We describe a simple and novel cryptographic construction that we call a fuzzy vault. Alice may place a secret value /spl kappa/ in a fuzzy vault and "lock" it using an unordered set A of elements from some public universe U. If Bob tries to "unlock" the vault using an unordered set B, he obtains /spl kappa/ only if B is close to A, i.e., only if A and B overlap substantially.

A fuzzy vault scheme

Password-based protocols for authenticated key exchange (AKE) are designed to work despite the use of passwords drawn from a space so small that an adversary might well enumerate, off line, all possible passwords. While several such protocols have been suggested, the underlying theory has been lagging. We begin by defining a model for this problem, one rich enough to deal with password guessing, forward secrecy, server compromise, and loss of session keys. The one model can be used to define various goals. We take AKE (with "implicit" authentication) as the "basic" goal, and we give definitions for it, and for entity-authentication goals as well. Then we prove correctness for the idea at the center of the Encrypted Key-Exchange (EKE) protocol of Bellovin and Merritt: we prove security, in an ideal-cipher model, of the two-flow protocol at the core of EKE.

/pdf/authenticated-key-exchange-secure-against-dictionary-attacks-3e7gjz9v6y.pdf

Authenticated key exchange secure against dictionary attacks

We introduce HAIL (High-Availability and Integrity Layer), a distributed cryptographic system that allows a set of servers to prove to a client that a stored file is intact and retrievable. HAIL strengthens, formally unifies, and streamlines distinct approaches from the cryptographic and distributed-systems communities. Proofs in HAIL are efficiently computable by servers and highly compact---typically tens or hundreds of bytes, irrespective of file size. HAIL cryptographically verifies and reactively reallocates file shares. It is robust against an active, mobile adversary, i.e., one that may progressively corrupt the full set of servers. We propose a strong, formal adversarial model for HAIL, and rigorous analysis and parameter choices. We show how HAIL improves on the security and efficiency of existing tools, like Proofs of Retrievability (PORs) deployed on individual servers. We also report on a prototype implementation.

/pdf/hail-a-high-availability-and-integrity-layer-for-cloud-1y31n4xk9i.pdf

HAIL: a high-availability and integrity layer for cloud storage

Protocols for authentication and key establishment are the foundation for security of communications. The range and diversity of these protocols is immense, while the properties and vulnerabilities of different protocols can vary greatly.This is the first comprehensive and integrated treatment of these protocols. It allows researchers and practitioners to quickly access a protocol for their needs and become aware of existing protocols which have been broken in the literature.As well as a clear and uniform presentation of the protocols this book includes a description of all the main attack types and classifies most protocols in terms of their properties and resource requirements. It also includes tutorial material suitable for graduate students.

Protocols for Authentication and Key Establishment

Password-based authenticated key exchange are protocols which are designed to be secure even when the secret key or password shared between two users is drawn from a small set of values. Due to the low entropy of passwords, such protocols are always subject to on-line guessing attacks. In these attacks, the adversary may succeed with non-negligible probability by guessing the password shared between two users during its on-line attempt to impersonate one of these users. The main goal of password-based authenticated key exchange protocols is to restrict the adversary to this case only. In this paper, we consider password-based authenticated key exchange in the three-party scenario, in which the users trying to establish a secret do not share a password between themselves but only with a trusted server. Towards our goal, we recall some of the existing security notions for password-based authenticated key exchange protocols and introduce new ones that are more suitable to the case of generic constructions. We then present a natural generic construction of a three-party protocol, based on any two-party authenticated key exchange protocol, and prove its security without making use of the Random Oracle model. To the best of our knowledge, the new protocol is the first provably-secure password-based protocol in the three-party setting.

/pdf/password-based-authenticated-key-exchange-in-the-three-party-47tk2krj6c.pdf

Password-Based authenticated key exchange in the three-party setting

This work initiates a study of Luby-Rackoff ciphers when the bitwise exclusive-or (XOR) operation in the underlying Feistel network is replaced by a binary operation in an arbitrary finite group. We obtain various interesting results in this context: - First, we analyze the security of three-round Feistel ladders over arbitrary groups. We examine various Luby-Rackoff ciphers known to be insecure when XOR is used. In some cases, we can break these ciphers over arbitrary Abelian groups and in other cases, however, the security remains an open problem. - Next, we construct a four round Luby-Rackoff cipher, operating over finite groups of characteristic greater than 2, that is not only completely secure against adaptive chosen plaintext and ciphertext attacks, but has better time / space complexity and uses fewer random bits than all previously considered Luby-Rackoff ciphers of equivalent security in the literature. Surprisingly, when the group is of characteristic 2 (i.e., the underlying operation on strings is bitwise exclusive-or), the cipher can be completely broken in a constant number of queries. Notably, for the former set of results dealing with three rounds (where we report no difference) we need new techniques. However for the latter set of results dealing with four rounds (where we prove a new theorem) we rely on a generalization of known techniques albeit requires a new type of hash function family, called a monosymmetric hash function family, which we introduce in this work. We also discuss the existence (and construction) of this function family over various groups, and argue the necessity of this family in our construction. Moreover, these functions can be very easily and efficiently implemented on most current microprocessors thereby rendering the four round construction very practical.

Luby-Rackoff ciphers: Why XOR is not so exclusive

Cellular bandits have exploited security limitations of analog technology from its infancy. First-generation analog system security has been primarily left up to system manufacturers and service providers. With the advent of digital technology (second generation [2G]), the standards organizations aggressively developed techniques and cryptographic methods to protect the service provider from fraudulent use of network resources and to provide user privacy. Third-generation (3G) digital wireless systems offer significant improvement of security techniques that address all known 2G deficiencies and allow strong service protection for many years to come. This paper discusses in detail the wireless security architecture evolution (voice and data) with special emphasis on the latest standards developed for 3G wireless systems, including 2G/3G interoperability issues. Both the Universal Mobile Telecommunications System (developed by the 3rd Generation Partnership Project [3GPP]) and CDMA2000∗ (developed by the 3rd Generation Partnership Project 2 [3GPP2]) architectures are addressed.

Wireless network security architecture

This paper introduces two new ideas in the construction of fast universal hash functions geared towards the task of message authentication. First, we describe a simple but novel family of universal hash functions that is more efficient than many standard constructions. We compare our hash functions to the MMH family studied by Halevi and Krawczyk [12]. All the main techniques used to optimize MMH work on our hash functions as well. Second, we introduce additional techniques for speeding up our constructions; these techniques apply to MMH and may apply to other hash functions. The techniques involve ignoring certain parts of the computation, while still retaining the necessary statistical properties for secure message authentication. Finally, we give implementation results on an ARM processor, Our constructions are general and can be used in any setting where universal hash functions are needed; therefore they may be of independent interest.

SQUARE HASH : Fast message authentication via optimized universal hash functions

An apparatus in one example has: a femtocell operatively coupled to an operations support system and operatively coupleable to a mobile terminal; a femtocell access control list operatively coupled to the operations support system and the femtocell; and an SMS control center operatively coupled to the operations support system and to the femtocell; wherein an addition of the mobile terminal to the femtocell access control list is initiated; wherein a message is sent to the mobile terminal that informs the mobile terminal that the mobile terminal is being added to the femtocell; wherein a response is communicated from the mobile terminal to the operations support system; and wherein the mobile terminal is added to the access control list upon receipt of the response. Thus, the present method and apparatus control addition of mobile terminals to access control lists for femtocells.

Femtocell access control list addition confirmation

The present invention provides a method involving a femtocell in communication with a secure core network such as an Internet Protocol Multimedia Subsystem (IMS) network. The method includes receiving, from the femtocell and at a first secure entity in the IMS network, a global challenge including information indicating a random number. The method also includes receiving an authentication response computed by a mobile unit based on the random number and the first key known by the mobile unit and not known by the femtocell. The method further includes determining, at the first secure entity, that the random number is a legitimate random number provided to the femtocell by the IMS network.

Sarvar Patel

Papers

Luby-Rackoff ciphers: Why XOR is not so exclusive

Wireless network security architecture

SQUARE HASH : Fast message authentication via optimized universal hash functions

Femtocell access control list addition confirmation

Method for authenticating mobile units attached to a femtocell in communication with a secure core network such as an ims