taken highly important. The main characteristic of the proposed scheme is that the length of the multi-signature is fixed rather than changeable and it will not increase with the number of group members.
Article
The security of a password authentication scheme using smart cards proposed by Liao et al. [I.-E. Liao, C.-C. Lee, M.-S. Hwang, A password authentication scheme over insecure networks, J. Comput. System Sci. 72 (2006) 727–740] is analyzed. Three kinds of attacks are presented in different scenarios.
Article
Since Bellare and Rogaway's work in 1994, the indistinguishability-based security modelsof authenticated key agreement protocols in simple cases have been evolving for more than tenyears. In this paper, we review and organize the models under a unified framework with some newextensions. By providing a new ability (the Coin query) to adversaries and redefining two key securitynotions, the framework fully exploits an adversary's capacity and can be used to prove all thecommonly required ...
Article
Remote user authentication scheme is a procedure which allows a server to authenticate a remote user through insecure channel. Recently, Yoon, Ryu and Yoo made an enhancement based on Ku–Chen’s remote user authentication scheme by using smart cards. The scheme has the merits of providing mutual authentication, no verification table, freely choosing password, involving only few hashing operations and parallel session attack resistance. In this paper, we point out security flaws of Yoon–Ryu–Yoo’s protocols against masquerading attack, off-line password guessing attacks and parallel session attack. An improvement to enhance Yoon–Ryu–Yoo’s security scheme is proposed.
Article
In 2000, Hwang and Li's proposed a new remote user authentication scheme with smart cards. Some researchers pointed out the security weaknesses of Hwang and Li's scheme and they also proposed some modified schemes to avoid these weaknesses. In 2004, Kumar proposed a new remote user authentication scheme and try to solve the security problems of Hwang and Li's scheme. This paper analyzes that Kumar's scheme does not satisfy some essential security requirements. Kumar's scheme does not support mutual authentication, session key generation phase for secure communication. In addition, in Kumar's scheme, the remote user is not free to change his password. This paper present an enhanced remote user authentication scheme with smart card that not only resolves all the security problems of Hwang and Li's scheme, but also adds mutual authentication, session key generation and password change phase to Kumar's scheme and provides forward secrecy to the long term secret key of the remote server. In the proposed scheme, first the server and user authenticate one another and then generate a secret session key for secure communication. In our scheme, the remote user is free to change his/her password without connecting to server.