For secure communication it is not just sufficient to use strong cryptography with good and strong keys, but to actually have the assurance, that the keys in use for it are authentic and from the contact one is expecting to communicate with. Without that, it is possible to be subject to impersonation or man-in-the-middle (MitM) attacks.
Mega meets this problem by providing a hierarchical authentication mechanism for contacts and their keys. To avoid any hassle when using multiple types of keys and key pairs for different purposes, the whole authentication mechanism is brought down to a single "identity key".
Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis
Simon Fraser University（西蒙菲莎大学）；QI-ANXIN Research Institute（奇安信研究院）；Shandong University（山东大学）；The Chinese University of Hong Kong（香港中文大学）；QI-ANXIN Technology Research Institute（奇安信技术研究院）；School of Computer Science, Shanghai Jiao Tong University（上海交通大学计算机科学技术学院）；Tsinghua University（清华大学）；Tsinghua University-QI-ANXIN Group JCNS（清华大学-奇安信集团联合网络安全研究中心）；School of Cyber Science and Technology, Shandong University（山东大学网络空间安全学院）
研究通过动态分析揭示小程序中基于 OAuth 的认证滥用问题，设计 MINIAUTH 框架，对大量微信和百度小程序进行分析，发现多种滥用案例及百度 API 加密缺陷，强调加强开发者指导与平台保护的必要性。
We give a new two-pass authentication scheme, whichis a generalisation of an authentication scheme of Sibert-Dehornoy-Girault based on the Diffie-Hellman conjugacy problem. Compared to the above scheme, for some parameters it is more efficient with respect to multiplications. We sketch a proof that our authentication scheme is secure. We give a new key agreement protocols.
A group authentication protocol authenticates pre-defined groups of individuals such that: - No individual is identified - No knowledge of which groups can be successfully authenticated is known to the verifier - No sensitive data is exposed The paper presents a group authentication protocol based on splitting the private keys of the Naccache-Stern public-key cryptosystem in such a way that the Boolean expression defining the authenticable groups is implicit in the split.
Key Assignment Schemes (KASs) have been extensively studied in the context of cryptographically-enforced access control, where derived keys are used to decrypt protected resources. In this paper, we explore the use of KASs in entity authentication protocols, where we use derived keys to encrypt challenges. This novel use of KASs permits the efficient authentication of an entity in accordance with an authentication policy by associating entities with security labels representing specific services. Cryptographic keys are associated with each security label and demonstrating knowledge of an appro…
Recently, the number of requests for multicast services through the wireless networks has been increased. However, for successful deployment, security and efficiency of content delivery must be provided at first. This paper presents a new approach for secure multicast in wireless networks. This approach, CRAW (Combination of Re-keying and Authentication in Wireless networks) combines member authentication procedure with group key management protocol to provide an efficient group re-keying process. One-time password is proposed for member authentication and CKC (Code for Key Calculation) is sug…
Recently, Li et al. analyzed Lee et al.'s multi-server authentication scheme and proposed a novel smart card and dynamic ID based remote user authentication scheme for multi-server environments. They claimed that their scheme can resist several kinds of attacks. However, through careful analysis, we find that Li et al.'s scheme is vulnerable to stolen smart card and offline dictionary attack, replay attack, impersonation attack and server spoofing attack. By analyzing other similar schemes, we find that the certain type of dynamic ID based multi-server authentication scheme in which only hash …
With the rapid development of vehicular ad hoc Network (VANET), it is gaining significant popularity and receiving increasing attentions from academics and industry in security and efficiency. To address security and efficiency issues, a self-authentication and deniable efficient group key agreement protocol is proposed in this paper. This scheme establishes a group between road-side unit (RSU) and vehicles by using self-authentication without certification authority, and enhances certification efficiency by using group key (GK) transmission method. At the same time, to avoid the attacker to a…
In this paper, we propose a very secure and reliable owner-self-managed private key recovery method. In recent years, Public Key Authentication (PKA) method has been identified as the most feasible online security solution. However, losing the private key also implies the risk of losing the ownership of the assets associated with the private key. For key protection, the commonly adopted something-you-x solutions require a new secret to protect the target secret and fall into a circular protection issue as the new secret has to be protected too. To resolve the circular protection issue and prov…
We propose the use of PAKE for achieving and enhancing entity authentication (EA) and key management (KM) in the context of decentralized end-to-end encrypted email and secure messaging, i.e., where neither a public key infrastructure nor trusted third parties are used. This approach not only simplifies the EA process by requiring users to share only a low-entropy secret, e.g., a memorable word, but it also allows us to establish a high-entropy secret key; this key enables a series of cryptographic enhancements and security properties, which are hard to achieve using out-of-band (OOB) authenti…
Peripheral authentication is an important aspect in the vehicle networks to provide services to only authenticated peripherals and a security to internal vehicle modules such as anti-lock braking system, power-train control module, engine control unit, transmission control unit, and tire pressure monitoring. In this paper a three-way handshake scheme is proposed for a vehicle to a keyfob authentication. A keyfob is a key with a secure hardware that communicates and authenticates the vehicle over the wireless channel. Conventionally, a vehicle to keyfob authentication is realized through a chal…
Application authentication is typically performed using some form of secret credentials such as cryptographic keys, passwords, or API keys. Since clients are responsible for securely storing and managing the keys, this approach is vulnerable to attacks on clients. Similarly a centrally managed key store is also susceptible to various attacks and if compromised, can leak credentials. To resolve such issues, we propose an application authentication, where we rely on unique and distinguishable application's behavior to lock the key during a setup phase and unlock it for authentication. Our system…
To send encrypted emails, users typically need to create and exchange keys which later should be manually authenticated, for instance, by comparing long strings of characters. These tasks are cumbersome for the average user. To make more accessible the use of encrypted email, a secure email application named pEp automates the key management operations; pEp still requires the users to carry out the verification, however, the authentication process is simple: users have to compare familiar words instead of strings of random characters, then the application shows the users what level of trust the…
This paper modifies Kak's three-stage protocol so that it can guarantee secure transmission of information. Although avoiding man-in-the-middle attack is our primary objective in the introduction of classical authentication inside the three-stage protocol, we also benefit from the inherent advantages of the chosen classical authentication protocol. We have tried to implement ideas like key distribution center, session key, time-stamp, and nonce, within the quantum cryptography protocol.
We introduce LOCATHE (Location-Enhanced Authenticated Key Exchange), a generic protocol that pools location, user attributes, access policy and desired services into a multi-factor authentication, allowing two peers to establish a secure, encrypted session and perform mutual authentication with pre-shared keys, passwords and other authentication factors. LOCATHE contributes to: (1) forward secrecy through ephemeral session keys; (2) security through zero-knowledge password proofs (ZKPP), such that no passwords can be learned from the exchange; (3) the ability to use not only location, but also…
Authentication and Key Agreement (AKA) is a type of security protocol, used in 3GPP mobile networks, that provides two security capabilities. The first capability, called authentication, is to cryptographically assert that a mobile phone or a network is indeed who it claims to be, and the second capability, called key agreement, is to put necessary cryptographic keys in place for protection of traffic between the mobile phone and the network. Jointly, these two capabilities lay the foundation of secure 3GPP mobile networks. From 2G-5G, there are eight main versions of AKA, details of which are…
The Telecare medicine information system (TMIS) is developed to provide Telecare services to the remote user. A user can access remote medical servers using internet without moving from his place. Although remote user and server exchange their messages/data via public networks. An adversary is considered to be enough powerful that he may have full control over the public network. This makes these Telecare services vulnerable to attacks. To ensure secure communication between the user and server many password based authentication schemes have been proposed. In 2013, Hao et al. presented chaotic…
Our high expectations from Internet of Things (IoT) and how it will positively influence our lifestyles depend on a secure and trusted implementation of it, especially in the sensitive sectors such as health or financial. IoT platforms and solutions must provide Confidentiality, Integrity and Availability (CIA) in a secure and transparent way. Due to the extremely large scales of IoT, traditional centralized solutions for security provisioning cannot be employed in their original form. This article discusses the authentication problem in IoT, which is fundamental to providing CIA. We propose a…
With the rapid advancement of wireless network technology, usage of WSN in real time applications like military, forest monitoring etc. found increasing. Generally WSN operate in an unattended environment and handles critical data. Authenticating the user trying to access the sensor memory is one of the critical requirements. Many researchers have proposed remote user authentication schemes focusing on various parameters. In 2013, Li et al. proposed a temporal-credential-based mutual authentication and key agreement scheme for WSNs. Li et al. claimed that their scheme is secure against all maj…
Privacy preserving RFID (Radio Frequency Identification) authentication has been an active research area in recent years. Both forward security and backward security are required to maintain the privacy of a tag, i.e., exposure of a tag's secret key should not reveal the past or future secret keys of the tag. We envisage the need for a formal model for backward security for RFID protocol designs in shared key settings, since the RFID tags are too resource-constrained to support public key settings. However, there has not been much research on backward security for shared key environment since …
The Session Initiation Protocol (SIP) has become the most predominant protocol for Voice over Internet Protocol (VoIP) signaling. Security of SIP is an important consideration for VoIP communication as the traffic is transmitted over the insecure IP network. And the authentication process in SIP ranges from pre-shared secret based solutions to Public Key Infrastructure (PKI) based solution. However, due to the limitations in PKI based solutions, some PKI less authentications mechanisms are proposed. This paper aims to present an overview of different authentication methods used in or together …
The Internet of Vehicles (IoV) can significantly improve transportation efficiency and ensure traffic safety. Authentication is regarded as the fundamental defense line against attacks in IoV. However, the state-of-the-art approaches suffer from several drawbacks, including bottlenecks of the single cloud server model, high computational overhead of operations, excessive trust in cloud servers and roadside units (RSUs), and leakage of vehicle trajectory privacy. In this paper, BEPHAP, a Blockchain-based Efficient Privacy-preserving Handover Authentication Protocol with key agreement for intern…
Authcoin is an alternative approach to the commonly used public key infrastructures such as central authorities and the PGP web of trust. It combines a challenge response-based validation and authentication process for domains, certificates, email accounts and public keys with the advantages of a block chain-based storage system. As a result, Authcoin does not suffer from the downsides of existing solutions and is much more resilient to sybil attacks.
Authentication schemes are practised globally to verify the legitimacy of users and servers for the exchange of data in different facilities. Generally, the server verifies a user to provide resources for different purposes. But due to the large network system, the authentication process has become complex and therefore, time-to-time different authentication protocols have been proposed for the multi-server architecture. However, most of the protocols are vulnerable to various security attacks and their performance is not efficient. In this paper, we propose a secure and energy-efficient remot…
Public key authentication (PKA) has been deployed in various services to provide stronger authentication to users. In PKA, a user manages private keys on her devices called authenticators, and services bind the corresponding public keys to her account. To protect private keys, a user uses authenticators which never export private keys outside. On the other hand, a user regularly uses multiple authenticators like PCs and smartphones. She replaces some of her authenticators according to their lifecycle, such as purchasing new devices and losing devices. It is a burden for a user to register, upd…
Context-based authentication is a method for transparently validating another device's legitimacy to join a network based on location. Devices can pair with one another by continuously harvesting environmental noise to generate a random key with no user involvement. However, there are gaps in our understanding of the theoretical limitations of environmental noise harvesting, making it difficult for researchers to build efficient algorithms for sampling environmental noise and distilling keys from that noise. This work explores the information-theoretic capacity of context-based authentication …
Many users would prefer the privacy of end-to-end encryption in their online communications if it can be done without significant inconvenience. However, because existing key distribution methods cannot be fully trusted enough for automatic use, key management has remained a user problem. We propose a fundamentally new approach to the key distribution problem by empowering end-users with the capacity to independently verify the authenticity of public keys using an additional media attestment. This permits client software to automatically lookup public keys from a keyserver without trusting the…
The usage of different technologies and smart devices helps people to get medical services remotely for multiple benefits. Thus, critical and sensitive data is exchanged between a user and a doctor. When health data is transmitted over a common channel, it becomes essential to preserve various privacy and security properties in the system. Further, the number of users for remote services is increasing day-by-day exponentially, and thus, it is not adequate to deal with all users using the one server due to the verification overhead, server failure, and scalability issues. Thus, researchers prop…
This paper proposes a PKINIT_AS Kerberos V5 authentication system to use public key cryptography and a method to implement the gssapi_krb authentication method and secured Internet service using it in IPSec VPN
The widespread use of wireless sensor networks (WSNs) that are consisted of resource-constrained sensor nodes in communication with gateways in open-space environments and industries has highlighted the need for a secure yet fast communication protocol between users, gateways, and sensor nodes. Due to the properties of the network, elliptic-curve cryptography seems to be the most viable choice as it requires fewer resources than most other options. In this paper, we analyze the protocol suggested by Moghadam et al. which is based on ECDH (elliptic-curve Diffie-Hellman), and mention some of the…
It is a challenging task to deploy lightweight security protocols in resource-constrained IoT applications. A hardware-oriented lightweight authentication protocol based on device signature generated during voltage over-scaling (VOS) was recently proposed to address this issue. VOS-based authentication employs the computation unit such as adders to generate the process variation dependent error which is combined with secret keys to create a two-factor authentication protocol. In this paper, machine learning (ML)-based modeling attacks to break such authentication is presented. We also propose …
Number theoretic public-key solutions, currently used in many applications worldwide, will be subject to various quantum attacks, making them less attractive for longer-term use. Certain group theoretic constructs are now showing promise in providing quantum-resistant cryptographic primitives, and may provide suitable alternatives for those looking to address known quantum attacks. In this paper, we introduce a new protocol called a Meta Key Agreement and Authentication Protocol (MKAAP) that has some characteristics of a public-key solution and some of a shared-key solution. Specifically it ha…
Traditional password based authentication schemes are mostly considered in single server environments. They are unfitted for the multi-server environments from two aspects. On the one hand, users need to register in each server and to store large sets of data, including identities and passwords. On the other hand, servers are required to store a verification table containing user identities and passwords. Recently, On the base on Sood et al.'s protocol(2011), Li et al. proposed an improved dynamic identity based authentication and key agreement protocol for multi-server architecture(2012). Li …
Preservation of information and computer security is broadly dependent on the secured authentication system which is underpinned by password. Text based password is a commonly used and available system for authentication. But it bears many limitations like shoulder surfing, dictionary attack, Phishing, guessing the password etc. In order to overwhelm these vulnerabilities of ancient textual password, many graphical or image based password authentication system has been introduced form last few years. But none of this graphical system is considered as enough adventurous to keep pace with these …
Secure Shell (SSH) protocol requires all implementations to support public key authentication method ("publickey") for authentication purposes, so web applications which provide a SSH client over the web browser need to support "publickey". However, restrictions in Hypertext Transfer Protocol (HTTP), such as same origin policy, and limited access to local resources, make it difficult to perform such authentications. In this document, a system to perform "publickey" authentication over HTTP is provided. It is ensured that no compromise is made that would pose a security risk to SSH protocol.
Passwords are a fragile, inadequate, and insecure tool for authenticating users, and are especially fraught with problems when used to secure access to network resources and services. In many cases, passwords provide a false sense of security. Creating passwords which are both secure (i.e., hard for attackers to guess) and easy for humans to remember is, at best, a paradoxical task because these two criteria are diametrically opposed. Fortunately, a far more secure and user-friendly alternative is available. Public-key cryptography provides a means of both identifying and authenticating users …
RFID tags are heavily constrained in computational and storage capabilities, and raise numerous privacy concerns in everyday life due to their vulnerability to different attacks. Both forward security and backward security are required to maintain the privacy of a tag i.e., exposure of a tag's secret key should not reveal the past or future secret keys of the tag. We envisage the need for a formal model for backward security for RFID protocol designs in shared key settings, since the RFID tags are too resource-constrained to support public key settings. However, there has not been much researc…
In an open network environment, privacy of group communication and integrity of the communication data are the two major issues related to secured information exchange. The required level of security may be achieved by authenticating a group key in the communication channel, where contribution from each group member becomes a part of the overall group key. In the current work, we have developed an authentication system through Central Administrative Server (CAS) for automatic integration and validation of the group key. For secured group communication, the CAS generates a secret alphanumeric g…
Authentication is the first step toward establishing a service provider and customer (C-P) association. In a mobile network environment, a lightweight and secure authentication protocol is one of the most significant factors to enhance the degree of service persistence. This work presents a secure and lightweight keying and authentication protocol suite termed TAP (Time-Assisted Authentication Protocol). TAP improves the security of protocols with the assistance of time-based encryption keys and scales down the authentication complexity by issuing a re-authentication ticket. While moving acros…
Information-theoretically secure (ITS) authentication is needed in Quantum Key Distribution (QKD). In this paper, we study security of an ITS authentication scheme proposed by Wegman & Carter, in the case of partially known authentication key. This scheme uses a new authentication key in each authentication attempt, to select a hash function from an Almost Strongly Universal$_2$ hash function family. The partial knowledge of the attacker is measured as the trace distance between the authentication key distribution and the uniform distribution; this is the usual measure in QKD. We provide direc…
We investigate quantum authentication schemes constructed from quantum error-correcting codes. We show that if the code has a property called purity testing, then the resulting authentication scheme guarantees the integrity of ciphertexts, not just plaintexts. On top of that, if the code is strong purity testing, the authentication scheme also allows the encryption key to be recycled, partially even if the authentication rejects. Such a strong notion of authentication is useful in a setting where multiple ciphertexts can be present simultaneously, such as in interactive or delegated quantum co…
We present a computational security analysis of the Authentication and Key Agreement (AKA) protocols for both Long-Term Evolution (LTE) and Universal Mobile Telecommunications System (UMTS). This work constitutes the first security analysis of LTE AKA to date and the first computationally sound analysis of UMTS AKA. Our work is the first formal analysis to consider messages that are sent in the core network, where we take into account details of the carrying protocol (i.e., MAP or Diameter) and of the mechanism for secure transport (i.e., MAPsec/TCAPsec or IPsec ESP). Moreover, we report on a …
Unlike current closed systems such as 2nd and 3rd generations where the core network is controlled by a sole network operator, multiple network operators will coexist and manage the core network in Next Generation Networks (NGNs). This open architecture and the collaboration between different network operators will support ubiquitous connectivity and thus enhances users' experience. However, this brings to the fore certain security issues which must be addressed, the most important of which is the initial Authentication and Key Agreement (AKA) to identify and authorize mobile nodes on these va…
