Search

In recent years, the number of people using the Internet has increased worldwide, and the use of web applications in many areas of daily life, such as education, healthcare, finance, and entertainment, has also increased. On the other hand, there has been an increase in the number of web application security issues that directly compromise the confidentiality, availability, and integrity of data. One of the most widespread web problems is defacement. In this research, we focus on the vulnerabilities detected on the websites previously exploited and distorted by attackers, and we show the vulnerabilities discovered by the most popular scanning tools, such as OWASP ZAP, Burp Suite, and Nikto, depending on the risk from the highest to the lowest. First, we scan 1000 URLs of defaced websites by using three web application assessment tools (OWASP ZAP, Burp Suite, and Nikto) to detect vulnerabilities which should be taken care of and avoided when building and structuring websites. Then, we compare these tools based on their performance, scanning time, the names and number of vulnerabilities, and the severity of their impact (high, medium, low). Our results show that Burp Suite Professional has the highest number of vulnerabilities, while Nikto has the highest scanning speed. Additionally, the OWASP ZAP tool is shown to have medium- and low-level alerts, but no high-level alerts. Moreover, we detail the best and worst uses of these tools. Furthermore, we discuss the concept of Domain Name System (DNS), how it can be attacked in the most common ways, such as poisoning, DDOS, and DOS, and link it to our topic on the basis of the importance of its infrastructure and how it can be the cause of hacking and distorting sites. Moreover, we introduce the tools used for DNS monitoring. Finally, we give recommendations about the importance of security in the community and for programmers and application developers. Some of them do not have enough knowledge about security, which allow vulnerabilities to occur. [ABSTRACT FROM AUTHOR]

This paper proposes a novel hardware design for a compact crypto processor devoted to elliptic-curve point multiplication over G F (2 233) . We focus on minimizing hardware usage, which we obtain using an iterative bit–serial finite field modular multiplier for polynomial coefficient multiplication. The same multiplier is also used for modular squares and inversion computations, further optimizing the hardware footprint. Our design offers flexibility by permitting users to load different curve parameters and secret keys while keeping a low-area hardware design. To efficiently generate the control signals, we utilize a finite-state-machine-based controller. We have implemented the proposed crypto processor on Virtex-6 and Virtex-7 FPGA devices, and we have evaluated its performance at clock frequencies of 100, 50, and 10 MHz. Specifically, for one point multiplication computation on Virtex-7 FPGA, our crypto processor uses 391 slices, attains a maximum frequency of 161 MHz, has a latency of 4.45 ms, and consumes 77 mW of power. These results, along with a comparison to state-of-the-art designs, clearly demonstrate the practicality of our crypto processor for applications requiring efficient and compact cryptographic computations. [ABSTRACT FROM AUTHOR]

Data Encryption Standard (DES) is a symmetric key cryptosystem that is applied in different cryptosystems of recent times. However, researchers found defects in the main assembling of the DES and declared it insecure against linear and differential cryptanalysis. In this paper, we have studied the faults and made improvements in their internal structure and get the new algorithm for Improved DES. The improvement is being made in the substitution step, which is the only nonlinear component of the algorithm. This alteration provided us with great outcomes and increase the strength of DES. Accordingly, a novel 6 × 6 good quality S-box construction scheme has been hired in the substitution phase of the DES. The construction involves the Galois field method and generates robust S-boxes that are used to secure the scheme against linear and differential attacks. Then again, the key space of the improved DES has been enhanced against the brute force attack. The outcomes of different performance analyses depict the strength of our proposed substitution boxes which also guarantees the strength of the overall DES. [ABSTRACT FROM AUTHOR]

This article presents a latency-optimized implementation of the SIMECK lightweight block cipher on a field-programmable-gate-array (FPGA) platform with a block and key lengths of 32 and 64 bits. The critical features of our architecture include parallelism, pipelining, and a dedicated controller. Parallelism splits the digits of the key and data blocks into smaller segments. Then, we use each segmented key and data block in parallel for encryption and decryption computations. Splitting key and data blocks helps reduce the required clock cycles. A two-stage pipelining is used to shorten the critical path and to improve the clock frequency. A dedicated controller is implemented to provide control functionalities. For the performance evaluation of our design, we report implementation results for two different cases on Xilinx 7-series FPGA devices. For our case one, the proposed architecture can operate on 382, 379, and 388 MHz frequencies for Kintex-7, Virtex-7, and Artix-7 devices. On the same Kintex-7, Virtex-7, and Artix-7 devices, the utilized Slices are 49, 51, and 50. For one encryption and decryption computation, our design takes 16 clock cycles. The minimum power consumption is 172 mW on the Kintex-7 device. For the second case, we targeted the same circuit frequency of 50 MHz for synthesis on Kintex-7, Virtex-7, and Artix-7 devices. With minimum hardware resource utilization (51 Slices), the least consumed power of 13.203 mW is obtained for the Kintex-7 device. For proof-of-concept, the proposed SIMECK design is validated on the NEXYS 4 FPGA with the Artix-7 device. Consequently, the implementation results reveal that the proposed architecture is suitable for many resource-constrained cryptographic applications. [ABSTRACT FROM AUTHOR]

The decoding algorithm for the correction of errors of arbitrary Mannheim weight has discussed for Lattice constellations and codes from quadratic number fields. Following these lines, the decoding algorithms for the correction of errors of n = p-1 2 length cyclic codes (C) over quaternion integers of Quaternion Mannheim (QM) weight one up to two coordinates have considered. In continuation, the case of cyclic codes of lengths n = p-1 2 and 2n - 1 = p - 2 has studied to improve the error correction efficiency. In this study, we present the decoding of cyclic codes of length n = ϕ (p) = p - 1 and length 2n - 1 = 2ϕ (p) - 1 = 2p - 3 (where p is prime integer and ϕ is Euler phi function) over Hamilton Quaternion integers of Quaternion Mannheim weight for the correction of errors. Furthermore, the error correction capability and code rate tradeoff of these codes are also discussed. Thus, an increase in the length of the cyclic code is achieved along with its better code rate and an adequate error correction capability. [ABSTRACT FROM AUTHOR]

The Human-Centered Internet of Things (HC-IoT) is fast becoming a hotbed of security and privacy concerns. Two users can establish a common session key through a trusted server over an open communication channel using a three-party authenticated key agreement. Most of the early authenticated key agreement systems relied on pairing, hashing, or modular exponentiation processes that are computationally intensive and cost-prohibitive. In order to address this problem, this paper offers a new three-party authenticated key agreement technique based on fractional chaotic maps. The new scheme uses fractional chaotic maps and supports the dynamic sensing of HC-IoT devices in the network architecture without a password table. The projected security scheme utilized a hash function, which works well for the resource-limited HC-IoT architectures. Test results show that our new technique is resistant to password guessing attacks since it does not use a password. Furthermore, our approach provides users with comprehensive privacy protection, ensuring that a user forgery attack causes no harm. Finally, our new technique offers better security features than the techniques currently available in the literature. [ABSTRACT FROM AUTHOR]

The commercialization of the fifth-generation (5G) wireless network has begun. Massive devices are being integrated into 5G-enabled wireless sensor networks (5G WSNs) to deliver a variety of valuable services to network users. However, there are rising fears that 5G WSNs will expose sensitive user data to new security vulnerabilities. For secure end-to-end communication, key agreement and user authentication have been proposed. However, when billions of massive devices are networked to collect and analyze complex user data, more stringent security approaches are required. Data integrity, nonrepudiation, and authentication necessitate special-purpose subtree-based signature mechanisms that are pretty difficult to create in practice. To address this issue, this work provides an efficient, provably secure, lightweight subtree-based online/offline signature procedure (SBOOSP) and its aggregation (AggSBOOSP) for massive devices in 5G WSNs using conformable chaotic maps. The SBOOSP enables multi-time offline storage access while reducing processing time. As a result, the signer can utilize the pre-stored offline information in polynomial time. This feature distinguishes our presented SBOOSP from previous online/offline-signing procedures that only allow for one signature. Furthermore, the new procedure supports a secret key during the pre-registration process, but no secret key is necessary during the offline stage. The suggested SBOOSP is secure in the logic of unforgeability on the chosen message attack in the random oracle. Additionally, SBOOSP and Agg-SBOOSP had the lowest computing costs compared to other contending schemes. Overall, the suggested SBOOSP outperforms several preliminary security schemes in terms of performance and computational overhead. [ABSTRACT FROM AUTHOR]

With the increasing volume of data transmission through insecure communication channels, big data security has become one of the important concerns in the cybersecurity domain. To address these concerns and keep data safe, a robust privacy-preserving cryptosystem is necessary. Such a solution relies on chaos encryption algorithms over standard cryptographic methods that possess multistage encryption levels, including high speed, high security, low compute overheads, and procedural power, among other characteristics. In this work, a secure image encryption scheme is proposed using linear feedback shift register (LFSR) and chaos-based quantum chaotic map. The focus of the scheme is mainly dependent on the secret keys from the input of the algorithm. The threat landscape, the statistical test analysis, along critical comparisons with other schemes indicate that the presented algorithm is significantly secure and is resistant to a wide range of different attacks such as differential and statistical attacks. The proposed method has sufficiently higher sensitivity and security when compared to existing encryption algorithms. Several security parameters validated the security of proposed work such as correlation coefficient analyses among the neighboring pixels, entropy, the number of pixels change rate (NPCR), unified average change intensity (UACI), mean square error (MSE), brute force, key sensitivity, and peak signal to noise ratio (PSNR) analyses. The randomness of the ciphers produced by the proposed technique is also passed through NIST-800-22. The results of NIST indicate that the ciphers are highly random and do not produce any type of periodicity or pattern. [ABSTRACT FROM AUTHOR]

Elliptic curve cryptography ensures more safety and reliability than other public key cryptosystems of the same key size. In recent years, the use of elliptic curves in public-key cryptography has increased due to their complexity and reliability. Different kinds of substitution boxes are proposed to address the substitution process in the cryptosystems, including dynamical, static, and elliptic curve-based methods. Conventionally, elliptic curve-based S-boxes are based on prime field GF(p) but in this manuscript; we propose a new technique of generating S-boxes based on mordell elliptic curves over the Galois field GF(2n). This technique affords a higher number of possibilities to generate S-boxes, which helps to increase the security of the cryptosystem. The robustness of the proposed S-boxes against the well-known algebraic and statistical attacks is analyzed to classify its potential to generate confusion and achieve up to the mark results compared to the various schemes. The majority logic criterion results determine that the proposed S-boxes have up to the mark cryptographic strength. [ABSTRACT FROM AUTHOR]