Search

The security of the authentication scheme plays a more and more important role in today's web service systems as people's daily are increasingly depending on these services and user credentials are collected and stored online. An insecure authentication system will become a great threat for users' privacy. Beside security, usability is also very important for the design of an authentication system. Traditional password-based authentication solutions are often susceptible to various attacks due to the weak passwords chosen by incautious users. This paper illustrates a secure yet simple implementation, which uses digital signature algorithm to authenticate user identities. The proposed design brings usability and convenience to the authentication scheme by taking advantage of the increasingly widespread mobile devices. Full comparisons with existing systems in terms of their security, usability and deploy ability will also be presented in this paper.

MIFARE Classic is the world’s most widely deployed RFID (radio-frequency identification) technology. It was claimed to be cryptographically protected by the proprietary Crypto-1 stream cipher. However, it proved inadequate after weaknesses in the design and implementation of Crypto-1 and MIFARE Classic started surfacing since late 2007 [7, 8, 12, 13, 14, 15, 16, 17]. Some operators of MIFARE Classic-based systems reacted by upgrading to more secure alternatives such as MIFARE DESFire. However, many (especially in Asia) opted to “patch” MIFARE Classic instead. Their risk analysis might have gone as follows: “The most serious threat comes from efficient card-only attacks, where the attacker only needs an off-the-shelf reader and a PC to tamper a target tag. All efficient card-only attacks depend on certain implementation flaws. Ergo, if we just fix these flaws, we can stop the most serious attacks without an expensive infrastructure upgrade.” One such prominent case is “EasyCard 2.0,” today accepted in Taiwan as a means of electronic payment not only in public transportation but also in convenient stores, drug stores, eateries, cafes, supermarkets, book stores, movie theaters, etc. Obviously, the whole “patching” approach is questionable because Crypto-1 is fundamentally a weak cipher. In support of the proposition, we present a new card-only attack based on state-of-the-art algebraic differential cryptanalytic techniques [1, 2]. Still using the same cheap reader as previous attacks, it takes 2–15 min of computation on a PC to recover a secret key of EasyCard 2.0 after 10–20 h of data collection. We hope the new attack makes our point sufficiently clear, and we urge that all MIFARE-Classic operators with important transactions such as electronic payment upgrade their systems to the more secure alternatives soon.

Cloud storage is one of the most rapidly growing cloud services, which at the same time also faces serious security challenges. Recently, several cloud-storage service providers started to provide encryption protection to client data in the cloud. However, encryption imposes significant limits on data use. In this paper, we report our design and implementation of an encrypted cloud storage system that supports multi-user secure indices, allowing efficient search among encrypted documents of multiple users. Experiment results show that keyword search can be performed in real time. We believe that our system represent a first step toward providing secure and useful cloud-storage services in practice.