Secure password storage is a vital aspect in systems based on password authentication, which is still the most widely used authentication technique, despite some security flaws. In this paper, we propose a password authentication framework that is designed for secure password storage and could be easily integrated into existing authentication systems. In our framework, first, the received plain password from a client is hashed through a cryptographic hash function (e.g., SHA-256). Then, the hashed password is converted into a negative password. Finally, the negative password is encrypted into an encrypted negative password (ENP) using a symmetric-key algorithm (e.g., AES), and multi-iteration encryption could be employed to further improve security. The cryptographic hash function and symmetric encryption make it difficult to crack passwords from ENPs. Moreover, there are lots of corresponding ENPs for a given plain password, which makes precomputation attacks (e.g., lookup table attack and rainbow table attack) infeasible. The algorithm complexity analyses and comparisons show that the ENP could resist lookup table attack and provide stronger password protection under dictionary attack. It is worth mentioning that the ENP does not introduce extra elements (e.g., salt); besides this, the ENP could still resist precomputation attacks. Most importantly, the ENP is the first password protection scheme that combines the cryptographic hash function, the negative password, and the symmetric-key algorithm, without the need for additional information except the plain password.

Authentication by Encrypted Negative Password

Attacks and defenses in user authentication systems: A survey

Security of data is the most important concern on the network. When information is transmitted over the network, various attacks are launched by attacker on the information being sent by the source. In the present era, as per Insurance Regulatory and Development Authority all financial transaction involving payment of premiums towards renewal of the Customer's Insurance Policies are widely preferred on electronic commerce site. In this paper, a Policy Premium Payment application has been designed and developed in java for the purpose of secure financial transaction over the internet. This application is deployed on cloud. The web application is secure for the transaction. Google App engine which, a google cloud is used for the deployment of the financial transaction application. In this paper, various network attacks such as Brute force attack and Dictionary attack have been discussed and demonstrated.

SOAiCE: Simulation of Attacks in Cloud Computing Environment

This paper attempts to introduce the enhanced SHA-1 algorithm which features a simple quadratic function that will control the selection of primitive function and constant used per round of SHA-1. The message digest for this enhancement is designed for 512 hashed value that will answer the possible occurrence of hash collisions. Moreover, this features the architecture of 8 registers of A, B, C, D, E, F, G, and H which consists of 64 bits out of the total 512 bits. The testing of frequency for Q 15 and Q 0 will prove that the selection of primitive function and the constant used are not equally distributed. Implementation of extended bits for hash message will provide additional resources for dictionary attacks and the extension of its hash outputs will provide an extended time for providing a permutation of 512 hash bits.

Enhanced Secure Hash Algorithm-512 based on Quadratic Function

Internet security is getting worse day by day and it has become a major area of concern, as many types of hacking methods are practiced increasingly and new hacking techniques are being introduced. Hence cyber security is prioritized the most in many of the organizations. Hacking is illegal use of computer and network resources which enables to manipulate the normal behavior of systems connected to the network. Basically, a hacker is a skilled programmer who is clever enough to break into someone else's device and access the confidential data. The main purpose of this survey is to throw light on the concept of frequently occurring hacking techniques and its prevention for the betterment of the cyber security.

Survey of hacking techniques and it's prevention

Most websites use passwords for authenticating user identity and for allowing access to website resources that may contain sensitive information. A large number of people use dictionary words for creating passwords. These user passwords are subjected to one-way hash functions and are stored inside the database as corresponding hash values instead of plaintext. A potential hacker can use brute-force, rainbow table or dictionary attacks to get the input password from the hash values and the most reported real life hacks were done by cracking password hashes using dictionary attack. Currently, users are allowed to register in websites only with passwords that obey the security policies. It is noted that, even though passwords with certain patterns are accepted as strong by the existing policies, they are vulnerable for a dictionary attack based on those patterns. This paper proposes a novel method for ensuring security for passwords against such dictionary attacks. This method, checks strength of the user passwords using a dictionary which is stored as a character tree. This system helps to create strong password hashes that are resistant to dictionary attacks. This approach thus offers advanced and superior protection for passwords from cracking attempts.

C A Nisha

Papers

Securing passwords from dictionary attack with character-tree