The objective of this paper is to give a comprehensive introduction to applied cryptography with an engineer or computer scientist in mind. The emphasis is on the knowledge needed to create practical systems which supports integrity, confidentiality, or authenticity. Topics covered includes an introduction to the concepts in cryptography, attacks against cryptographic systems, key use and handling, random bit generation, encryption modes, and message authentication codes. Recommendations on algorithms and further reading is given in the end of the paper. This paper should make the reader able to build, understand and evaluate system descriptions and designs based on the cryptographic components described in the paper.

[서평]「Applied Cryptography」

An improved smart card based password authentication scheme with provable security

The authentication scheme is an important cryptographic mechanism, through which two communication parties could authenticate each other in the open network environment To satisfy the requirement of practical applications, many authentication schemes using passwords and smart cards have been proposed However, passwords might be divulged or forgotten, and smart cards might be shared, lost, or stolen In contrast, biometric methods, such as fingerprints or iris scans, have no such drawbacks Therefore, biometrics-based authentication schemes gain wide attention In this paper, we propose a biometrics-based authentication scheme for multiserver environment using elliptic curve cryptography To the best of our knowledge, the proposed scheme is the first truly three-factor authenticated scheme for multiserver environment We also demonstrate the completeness of the proposed scheme using the Burrows–Abadi–Needham logic

Robust Biometrics-Based Authentication Scheme for Multiserver Environment

As the most prevailing two-factor authentication mechanism, smart-card-based password authentication has been a subject of intensive research in the past two decades, and hundreds of this type of schemes have wave upon wave been proposed. In most of these studies, there is no comprehensive and systematical metric available for schemes to be assessed objectively, and the authors present new schemes with assertions of the superior aspects over previous ones, while overlooking dimensions on which their schemes fare poorly. Unsurprisingly, most of them are far from satisfactory—either are found short of important security goals or lack of critical properties, especially being stuck with the security-usability tension. To overcome this issue, in this work we first explicitly define a security model that can accurately capture the practical capabilities of an adversary and then suggest a broad set of twelve properties framed as a systematic methodology for comparative evaluation, allowing schemes to be rated across a common spectrum. As our main contribution, a new scheme is advanced to resolve the various issues arising from user corruption and server compromise, and it is formally proved secure under the harshest adversary model so far. In particular, by integrating “honeywords”, traditionally the purview of system security, with a “fuzzy-verifier”, our scheme hits “two birds”: it not only eliminates the long-standing security-usability conflict that is considered intractable in the literature, but also achieves security guarantees beyond the conventional optimal security bound.

Two Birds with One Stone: Two-Factor Authentication with Security Beyond Conventional Bound

Advanced smart card based password authentication protocol

Improvement of Chien et al.'s remote user authentication scheme using smart cards

This paper proposes two ID-based password authentication schemes, which does not require a dictionary of passwords or verification tables, with smart card and fingerprint. In these schemes, users can change their passwords freely. For a network without synchronization clocks, the proposed nonce-based authentication scheme can withstand message replay attacks. The proposed two schemes require a system to authenticate each user by each user's knowledge, possession, and biometrics, and this feature makes our schemes more reliable.

ID-based password authentication scheme using smart cards and fingerprints

Efficient verifier-based key agreement protocol for three parties without server's public key

Nodes in a sensor network may be lost because of the power exhaustion problem or malicious attacks. Thereby new node deployment is necessary in the sensor network. Huang recently proposed a novel access control protocol (NACP) based on the elliptic curve cryptography and the hash chain. She claimed that NACP can easily add new nodes and can resist against various known attacks. However, this paper addresses that her NACP is insecure to the replay attack and against an active attack, and has the lack of hash chain renewability, which is one of the necessary aspects in the sensor network with memory restricted nodes. To cope with them, we propose an enhanced novel access control protocol which is quite adequate for power and resource constrained sensor networks.

Sung-Woon Lee

Papers

Improvement of Chien et al.'s remote user authentication scheme using smart cards

ID-based password authentication scheme using smart cards and fingerprints

Efficient verifier-based key agreement protocol for three parties without server's public key

Enhanced novel access control protocol over wireless sensor networks

Efficient nonce-based remote user authentication scheme using smart cards