Since Power Analysis on smart cards was introduced by Paul Kocher [7], many countermeasures have been proposed to protect implementations of cryptographic algorithms In this paper we propose a new protection principle: the transformed masking method We apply this method to protect two of the most popular block ciphers: DES and the AES Rijndael To this end we introduce some transformed S-boxes for DES and a new masking method and its applications to the non-linear part of Rijndael

/pdf/an-implementation-of-des-and-aes-secure-against-some-attacks-37bogqbiyt.pdf

An Implementation of DES and AES, Secure against Some Attacks

A protocol for establishing the authenticity of a client to a server in an electronic transaction by encrypting a certificate with a key known only to the client and the server. The trust of the server, if necessary, can be established by a public key protocol. The client generates and sends over a communications channel a message containing at least a part of a certificate encrypted with the server's public key or a secret session key. The server receives and processes the message to recover at least part of the certificate, verifies and accepts it as proof of the client's authenticity.

Client/server protocol for proving authenticity

A system and method for defining a platform-independent policy framework for authentication of principals to servers in another realm, within a distributed data processing system. The present invention may be implemented on top of the Kerberos protocol, or any trusted third party network authentication protocol with inter-realm authentication mechanisms.

System and method for policy-based inter-realm authentication within a distributed processing system

A time-based method for generating an authentication code associated with an entity uses an authentication code generated from a secret, a dynamic, time-varying variable, and the number of previous authentication code generations within the particular time interval. Other information such as a personal identification number (PIN) and a verifier identifier can also be combined into the authentication code.

Method and apparatus for performing enhanced time-based authentication

In one embodiment of a user authentication system and method according to the invention, a device shares a secret, referred to as a master seed, with a server. The device and the server both derive one or more secrets, referred to as verifier seeds, from the master seed, using a key derivation function. The server shares a verifier seed with one or more verifiers. The device, or an entity using the device, can authenticate with one of the verifiers using the appropriate verifier seed. In this way, the device and the verifier can share a secret, the verifier seed for that verifier, without that verifier knowing the master seed, or any other verifier seeds. Thus, the device need only store the one master seed, have access to the information necessary to correctly derive the appropriate seed, and have seed derivation capability. A verifier cannot compromise the master seed, because the verifier does not have access to the master seed.

System and method for authentication seed distribution

The data encryption standard

A data communication system in which messages sent between a central processor (10) and message source units (14) are enciphered under session keys. Session keys are changed for each exchange of messages and the method described ensures that a source unit and a central processor are using the same key and that the updating of session keys is done without the updated key being transmitted through the communication medium.

Security in data communication systems

The invention presented describes the protection of transaction data in cash-free payment traffic from its creation to its processing by means of stock-exchange chip cards ( 4 ). In each payment transfer, transaction data TDi ( 10 ) is created on the individual payment procedure, and cumulative data SD ( 81 ) on the payment transactions since the last data exchange with the settlement position are summarized. The transaction data TDi is stored in the payment terminal. The cumulative data SD is stored in the security module. In each payment transaction, the cumulative data is supplemented by the new amount. The cumulative data is stored using a cumulative signature Ssn ( 82 ) which is applied to each supplement to the cumulative data. In this, the value of the previous cumulative signature is used as an initial value for the formation of the new cumulative signature. The key of the payment terminal or a separate individual key can be used. The cumulative signature is also stored in the security module. To settle using the settlement position, the cumulative data, the cumulative signature and the transaction data are sent to the settlement position by means of a transaction file ( 12 ).

Protection of transaction data

A method and apparatus for testing the validity of personal identification numbers (PIN) entered at a transaction terminal of an electronic funds transfer network in which the PIN is not transmitted through the network. The PIN and the personal account number (PAN) are used to derive an authorisation parameter (DAP). A unique message is sent with the PAN to the host processor where the PAN is used to identify a valid authorisation parameter (VAP). The VAP is used to encode the unique message and the result (a message authentication code MAC) transmitted back to the transaction terminal. The terminal generates a parallel message authentication code by using the DAP to encode the unique message. The two MAC's are compared and the result of the comparison used to determine the validity of the PIN.

Testing the validity of identification codes

A capability progress modelling component for determining the progress of adoption of an on-demand capabilities model by an organization, the deployment progress component comprising: a completion state descriptor component for receiving inputs from an entity describing a current state, a target state and a modelled state for the organization; and a state comparator component for comparing the current state and modelled state with the target status to derive a set of parameters, the state comparator component analyzing the set of parameters to determine deviation points indicating capability areas requiring attention in order for the organization to progress to an on-demand capabilities model.

Chris Holloway

Papers

The data encryption standard

Security in data communication systems

Protection of transaction data

Testing the validity of identification codes

Capability progress modelling component