可防范词典攻击的密钥分发协议

在密钥分发协议中,一般都通过在参与协议的实体之间共享秘密来提供认证服务。因为用户倾向于选择容易记忆的口令,而这种弱口令容易遭受词典攻击,因此由用户选择的口令不应是共享秘密。在许多协议中,人们使用不同的方法来解决这个问题。提出了一个基于单向函数实现的密钥分发协议。安全分析表明,该协议可以防范词典攻击。     

A Provably Secure Multi-server Based Authentication Scheme

With the rapid growth of electronic commerce and demand on variants of Internet based applications, the system providing resources and business services often consists of many servers around the world. So far, a variety of authentication schemes have been published to achieve remote user authentication on multi-server communication environment. Recently, Pippal et al. proposed a multi-server based authentication protocol to pursue the system security and computation efficiency. Nevertheless, based on our analysis, the proposed scheme is insecure against user impersonation attack, server counterfeit attack, and man-in-the-middle attack. In this study, we first demonstrate how these malicious attacks can be invoked by an adversary. Then, a security enhanced authentication protocol is developed to eliminate all identified weaknesses. Meanwhile, the proposed protocol can achieve the same order of computation complexity as Pippal et al.’s protocol does.     

一种改进的基于口令的认证体制

提出了一种改进的基于口令的认证体制,该体制能够抵御C．K．Chan和L．M．Cheng提出的一种重放攻击。     

Cryptanalysis and Improvement of a Robust Smart Card Authentication Scheme for Multi-server Architecture

A multi-server authentication scheme enables a remote user to access the services provided by multiple servers after registering with the registration center. Recently, Pippal et al. (Wirel Pers Commun 2013, doi:10.1007/s11277-013-1039-6) introduced a robust smart card authentication scheme for multi-server architecture. They also illustrated that their scheme could be free from potential network attacks, and validated the scheme by using BAN logic. In this paper, by presenting concrete attacks, we demonstrate that Pippal et al.’s scheme can not withstand off-line password guessing attacks, impersonation attacks and privileged insider attacks. Furthermore, to overcome these attacks, we propose an improved authentication scheme for multi-server architecture using smart card and password. Security and efficiency analysis indicates that our scheme not only actually achieves intended security goals (e.g., two-factor authentication, perfect forward secrecy etc.), but also is efficient enough to be implemented for practical applications.     

密码学中口令验证方案的设计研究

在介绍基于拉格朗日插值公式的口令验证方案的基础上,提出了2种新的改进的基于多项式的口令验证方案,适应于当今系统网络成员不断变化的情况。最后提出一种基于公钥密码和中国剩余定理的动态口令验证方案,进行方案安全性及性能的分析。     

基于Harn签名方案的远距离通行字认证方案

本文首先利用Ｓｈａｍｉｒ的秘密共享方法将Ｃｈａｎｇ－Ｌｉａｏ通行字认证方案转变成（ｔ，ｎ）共享认证方案，从而使ｎ个认证者中任意ｔ个人能够认证通行字的正确性。其次提出了一个基于Ｈａｒｎ数字签名方案的远距离通行字认证方案。     

一种新颖的认证机制

识别和认证是计算机安全保密的一项重要内容。识别用于区分不同的用户,认证用于鉴别用户的身份。其中认证是实施存取控制的关键,常规的基于口令的认证机制,对于防止口令猜测的进攻显得无能为力,而本文提出的认证机制具有良好的抗猜测特性,而且易于实现。     

An Enhanced Authentication Protocol for Multi-server Environment Using Password and Smart Card

Wireless Personal Communications - In the past two decades, numerous two-factor authentication protocols have been proposed for the multi-server environment using a smart card and password. Sahoo...     

一种基于动态口令的FTP双向认证方案

FTP协议是一种简单易用的文件传输协议,应用十分广泛,但它以明文形式传输口令和文件,带有与生俱来的不安全性,随着网络的不断发展应用,FTP已成为政府机关和企事业单位传送信息的一种主要手段,以明文形式传输敏感信息,缺乏有效的身份认证以及安全传输机制等这样的隐患将会给国家和企业造成巨大的损失和危害,因此FTP通信系统的安全性研究显得尤为重要。以构建FTP安全通信系统为背景,分析了传统FTP身份认证的缺陷,对比了当前常用的认证技术。在此基础上,提出了一种结合HASH函数、对称密码机制以及挑战/应答机制的基于动态口令的双向认证方案。最后对该方案进行了性能分析。结果表明：该方案具有保护用户身份信息,防止诸如重放、假冒等常见身份认证攻击,实现双向认证的优点。     

基于矢积的远程口令鉴别方案

本文提出了一种基于矢积的远程口令鉴别方案.本方案中,合法用户在智能卡初始化时可以自由地选取自己的口令.用户利用智能卡以及口令便可成功地登录到远程系统.根据分析,攻击者不能从公开或传送的信息中获得用户秘密信息,也不能冒充别的合法用户.此外,本方案还能抵抗登录请求的重播.本方案所需的计算量大大地小于C-H方案.     

一种一次性口令身份认证方案的设计与分析

身份认证机制是网络安全的第一道防线，利用椭圆曲线密钥交换体制，设计了一种新型的身份认证方案，该方案降低了对信道安全性的要求，提供通信双方的相互认证，并能有效地防止重放攻击、冒充攻击、小数攻击，提高了认证系统的安全性。     

Security Flaws in a Smart Card Based Authentication Scheme for Multi-server Environment

Recently, Wang and Ma (Wireless Pers Commun, 2012. doi:10.1007/s11277-011-0456-7) proposed a smart card based authentication scheme for multi-server environment. They also demonstrated that their scheme could overcome various attacks. In this paper, the security of Wang et al.’s scheme is evaluated. Our analysis shows their scheme is vulnerable to the server spoofing attack, the impersonation attack, the privileged insider attack and the off-line password guessing attack.     

An ECC Based Secure Authentication and Key Exchange Scheme in Multi-server Environment

Wireless Personal Communications - For providing strong mutual authentication in a multi-server environment many algorithms have been proposed. Most of the algorithms provide mutual authentication...     

一种新的防肩窥图形口令机制

提出了一种新的基于多图形选择的图形口令机制。与现存的基于多图形选择的图形口令相比,文中所提出的新机制采用敲击键盘选择口令图片,代替了以往由鼠标点击的选择方式,其优点在于可有效地防止肩窥攻击,并能抵御交叉攻击,增加了口令机制的安全性。实验证明,该机制具有较好的安全性和可用性。     

口令认证方案的安全性改进及其相应的数字签名方案

本文首先利用离散对数和分子因解问题提出了许多口令认证方案。其次建立并分析了三个新型数字签名方案。     

基于孙子定理和欧拉函数口令验证方案

在介绍著名的孙子定理和欧拉函数的基础上,提出了一种新的口令验证方案。介绍了他的数学基础、原理和具体实现过程,进行了方案安全性和可操作性的分析。该方案简便、实用、存储量小、保密性和可操作性较强,克服了以往诸如基于拉格朗日多项式的口令验证方案等方案的缺点,适应于当今系统网络成员不断变化的情况,具有一定的理论和实践意义。     

一种智能卡口令认证方案的分析与改进

袁,吕提出了一种智能卡口令认证方案.在他们的方案中,用户能随意更改口令,远程系统不需要存储用户的口令表或验证表,并能防止重放攻击.作者指出袁-吕方案不能抵抗假冒攻击,并进行了改进.     

基于智能卡和密码保护的WSN远程用户安全认证方案

针对无线传感器网络（WSN）用户远程安全认证问题,分析现有方案的不足,提出一种新颖的基于智能卡的WSN远程用户认证方案。通过用户、网关节点和传感器节点之间的相互认证来验证用户和节点的合法性,并结合动态身份标识来抵抗假冒攻击、智能卡被盗攻击、服务拒绝攻击、字典攻击和重放攻击。同时对用户信息进行匿名保护,且用户能够任意修改密码。性能比较结果表明,该方案具有较高的安全性能,且具有较小的计算开销。     

Trapdoor Hard-to-Invert Group Isomorphisms and Their Application to Password-Based Authentication

In the security chain the weakest link is definitely the human one: human beings cannot remember long secrets and often resort to rather insecure solutions to keep track of their passwords or pass-phrases. For this reason it is very desirable to have protocols that do not require long passwords to guarantee security, even in the case in which exhaustive search is feasible. This is actually the goal of password-based key exchange protocols, secure against off-line dictionary attacks: two people share a password (possibly a very small one, say a 4-digit number), and after the protocol execution, they end up sharing a large secret session key (known to both of them, but nobody else). Then an adversary attacking the system should try several connections (on average 5000 for the above short password) in order to be able to get the correct password. Such a large number of erroneous connections can be prevented by various means. Our results can be highlighted as follows. First we define a new primitive that we call trapdoor hard-to-invert group isomorphisms, and give some candidates. Then we present a generic password-based key exchange construction that admits a security proof assuming that these objects exist. Finally, we instantiate our general scheme with some concrete examples, such as the Diffie-Hellman function and the RSA function, but more interestingly the modular square-root function, which leads to the first scheme with security related to the integer factorization problem. Furthermore, the latter variant is very efficient for one party (the server). Our results hold in the random-oracle model.