Secure bootstrapping is the process by which a device gets the necessary configuration information and security credentials to become operational. In many pervasive computing and Internet-of-Things scenarios, it is often not possible to rely on the existence of a trusted third party or other network infrastructure for bootstrapping. Therefore, several device bootstrapping protocols rely on an out-of-band (OOB) channel for initial device authentication and configuration. We begin this paper by understanding the need for OOB channels and performing a literature survey of existing standards and devices that rely on OOB channels. We then look at one candidate bootstrapping protocol: Nimble out-of-band authentication for EAP (EAP-NOOB). We provide a brief overview of the EAP-NOOB protocol and describe its unique OOB channel requirements. Thereafter, we implement three OOB channels for EAP-NOOB using near-field communication, quick response codes, and sound. Using our implementation, we evaluate the usability, security, benefits, and limitations of each of the OOB channels.

/pdf/evaluation-of-out-of-band-channels-for-iot-security-3wq0u6l8au.pdf

Evaluation of Out-of-Band Channels for IoT Security

Online Authentication Methods Used in Banks and Attacks Against These Methods

we introduce a password strength metric using Enhanced Fuzzy K-Means clustering algorithm (EFKM henceforth). The EFKM is trained on the OWASP list of 10002 weak passwords. After that, the optimized centroids are maximized to develop a password strength metric. The resulting meter was validated by contrasting with three entropy-based metrics using two datasets: the training dataset (OWASP) and a dataset that we collected from github website that contains 5189451 leaked passwords. Our metric is able to recognize all the passwords from the OWASP as weak passwords only. Regarding the leaked passwords, the metric recognizes almost the entire set as weak passwords. We found that the results of the EFKM-based metric and the entropy-based meters are consistent. Hence the EFKM metric demonstrates its validity as an efficient password strength checker.

https://www.ijcnis.org/index.php/ijcnis/article/download/4795/418

Introducing a Machine Learning Password Metric Based on EFKM Clustering Algorithm

The world is vastly becoming a completely digital one with most transactions
carried out over the internet. This has exposed the internet to increasing threats and attacks and
has necessitated the need for an internet-based authentication and authorization services. One
Time Passwords (OTP) have been introduced to overcome the limitations of static passwords.
However, research has shown that OTP are not completely free from middle man attacks. This
paper presents a (3, 3) Visual Cryptographic Scheme (VCS) technique for OTP security. The
technique secures the generated OTP image by dividing it into three shares, of which one of the
shares will be sent to the user while the remaining shares will be stored at different locations on
the server. Before the original OTP image will be recovered, all the shares must the retrieved
and stacked together. To avoid pixel expansion problem and loss of image quality that have
characterized existing VCS technique, progressive visual cryptography was adopted to decrypt
the retrieved OTP shares. A high quality OTP image was recovered as revealed by the peak
signal to noise ratio values and there was no change in size of the OTP images.
Keywords: Data Security, Information Security, One Time Password, Visual
Cryptography Scheme, Progressive Visual Cryptography

A Secured One Time Password Authentication Technique using (3, 3) Visual Cryptography Scheme

During the Covid-19 pandemic, almost all jobs and activities to be limited, relying on the internet network Data security in an internet network is most important and needs to be a concern for internet users The internet network is a public network, which is vulnerable to security attacks Attacks may occur to retrieve user data in the form of a username and password This study conducts system design to improve the security of the username and password data when logging into web applications Login using One-Time Password (OTP) verification by implementing the AES algorithm and Blowfish to encrypt the verification code The verification code uses an SMS gateway Testing is done by looking at security performances and comparing the performance of the Blowfish and AES algorithm The results of the design research show that OTP is running well where the AES algorithm performance has advantages in terms of encryption and decryption speed compared to the Blowfish algorithm with a difference of ± 0 015 milliseconds for encryption and ± 0 04 milliseconds for decryption © Published under licence by IOP Publishing Ltd

Login Security Using One Time Password (OTP) Application with Encryption Algorithm Performance

Authentication and cryptography have been used to address security issues on various online services. However, researchers discovered that even the most commonly used multi-factor out-of-band authentication mechanism was vulnerable to attacks and traditional crypto-algorithms were characterized to have some drawbacks making it crucial to choose desirable algorithms for a particular purpose. This study introduces an innovative modification of the Blowfish algorithm designed to capitalize on its strengths but supports 128-bits block size text input using dynamic selection encryption method and reduction of cipher function execution through randomly determined rounds. Experimentation results on 128-bit input text revealed significant performance improvements with utmost 5.91 % in terms of avalanche effect, 38.97 % for integrity, and 41.02 % in terms of execution time. Results also showed that the modification introduced extra security layer, thus, displaying higher complexity and stronger diffusion at faster execution time making it more difficult and complex for an unauthorized individual to decipher the information and desirable to be used for applications with multiple users respectively. This is a good contribution to the continuous developments in the field of information security particularly in cryptography and towards providing a secure OTP for multifactor out-of-band authentication.

https://www.ijcnis.org/index.php/ijcnis/article/download/3188/283

Securing One Time Password (OTP) for Multi-Factor Out-of-Band Authentication through a 128-bit Blowfish Algorithm

Validation of user’s authenticity through authentication played a crucial role to address risks and security issues in today's connected world. Among different authentication methods, OTP sent via SMS was identified as the most commonly used multi-factor authentication mechanism. However, studies have shown that it has not remained attack-proof. It has been branded to be vulnerable to SMiShing, a technique comparable to Internet phishing, and Eavesdropping accomplished through keylogging, screens capturing, shoulder surfing and other social engineering practices. This study introduced an innovative approach to secure SMS-based OTP against its threats through OTP encryption using modified Blowfish algorithm. A mobile application was also employed for capturing and processing encrypted SMS-based OTP to produce new OTP for verification, thus performing end-to-end OTP. Experimentation results and analysis revealed that the proposed architecture was free against the said vulnerabilities and promote tighter security, making it a good alternative for SMS-based OTP multi-factor authentication.

Ariel Roy L. Reyes

Papers

Securing One Time Password (OTP) for Multi-Factor Out-of-Band Authentication through a 128-bit Blowfish Algorithm

Enhanced Multi-factor Out-of-Band Authentication En Route to Securing SMS-based OTP Ariel