Search

Abstract: A three-party password-based authenticated key exchange (3PAKE) protocol is a useful mechanism to establish a secure session key in a network. However, most current 3PAKE protocols only achieve “heuristic” security; the underlying hardness assumptions of these protocols are not perfect. We propose a 3PAKE protocol which is provably secure if the Diffie–Hellman problem is computationally infeasible (the CDH assumption), even in the 3eCK model where the adversary is allowed to make more queries and have more freedom than previous models. In our formal proof, we use the trapdoor test technique introduced by Cash, Kiltz and Shoup to construct an efficient decision oracle. As far as we know, our protocol is the first provably secure 3PAKE protocol based on the CDH assumption and the first 3PAKE protocol using the trapdoor test technique for the security proof. [Copyright &y& Elsevier]

Abstract: A multi-secret sharing scheme is a protocol to share m arbitrarily related secrets s 1,…, s m among a set of n participants. In this paper, we propose an ideal linear multi-secret sharing scheme, based on monotone span programs, where each subset of the set of participants may have the associated secret. Our scheme can be used to meet the security requirement in practical applications, such as secure group communication and privacy preserving data mining etc. We also prove that our proposed scheme satisfies the definition of a perfect multi-secret sharing scheme. [ABSTRACT FROM AUTHOR]

Abstract: Nowadays, various promising paradigms of distributed computing over the Internet, such as Grids, P2P and Clouds, have emerged for resource sharing and collaboration. To enable resources sharing and collaboration across different domains in an open computing environment, virtual organizations (VOs) often need to be established dynamically. However, the dynamic and autonomous characteristics of participating domains pose great challenges to the security of virtual organizations. In this paper, we propose a secure collaboration service, called PEACE-VO, for dynamic virtual organizations management. The federation approach based on role mapping has extensively been used to build virtual organizations over multiple domains. However, there is a serious issue of potential policy conflicts with this approach, which brings a security threat to the participating domains. To address this issue, we first depict concepts of implicit conflicts and explicit conflicts that may exist in virtual organization collaboration policies. Then, we propose a fully distributed algorithm to detect potential policy conflicts. With this algorithm participating domains do not have to disclose their full local privacy policies, and is able to withhold malicious internal attacks. Finally, we present the system architecture of PEACE-VO and design two protocols for VO management and authorization. PEACE-VO services and protocols have successfully been implemented in the CROWN test bed. Comprehensive experimental study demonstrates that our approach is scalable and efficient. [Copyright &y& Elsevier]

Abstract: Key agreement (KA) allows two or more users to negotiate a secret session key among them over an open network. Authenticated key agreement (AKA) is a KA protocol enhanced to prevent active attacks. AKA can be achieved using a public-key infrastructure (PKI) or identity-based cryptography. However, the former suffers from a heavy certificate management burden while the latter is subject to the so-called key escrow problem. Recently, certificateless cryptography was introduced to mitigate these limitations. In this paper, we first propose a security model for AKA protocols using certificateless cryptography. Following this model, we then propose a simulatable certificateless two-party AKA protocol. Security is proven under the standard computational Diffie–Hellman (CDH) and bilinear Diffie–Hellman (BDH) assumptions. Our protocol is efficient and practical, because it requires only one pairing operation and five multiplications by each party. [Copyright &y& Elsevier]

Abstract: This paper deals with the original work due to Brassard et al., in which an algorithm to sell only one secret to one buyer was introduced. It is based on the theory of quadratic residues modulo an integer number and Jacobi symbols. Unfortunately, this algorithm exhibits an important security drawback: the seller can disclose more than one secret to the buyer instead of only one. This problem was overcome by other sophisticated protocols. Although such problem has been satisfactorily tackled, the main goal of this work is to modify the original work (preserving its flavour) in order to securely disclose multiple secrets without the participation of more buyers but with a third trusted party. [Copyright &y& Elsevier]

Abstract: We revisit the identity-based (ID-based) key agreement protocol due to Ryu et al. The protocol is highly efficient and suitable for real-world applications despite offering no resilience against key-compromise impersonation (K-CI). We show that the protocol is also insecure against reflection attacks. We propose a slight modification to the protocol and prove its security in a widely accepted model. [Copyright &y& Elsevier]

Abstract: We analyze the relationship between the notion of certificateless public key cryptography (CL-PKC) and identity-based schemes without a trusted private key generator (PKG), formally define the security of certificateless threshold signatures, and propose a concrete implementation based on bilinear pairings. To exhibit the security of our proposal, we develop the theory of simulatability and relationship between the certificateless threshold signatures and the underlying (non-threshold) ID-based signatures. We show that the proposed scheme is robust and existentially unforgeable against adaptively chosen message attacks under CDH assumption in the random oracle model. [Copyright &y& Elsevier]

Abstract: Authentication and key exchange are fundamental for establishing secure communication channels over public insecure networks. Password-based protocols for authenticated key exchange are designed to work even when user authentication is done via the use of passwords drawn from a small known set of values. Recently, Wen et al. (H.-A. Wen, T.-F. Lee, T. Hwang, Provably secure three-party password-based authenticated key exchange protocol using Weil pairing, IEE Proceedings—Communications 152 (2) (2005) 138–143) proposed a new protocol for password-based authenticated key exchange in the three-party setting, where the clients trying to establish a common secret key do not share a password between themselves but only with a trusted server. Wen et al.’s protocol carries a claimed proof of security in a formal model of communication and adversarial capabilities. However, this work shows that the protocol for three-party key exchange is completely insecure and the claim of provable security is seriously incorrect. We conduct a detailed analysis of flaws in the protocol and its security proof, in the hope that no similar mistakes are made in the future. [Copyright &y& Elsevier]

Abstract: A deniable authentication protocol enables a receiver to identify the true source of a given message, but not to prove the identity of the sender to a third party. This property is very useful for providing secure negotiation over the Internet. Consequently, many interactive and non-interactive deniable authentication protocols have been proposed. However, the interactive manner makes deniable protocols inefficient. In addition, a security hole is generated in deniable protocols that use the non-interactive manner if a session secret is compromised. Thus, there is no secure and efficient deniable authentication protocol as of now. In this paper, a new protocol based on the non-interactive manner is proposed to efficiently and securely achieve deniable authentication. This protocol can furthermore replace the underlying signature scheme in order to retain a secure status even if the previously used signature method is broken. [Copyright &y& Elsevier]

The article reports that China has proposed a standard for tracking goods using radio frequency identification (RFID) tags especially when bolstered by a developing coordination with Wal-Mart Inc., the world's largest merchandiser from Bentonville, Arkansas. Wal-Mart Inc. has planned to lead the way in commercial use of RFID technology to track its products from factory to store shelf. China's standard initiatives have been applied even in some of the hottest areas of technology including computer networking which has Wi-Fi security known as Wireless Authentication and Privacy Infrastructure, next-generation DVDs wherein the Chinese government has approved Enhanced Video Disk and race for the next generation of software to run on high-definition DVDs that is concerned with the way audio and video data on DVDs are encoded..

The article discusses practical aspects of setting up a wireless network (WLAN). One of the basic steps in setting up a WLAN involves installation and configuration of one or more access points. The process involves assigning the unit its Internet telephony (IP) address and other TCP/IP settings and then working through all the configuration details. To be secure, a wireless LAN must fit within the organization's overall network design and security architecture. Efforts must be made to detect and remove rogue access points or, at least, to bring them within the official network and support system. When establishing a wireless LAN for public use, the library provides only the basic connectivity. Users bring their own computers, not only saving the library in computer hardware costs, but also in furniture, Ethernet drops, power outlets, plus the building space.

Part III. Reports that the wireless telecommunication industry are rushing to get applications in the hands of users, and in the process are minimizing the importance of security. Factors hampering security efforts that are under way; Number of wireless devices accessing the Internet; Protocols being implemented in the wireless world. INSET: Users--the weakest link..

The author focuses on the Code Red worm, a computer virus which has traveled the Internet and has caused considerable consternation among users of Internet Information Server of Microsoft Corp. These worms work their way through self generated lists of Internet protocol addresses and contact each address's port 80, the standard Hyper Text Transfer Protocol (HTTP) port. The problem is created by the companies embedding network servers into products without making them sufficiently robust. The rise of HTTP as a communications common denominator comes from ease of use, fix programmer and customer alike. HTTP traffic is usually allowed through firewalls and other network traffic barriers. Numerous non-HTTP protocols are tunneled via HTTP in order to ease their passage. Given the ease of implementation and small code size of a lightweight web server, it is disturbing that such software is not engineered with greater care. HTTP is easy to implement, easy to use and easy to co-opt. With some diligence and forethought, it is also easy to secure.

The article focuses on an addressing system called IP address and relates it with the privacy of personal computers. A proposal to improve the way information flows across the Internet has caused worries for privacy advocates that the design could be used to trace a person's identity. The proposal, an addressing system called IPv6, was created by the Internet Engineering Task Force, an international standards body, and would include a unique serial number for each computer's network connection as part of its expanded new IP address. Critics warn that, if adopted, the move could strip the anonymity and security of Internet users over traditional phone lines, allowing commercial sites to correlate these embedded serial numbers against a consumer's name, address, and other personal details, from clothing size to political affiliation. Today, most home computers are assigned a different IP address each time they connect. According to a lawyer of Washington-based Electronic Privacy Information Center, Marc Rotenberg, although IPv6 would not be widely used for years, there is no doubt there are serious privacy concerns.

The article presents information about the Internet sabotage. A new type of Internet sabotage is spreading and has now occurred at more than a dozen Web sites around the U.S. Attacks which tie up network computers so that other users cannot gain access have created nuisance. Hackers bombard an Internet server with more than 100 requests per second for service, each coming from a randomly generated false address while shutting out legitimate users. The Computer Emergency Response Team formed by the Defense Advanced Research Projects Agency conducts research for improving computing security and drafted an advisory detailing the nature of the attack and its impact on the Internet community. Security officials are concerned because this type of hacking exploits the basic scheme of the Internet, software protocols, routing instructions, on which the Internet has based and they were not designed to prevent message flooding.

This article discusses the Obol protocol programming language that allows for testing and experimentation when constructing and using security protocols in real systems. An Obol program is called a script and describes a participant's role in the protocol. It provides features useful to the protocol programmer, such as control structures, interactivity and the use as a crypto coprocessor. Obol is also used by the GridKit project at the University of Lancaster in England to experiment with flexible security policies.

The article describes the mechanism of the Secure Shell (SSH) protocol Kerberos authentication using Generic Security Services Application Programming Interface and Microsoft's Security Support provider Interface. There are three steps in running SSH protocol: negotiate encryption, authenticate the user and open and use channels. The protocol uses a packetized binary protocol on the wire consisting of a shorter header, a message type, the payload and Message Authentication Code. On the other hand, SSH authentication using Kerberos, it can run over the SSH User Authentication protocol or over the SSH Transport protocol.

This article presents information on the new CryptoNetX line of security protocol processors unveiled by Broadcom as of December 2005. This next-generation line of security processors that combine Internet protocol Security and Secure Sockets Layer protocol processing, cryptographic acceleration, and hardware-based identity management and authentication into a single-chip solution. Recently announced are three new security protocol processors that include either PCI-X(R) or PCI Express(R) host bus architectures. Each of these new chips provides high-performance cryptographic acceleration and the ability to offload a significant amount of security processing functions from the host processor, resulting in higher performance and optimal central processing unit utilization.

This section offers steps on how to start with a service-oriented architecture (SOA). It was learned that SOA builds on the stack of protocols that define Web services. It is a broad, standards-based framework in which services are built, deployed, managed, and orchestrated in pursuit of new infrastructures that respond to shifting business demands. SOA starts with a business promise of enabling enterprises to re-engineer themselves. The more dynamic the business, the more it will benefit from a well-implemented SOA. Before implementation, it is recommended to survey surroundings. An SOA involves a sprawling set of technologies. Another step is the connection of first services. Coming next is the selection and deployment of a registry or repository. The issue of convergence should come next. Security plans must be laid and a messaging infrastructure must be built. The last two steps is the deployment of service management and orchestration.

Focuses on wireless networking capability for classroom connectivity at the West Point Military Academy. Software solution for security concerns of wireless networking; Advantages of using the bandwidth 802.11a; Configuration control of computers using the wireless technology.

Discusses the PacketCable Security Specification for Internet Protocol telephony networks. Information on the various security threats to IP networks; Details on the authentication process supervised by a Key Distributor Center; Key strength of the PacketCable security architecture.

Focuses on the security of computer network protocols, focusing on Internet protocol (IP). Information on Internet communication based on transmission control protocol; Advantages of having IP protocol security; Application of general-purpose protocols; Features of dial-up protocols.

The article reports on the Key Reinstallation Attacks (KRACK) that was disclosed on October 16, 2017 by researchers Frank Piessens and Mathy Vanhoef. Topics mentioned include the risk on Wi-Fi Protected Access 2 (WPA2) protocol that is used for WiFi security, the attack that reads information that was assumed to be encrypted, and the plan to discuss the details of the attack at the Black Hat Europe conference.

Reports on the availability of OCTEON XL Accelerator cards, targeted at secure network services and compression acceleration in Appliances and Storage Systems, from Cavium Networks. The cards deliver the industry's highest performance, enabling the fastest time to market for existing system configurations. The products are being adopted by Tier-1 vendors for security and networking appliances and storage products as the way to deliver advanced security and application acceleration. The cards are offered in three distinct families with a range of processor performance.

Examines which of the two primary technology, Internet protocol security (IPSec) and secure sockets layer (SSL), should be used for mobile work force. Key benefits of IPSec; Development of SSL; Factors to consider before choosing the appropriate solution.

The article focuses on the benefits of virtual private networks (VPN) for data protection by business users of the iPad tablet computer. The iPad supports three kinds of VPNs Point-to-Point tunneling Protocol (PPtP), Layer 2 tunneling Protocol (L2tP), and Cisco Internet Protocol Security (IPSec). It explains the method for configuring a VPN setup and procedure for using it.

The article discusses the development of Open Authorization (OAuth), an open standard allowing users to share their private resources stored on a website with another website. OAuth emerges from the intention of implementers of OpenID, another open standard for user authentication, to delegate authentication through an application programming interface (API). It compares OpenID protocol with single sign-on (SSO) and claims that OAuth does not need OpenID.

The article reports that Let's Encrypt has already issued its one millionth free secure sockets layer (SSL) certificate in 2016. Topics covered include the release of the certification program in December 2015 and the capacity of the program to support issuance rates on the high end. Also mentioned are security and authenticity issues raised against the initiative.

The article provides information on IPv6, the latest Internet layer of the TCP/IP suit. The IPv6 promises to offer more address space, better security, and easier management for network administrators. The IPv6 also sports IPSec, auto-configuration, and new features for mobile devices. Moreover, the IPv6 is on all software road maps and will likely arrive with mobile devices.

The article presents an analysis regarding the increasing trend for the used of 802.11n as well as its security risk. As most users agrees that their are no known vulnerabilities on the technology, an expert had specified the potential threat. According to Amit Sinha, chief technology officer of wireless intrusion prevention vendor AirDefense, 802.11n significantly complicate the media access control (MAC) layer with the inclusion of mechanisms such as block acknowledgements and spoofed duration fields that could be exploit candidates. It states that the product has still need to finalize the standards before it could be freed totally from the potential risks.

The article reports that Artimi Ltd. has announced a UWB chip that it believes solves the dilemma of high costing and ultrawideband (UWD) offerings of Wi-Fi. The company has combined an 800-Mbit/second physical layer based on pulse-position modulation (PPM) with IEEE 802.15 media-access control, promising full-home coverage using both wireless and power line media. The use of PPM separates the Santa Clara, California, company not just from Pulse-Link, which also uses UWB-over-power line technology, but also from the two main UWB approaches.

This article presents tips on using the Internet and avoiding e-mail attacks. According to the author, it is advisable to assume any message as malicious. Next, use a new found paranoia to examine messages critically. Even messages that appear to come from firms where a user has an account, may not be real. Before clicking a link or taking any action requested in a message, determine for certain that the message is genuine. Return addresses, embedded links, and images can deceive. Look for dire warnings and other classic con techniques, undoubtedly accompanied by a link to a bogus Web site where the user will be asked to enter personal information. As a clue, the phishing message may be delivered to an e-mail address that the user don't use with that company or institution. The author emphasized that if a user get a message at an address he or she never registered with, the e-mail is fake. Intuition and a suspicious nature are a good start, but to separate real messages from bogus ones, the user also need to decipher their Web addresses. Another clue is the string of numbers following the URL prefix http://. It should be remembered that every Web site resides at a specific Internet Protocol address. INSET: Nvu Brings Free Web Authoring to the Firefox Browser.

Although firewalls do a good job of protecting internal network resources from hostile network traffic in general, applications exposed over Hyper Text Transfer Protocol (HTTP) are wide open to all kinds of hostile attacks. To this end, a new set of HTTP-specific firewalls is emerging to address the security mismatch between traditional port-level firewalls and the security demands of Web applications and Web services. Web application firewalls and trusted operating system add-ons, are emerging as important new defensive techniques, but they only mitigate the need for secure programming practices.

Reports the emergence of Security Assertion Markup Language (SAML) and Web Services-(WS) Security to display Web security in protocols. Comparison between SAML and WS-Security; Practice for securing Web services; Problems in using a Web servers document access security mechanisms. INSET: IBM and Systinet write next-gen tools.