Much has been written about theory and practice in the law, and the tension between practitioners and theorists. Judges do not cite theoretical articles often; they rarely "apply" theories to particular cases. These arguments are not revisited. Instead the Essay explores the working and interaction of theory and practice, practitioners and theorists. The Essay starts with a story about solving a legal issue using our intellectual tools - theory, practice, and their progenies: experience and "gut." Next the Essay elaborates on the nature of theory, practice, experience and "gut." The third part of the Essay discusses theories that are helpful to practitioners and those that are less helpful. The Essay concludes that practitioners theorize, and theorists practice. They use these intellectual tools differently because the goals and orientations of theorists and practitioners, and the constraints under which they act, differ. Theory, practice, experience and "gut" help us think, remember, decide and create. They complement each other like the two sides of the same coin: distinct but inseparable.

Of Theory and Practice

The Universal Serial Bus (USB) is an extremely popular interface standard for computer peripheral connections and is widely used in consumer Mass Storage Devices (MSDs). While current consumer USB MSDs provide relatively high transmission speed and are convenient to carry, the use of USB MSDs has been prohibited in many commercial and everyday environments primarily due to security concerns. Security protocols have been previously proposed and a recent approach for the USB MSDs is to utilize multi-factor authentication. This paper proposes significant enhancements to the three-factor control protocol that now makes it secure under many types of attacks including the password guessing attack, the denial-of-service attack, and the replay attack. The proposed solution is presented with a rigorous security analysis and practical computational cost analysis to demonstrate the usefulness of this new security protocol for consumer USB MSDs.

/pdf/enhanced-three-factor-security-protocol-for-consumer-usb-1iscxmbwsz.pdf

Enhanced three-factor security protocol for consumer USB mass storage devices

This study proposes a three-factor control protocol for universal serial bus (USB) on an elliptic curve cryptosystem (ECC). USB is a universal interface used in an enormous number of devices. It has become the most popular interface standard for computer connections. However, since USB provides high transmission speed and is very convenient to carry, many workplace and commercial establishments have prohibited their employees from using USB devices. This precaution is an important way to prevent confidential data leaks via USB devices, as USB connections lack security management. Therefore the authors use a three-factor control protocol to ensure the security of USB connections. The proposed authentication protocol combines biometric, password and smart card to provide high security on the USB mutual authentication. To provide secure and efficient transmission between the user and the USB server, the proposed protocol adopts ECC to encrypt data. Compared to other encryption methods, the proposed protocol uses much smaller key sizes. As a further benefit, this protocol reduces the smart card computational cost and provides an efficient transmission for USB devices. This new scheme improves the security, efficiency and usability of the authentication process. More studies on USB are needed.

https://ietresearch.onlinelibrary.wiley.com/doi/pdf/10.1049/iet-cdt.2012.0073

Three-factor control protocol based on elliptic curve cryptosystem for universal serial bus mass storage devices

Blockchain can potentially be deployed in a wide range of applications due to its capability to ensure decentralization, transparency, and immutability. In this paper, we design a cryptographic membership authentication scheme (i.e., authenticating graph data) to support blockchain-based identity management systems (BIMS). Such a system is designed to bind a digital identity object to its real-world entity. Specifically, we introduce a new transitively closed undirected graph authentication (TCUGA) scheme, which only needs to use node signatures (e.g., certificates for identifying nodes). The trapdoor hash function used in our scheme allows the signer to efficiently update the certificates without the need to re-sign the nodes. In other words, our scheme is efficient even though the graph dynamically adds or deletes vertices and edges. Moreover, our proposal can efficiently provide a proof when the edge between two vertices does not exist, thus solving the existing intractability issue in transitive signature (the main tool for authenticating graph data). Finally, we prove the security of our proposed TCUGA in the standard model and evaluate its performance to show its feasibility for BIMS.

A New Transitively Closed Undirected Graph Authentication Scheme for Blockchain-Based Identity Management Systems

A novel encryption scheme based on complex chaotic networks is proposed in this paper. Compared with a single chaotic system, a network of chaotic systems possesses complex dynamic characteristics, which can be used in encryption to enhance security. We adopt the drive-response synchronization method to synchronize two identical chaotic networks at the transmitter and receiver. Analysis on encryption security shows that key space is enlarged exponentially with respect to the number of nodes in the drive network, and also shows that the encryption system is highly sensitive to parameter mismatch. The proposed scheme is competent in carrying out encryption tasks of large data. Both theoretical and numerical results demonstrate that the proposed scheme is feasible for implementation in image and data encryption.

An Encryption Scheme Based on Synchronization of Two-Layered Complex Dynamical Networks

The Universal Serial Bus (USB) has become the most popular interface standard for hardware connection, and there has been an explosion in the number of USB peripheral devices. External USB storage devices, in particular, are finding widespread application. Unfortunately, because USB affords high transmission speeds and is extremely convenient, many workplaces and businesses have prohibited the use of USB devices to prevent confidential data from being extracted from computer systems via USB ports. However, this compromises the convenience of the USB connection and demonstrates a lack of flexibility in management. Therefore, finding a way to take the considerations of both convenience and management into account has become a significant issue. This study proposes a secure control protocol which provides mutual authentication and key agreement between client and server to solve this problem.

http://ir.lib.cyut.edu.tw:8080/bitstream/310901800/11920/1/J-15-A+secure+control+protocol+for+USB+mass+storage+devices.pdf

A secure control protocol for USB mass storage devices

By appending some bits to the original signature, a trapdoor hash function converts any signature scheme into secure signature scheme with very efficient online computation. Many of them have been proposed. However, all of them require performing a modular reduction during the online phase. The paper presents a trapdoor hash function to get rid of the modular reduction in online computation.

/pdf/improvement-on-a-trapdoor-hash-function-1gsutm4zqh.pdf

Improvement on a Trapdoor Hash Function

Strong designated verifier signature scheme could make it possible for a signer to convince only the designated verifier that the signature is made by the signer. In 2007, Lee et al. proposed a designated verifier signature scheme with message recovery, attaching target message with signature, to prevent any attack by eavesdropping. In this paper, we propose an efficient strong designated verifier signature scheme, using key distribution mechanism where both sender and designated receiver share encryption/decryption key to fulfill encryption/decryption algorithm with low cost of communication and computation: 30% and 50% of Lee et al. scheme, respectively. We would prove its security based on public problem-Gap Diffie-Hellman (GDH) assumption.

A Provably Secure and Efficient Strong Designated Verifier Signature Scheme

Researchers have proposed an effective RSA multisignature scheme based on Shamir’s identity-based signature (IBS) scheme. Despite being a multisignature, the proposed scheme’s signature length is comparable to Shamir’s IBS scheme. Also, only one/two extra increments of l-1 modular multiplications are added to the verification/signature time, whereby l represents the number of signers. This greatly reduced the computational load and communication costs compared to the previously proposed multisignature schemes. However, this study discovers security loopholes in the previous schemes. This study analyzes and highlights the loopholes’ origins, and it proposes improvements to the original schemes, preserves the scheme’s merits and enhances their security. The resultant protocol is thus suitable for wireless communications because it not only possesses security but also saves computation resources and communication bandwidth.

http://ir.lib.cyut.edu.tw:8080/bitstream/310901800/16027/2/J-25-Improving%20an%20efficient%20ID-based%20RSA%20multisignature.pdf

Improving an efficient ID-based RSA multisignature

Recently, the authentication schemes based on password have been used widely in network environment. It provides a convenient way for users to authenticate him/her to servers. Previously, Xu et al. proposed an improved smart card based password authentication scheme with provable security. Unfortunately, Song pointed out their scheme cannot withstand impersonation attacks. Moreover, Song proposed two improved schemes to solve it, but his first scheme still cannot withstand impersonation attack. This paper in addition to analyze the weakness of Song's scheme, improved scheme preserving identity privacy also proposes.

Fuw-Yi Yang

Papers

A secure control protocol for USB mass storage devices

Improvement on a Trapdoor Hash Function

A Provably Secure and Efficient Strong Designated Verifier Signature Scheme

Improving an efficient ID-based RSA multisignature

Password Authentication Scheme Preserving Identity Privacy