Search

User authentication is necessary to provide services on an application system and the Internet. Various authentication methods are used such as ID/PW, biometric, and OTP authentications. One of the popular authentications is ID/PW authentication. As an inputted password is transferred by one-way hash function and then stored in DB, it is difficult for the DB administrator to figure out the password inputted by the user. However, when DB is leaked, and there is the time to decode, the password can be hacked. The time and cost to decode the original message from the hash value corresponding a short password decrease. Therefore, if the password is short, then attacking cost is low, and password crack possibility is high. In the case where an attacker utilizes pre-computing rainbow tables, and the hash value of short passwords is leaked, the password that the user inputted can be cracked. In this research, to block rainbow table attacks, when the user generates a short password, by adding additional messages of identification information of a system or the user and extending the length of the password, we try to resolve the vulnerability of short passwords. By proposing a model to minimize the length of the password and the authority accordingly in mobile devices on which inputting passwords is not easy, we take security into consideration. Our proposal model is strong against rainbow table attack and provides efficient password system to users. It contributes to resolving password vulnerability and upgrades mobile users’ convenience in typing passwords.

Password leakage is one of the most serious threats for password-based user authentication. Although this problem has been extensively investigated over the last two decades, there is still no widely adopted solution. In this paper, we attempt to systematically understand the challenges behind this problem and investigate the feasibility of solving it. Since password leakage usually happens when a password is input during authentication, we focus on designing leakage-resilient password entry (LRPE) schemes in this study. We develop a broad set of design criteria and use them to construct a practical LRPE scheme named CoverPad, which not only improves leakage resilience but also retains most usability benefits of legacy passwords. Its practicability is further verified by an extended user study.

A disposable password is necessary to avoid any danger by the use of a static password and reinforce the user's authentication. In order to prevent personal information from being exposed, OTP generation algorithm is regarded as important. The OTP generation algorithm we suggest in this thesis generates 256-bit-size OTP Data by using Seed value and Time value. This value that the generated OTP Data are arranged with a matrix and a 32-bit-value is extracted on an irregular basis becomes the final value. We can find out that the more OTP generation frequency we have, the lower probability of clash tolerance we get in our suggested algorithm, compared to the previous algorithm.Key Words : Authentication, One Time Password, Random Number, Truncation Function, Collision Resistance * 본 논문은 2013년 동명대하교 교내 학술연구비에 의하여 지원되었음Received 22 October 2014, Revised 28 November 2014Accepted 20 January 2015Corresponding Author: Dong Ryool Kim(Dept. of Mechatronics Engineering, Tongmyong University)Email: drkim@tu.ac.kr Ⓒ The Society of Digital Policy & Management. All rights reserved. This is an open-access article distributed under the terms of the Creative Commons Attribution Non-Commercial License (http://creativecommons.org/licenses/by-nc/3.0), which permits unrestricted non-commercial use, distribution, and reproduction in any medium, provided the original work is ISSN: 1738-1916 properly cited.

Password checking systems traditionally allow login only if the correct password is submitted. Recent work on typo-tolerant password checking suggests that usability can be improved, with negligible security loss, by allowing a small number of typographical errors. Existing systems, however, can only correct a handful of errors, such as accidentally leaving caps lock on or incorrect capitalization of the first letter in a password. This leaves out numerous kinds of typos made by users, such as transposition errors, substitutions, or capitalization errors elsewhere in a password. Some users therefore receive no benefit from existing typo-tolerance mechanisms. We introduce personalized typo-tolerant password checking. In our approach, the authentication system learns over time the typos made by a specific user. In experiments using Mechanical Turk, we show that 45% of users would benefit from personalization. Therefore, we design a system, called TypTop, that securely implements personalized typo-tolerance. Underlying TypTop is a new stateful password-based encryption scheme that can be used to store recent failed login attempts. Our formal analysis shows that security in the face of an attacker that obtains the state of the system reduces to the difficulty of a brute-force dictionary attack against the real password. We implement TypTop for Linux and Mac OS login and report on a proof-of-concept deployment.

Password managers (aka stores or vaults) allow a user to store and retrieve (usually high-entropy) passwords for her multiple password-protected services by interacting with a "device" serving the role of the manager (e.g., a smartphone or an online third-party service) on the basis of a single memorable (low-entropy) master password. Existing password managers work well to defeat offline dictionary attacks upon web service compromise, assuming the use of high-entropy passwords is enforced. However, they are vulnerable to leakage of all passwords in the event the device is compromised, due to the need to store the passwords encrypted under the master password and/or the need to input the master password to the device (as in smartphone managers). Evidence exists that password managers can be attractive attack targets. In this paper, we introduce a novel approach to password management, called SPHINX, which remains secure even when the password manager itself has been compromised. In SPHINX, the information stored on the device is information theoretically independent of the user's master password - an attacker breaking into the device learns no information about the master password or the user's site-specific passwords. Moreover, an attacker with full control of the device, even at the time the user interacts with it, learns nothing about the master password - the password is not entered into the device in plaintext form or in any other way that may leak information on it. Unlike existing managers, SPHINX produces strictly high-entropy passwords and makes it compulsory for the users to register these randomized passwords with the web services, hence fully defeating offline dictionary attack upon service compromise. The design and security of SPHINX is based on the device-enhanced PAKE model of Jarecki et al. that provides the theoretical basis for this construction and is backed by rigorous cryptographic proofs of security. While SPHINX is suitable for different device and online platforms, in this paper, we report on its concrete instantiation on smartphones given their popularity and trustworthiness as password managers (or even two-factor authentication). We present the design, implementation and performance evaluation of SPHINX, offering prototype browser plugins, smartphone apps and transparent device-client communication. Based on our inspection analysis, the overall user experience of SPHINX improves upon current managers. We also report on a lab-based usability study of SPHINX, which indicates that users' perception of SPHINX security and usability is high and satisfactory when compared to regular password-based authentication. Finally, we discuss how SPHINX may be extended to an online service for the purpose of back-up or as an independent password manager.

User authentication through textual passwords is very common in computer systems due to its ease of use. However textual passwords are vulnerable to different kinds of security attacks, such as spyware and dictionary attacks. In order to overcome the deficiencies of textual password scheme, many graphical password schemes have been proposed. The proposed schemes could not fully replace textual passwords, due to usability and security issues. In this paper a text based user authentication scheme is proposed which improves the security of textual password scheme by modifying the password input method and adding a password transformation layer. In the proposed scheme alphanumeric password characters are represented by random decimal numbers which resist online security attacks such as shoulder surfing and key logger attacks. In the registration process password string is converted into a completely new string of symbols or characters before encryption. This strategy improves password security against offline attacks such as brute-force and dictionary attacks. In the proposed scheme passwords consist of alphanumeric characters therefore users are not required to remember any new kind of passwords such as used in graphical authentication. Hence password memorability burden has been minimized. However mean authentication time of the proposed scheme is higher than the textual password scheme due to the security measures taken for the online attacks.

Passwords are the most widely used form of online user authentication. In a traditional setup, the user, who has a human-memorable low entropy password, wants to authenticate with a login server. Unfortunately, existing solutions in this setting are either non-portable or insecure against many attacks, including phishing, man-in-the-middle, honeypot, and offline dictionary attacks. Three previous studies (Acar et al. 2013, Bicakci et al. 2011, and Jarecki et al. 2016) provide solutions secure against offline dictionary attacks by additionally employing a storage provider (either a cloud storage or a mobile device for portability). These works provide solutions where offline dictionary attacks are impossible as long as the adversary does not corrupt both the login server and the storage provider.

This paper analyzes several kinds of S/KEY One-time Password (OTP) identity authentication schemes, and designs a new OTP identity authentication scheme with the increasing hash chains. The new scheme overcomes the weakness of common OTP schemes which need to reset parameters when used, consequently reduces the sever burden, and does not need any kinds of assists provided by additional hardware or serves. Furthermore, it can realize the client - server authentication and resist the common network attacks.

Password authentication scheme using smart cards is an important part of securely accessing the server program. In 2012, Chen et al. proposed a robust smart-card-based remote user password authentication scheme. Recently, Li et al. discovered the scheme of Chen et al. cannot really ensure forward secrecy, and it cannot achieve the goal of efficiency for wrong password login. Then, they proposed an enhanced remote user password authentication scheme based on smart cards. In this paper, we propose a novel authentication scheme by using elliptic curve cryptography. The new scheme can achieve both the user anonymity and the goal of efficiency of incorrect password detection, and can also establish a session key for the subsequent secure communication. Moreover, we show by a detailed analysis that it requires lower computation cost while improving the security of the scheme.

this digital world all information and data is kept safe by passwords. The simple and convenient format of password is in the form of text. But, text passwords are not always strong enough and under different vulnerabilities they are very easily stolen and changed. When a person creates a weak password or same password is reused in many sites it may be possible that others can acquire that password. If one password is stolen, then it is possible that it can be used for all the websites. This phenomenon is known as the Domino Effect. Another possible risky attacks are related to phishing, malware and key loggers etc. A protocol is designed which makes use of the user's customer's mobile i.e. cellular phone and SMS (short message service) to ensure protection against password stealing attacks. This user authentication protocol is named as m-Pass. The unique phone number is required which will be possessed by each participating website. The telecommunication service provider plays important role in the registration and the recovery phases. The main theme is to reduce the password reuse attack. It works with one time password technology, and results in reduction of the password validity time. The results show improvement in performance of the security. KeywordsSecurity, m-Pass, Phishing, authentication

In recent times, Wei et al. proposed a secure smart card based on remote user password authentication scheme. Their scheme is more secure than other schemes. In this article, we will prove their scheme is vulnerable to password guessing attack, privileged insider attack, and denial of service attack. Furthermore, we will propose an improved scheme to eliminate the security vulnerability.

The recent increase in smartphone supply drives more users to utilize mobile financial services and it magnifies the importance of mobile security solutions. But it is not easy to defend cyber-attacks against financial services because the attacks get more diverse every year. The recent solution, OTP one time password, is the most commonly used financial security measure to defend session attacks, but the downside is that it is hard to implement differentiated OTP creation mechanism to it. This research intends to solve the problem by suggesting Two-Factor authentication mechanism that utilizes graphical OTP. It is an extension of OTP mechanism which implements the graphical one time password to mobile financial security to reinforce mobile's way of authenticating with only ID and Password or digital certificate from banks; and it will defend against more diverse mobile hackings.

Authentication of any system means providing a security to that system. There are number of authentication techniques like textual, biometrics etc. This type of textual password commonly follows an encryption algorithm to provide security. Each of these techniques has some limitations and drawbacks. To overcome the drawbacks, a new authenticate technique is now available. This new authentication technique, known as 3D Password, is multi-factor and multi-factor authentication technique. The most important part of 3D Password is virtual environment containing the user interface which looks like a real time environment, but is not actually a real time environment [3]. 3D password is more secure technique of authentication in comparison to other techniques because it is difficult to break and simple to use [1].

Smart card based password authentication is one of the simplest and efficient authentication mechanisms to ensure secure communication in insecure network environments. Recently, Chen et al. have pointed out the weaknesses of some password authentication schemes and proposed a robust smart card based remote user password authentication scheme to improve the security. As per their claims, their scheme is efficient and can ensure forward secrecy of the session key. However, we find that Chen et al.'s scheme cannot really ensure forward secrecy, and it cannot detect the wrong password in login phase. Besides, the password change phase of Chen et al.'s scheme is unfriendly and inefficient since the user has to communicate with the server to update his/her password. In this paper, we propose a modified smart card based remote user password authentication scheme to overcome the aforementioned weaknesses. The analysis shows that our proposed scheme is user friendly and more secure than other related schemes.

Remote user authentication schemes are use to identify a user in the distributed environment. There are three different factors commonly use for authentication purpose named as password, smart card and biometric. It is been observed that authentication protocols designed till date are based on password. Normally, password is used as a first authentication factor, where as other two factors are included according to the level of security requirements. In this paper, analysis of 3-factor based protocols is done on the basis of wrong password input and stolen smart card vulnerabilities. Paper also suggest the improvements to control these vulnerabilities.

This paper explains a method of how the two factor authentication implemented using SMS OTP or OTP generated by Smartphone- One Time Password to secure user accounts. The proposed method guarantees authenticating online banking features are secured also this method can be useful for e-shopping & ATM machines. The proposed system involves generating and delivering a One Time Password to mobile phone. Smartphone can be used as token for creating OTP or OTP can be send to mobile phone in form of SMS. The generated OTP is valid for only for short period of time and it is generated and verified using Secured Cryptographic Algorithm. The proposed system has been implemented and tested successfully. Keywords - OTP, Authentication, SHA-1, Cloud, token, Android

A multi-server authentication scheme is a useful authentication mechanism in which a remote user can access the services of multiple servers after registering with the registration center (RC). This study shows that the password-based multi-server authentication scheme proposed by Yeh and Lo is vulnerable to undetectable password-guessing attack and offline password-guessing attack. This study proposes a new password-based multi-server authentication scheme to overcome these vulnerabilities. The proposed protocol introduces a new mechanism for protecting user password. The RC sends an alternative key to help the server verify the legitimacy of user instead of the user's password. The values of these keys are changed with a random large nonce in each session. Therefore, the password-guessing attack cannot work successfully on the proposed scheme.

With the development of Internet technology, the traditional static password based authentication solutions are no longer an adequate protection scheme to various enterprise applications. In this article, the principle of dynamic password technology is described, and the pros and cons of implementing dynamic password technology by software and hardware are analyzed as well. In addition, a dynamic password mutual authentication protocol base on MAC/IMEI of client is designed. The system architecture, authentication processes and safety measures are described and its security is also analyzed, which proves the high security features and wide application of such system. The new OTP scheme can be conveniently used and implemented with significant cost efficiency. It is mutual authentication and resistant to phishing attacks.

While numerous flaws have been recognized in using passwords as a method of authentication, passwords still remain the de-facto authentication standard in use today. Though password managers can ameliorate password fatigue, the vast majority of password managers require the user to choose and maintain a strong master password while offering little to no recourse in the event that the master password is compromised. The wide-application of cloud-based password managers congregate passwords in an encrypted database, which becomes an attractive target for attackers and also represents a single point of failure. In this paper, we propose Amnesia, a bilateral generative password manager that requires both the knowledge of the master password and the possession of the user's smartphone to generate website passwords for the user. Our generative password manager is not vulnerable to the password database leakage, since it generates the requested password on demand using both the master password and the secret information on the smartphone. An attacker wishing to steal the user's website passwords has to compromise both the user's smartphone and the master password. Amnesia also has strong recovery capability when either the master password is compromised or the smartphone is lost/stolen. By using an Amnesia server, a user can have the access to the password manager on multiple computers without installing any software on those computers. We implemented an Amnesia system prototype using Android and Cherrypy web framework and evaluated it in terms of security, usability, and overhead. A user study of 31 testers shows that Amnesia increases password security while maintaining reasonable user convenience.

A two-server password-based authentication (2PA) protocol is a special kind of authentication primitive that provides additional protection for the user's password. Through a 2PA protocol, a user can distribute his low-entropy password between two authentication servers in the initialization phase and authenticate himself merely via a matching password in the login phase. No single server can learn any information about the user's password, nor impersonate the legitimate user to authenticate to the honest server. In this paper, we first formulate and realize the security definition of two-server password-based authentication in the well-known universal composability (UC) framework, which thus provides desirable properties such as composable security. We show that our construction is suitable for the asymmetric communication model in which one server acts as the front-end server interacting directly with the user and the other stays backstage.Then, we show that our protocol could be easily extended to more complicate password-based cryptographic protocols such as two-server password-authenticated key exchange (2PAKE) and two-server password-authenticated secret sharing (2PASS), which enjoy stronger security guarantees and better efficiency performances in comparison with the existing schemes.

Many Internet-based applications authenticate the users before they are allowed to access the services provided by them. The traditional text-based password system is vulnerable to brute force attack, peeping attack, and reverse engineering attacks. The pitfalls of text-based passwords are addressed by employing graphical passwords. To create a password the graphical password systems make use of custom images, icons, or faces. Using images will decrease the tendency to choose insecure passwords. In this paper, we present a shoulder-surfing resistant pair based graphical password scheme to authenticate a user. Further enhancement of the proposed scheme is briefly discussed. Security analysis of the method is also evaluated.

This paper defines the AES password algorithm used as a symmetric-key-based password algorithm, and proposes the design of parallel password algorithm to utilize the resources of multi-core processor as much as possible. The proposed parallel password algorithm was confirmed for parallel execution of password computation by allocating the password algorithm according to the number of cores, and about 30% of performance increase compared to AES password algorithm. The encryption/decryption performance of the password algorithm was confirmed through binary comparative analysis tool, which confirmed that the binary results were the same for AES password algorithm and proposed parallel password algorithm, and the decrypted binary were also the same. The parallel password algorithm for multi-core environment proposed in this paper can be applied to authentication/payment of financial service in PC, laptop, server, and mobile environment, and can be utilized in the area that required high-speed encryption operation of large-sized data.

A username and password based login mechanism is commonly used for authenticating a user in online environments. It is a popular scheme because it helps to balance the usability and security traits of the system. However, online environments and pervasive computing may bring many risks through adversaries. Shoulder-surfing attack is one of the risks where attacker observes the authentication process and captures the password of victims. This paper proposes a hybrid-based authentication scheme termed "Enhanced Virtual Password Authentication (EVPA)". EVPA is designed to implement a virtual password mechanism to resist the shoulder surfing attacks. The virtual password mechanism requires a string part of password and a mathematical functional value to secure user passwords. The mathematical functional value keeps changing for each login session. This method uses a system generated random value and secret mathematical operation against the pre-selected secret number to obtain a mathematical functional value. Several experiments were conducted and the results demonstrate that systems are resilient to password attacks and usable for day to day purposes.

By studying the Kerberos authentication scheme, an improved authentication scheme is raised, which is based on Dynamic Password Method. In the improved scheme, user's password can be effectively protected, and the authentication is double between users and severs. Also, the scheme can resist jacking connection attack. The improved scheme is more secure and more practical than the original one. Index Terms—identity authentication; dynamic password; security; improvement

In practice, the single sign-on system is likely to suffer password attack and replay attack, etc. For the purpose of resolving these problems, a new single sign-on scheme is raised, which is based on dynamic password method. In the new scheme, a specific design is given, and the security of this scheme is analyzed in details. In this scheme, through the universal dynamic password authentication, the user can visit all the services in the visiting range. At the same time, the scheme implements the connect authentication between the client and application servers.

The well-known password authentication mechanisms are widely used in networks to protect resources from unauthorized access. The ad hoc networks, due to their dynamic and lack of network infrastructure features, require authentication schemes to ensure security. In this paper, we propose a new threshold password authentication scheme for ad hoc networks. Our scheme can be efficiently implemented in mobile devices, and can achieve mutual authentication with registered users.

Recently, several one time password authentication schemes have been proposed. However, most one-time password authentication schemes have security flaws. In this paper, a novel one-time password authentication and key agreement scheme (EAKAS) based on elliptic curve digital signature chain is developed. The proposed scheme has the following merits password or verification table is not required in the server; users can choose or change password; it can resist off-line dictionary attacks and achieves mutual authentication; it has no system clock synchronization and no constraint of transmission delay; it can resist replay attacks, man-in-the-middle attack and insider attack; it is sensitive to password error and strong in security restoration; the session keys in proposed scheme have the feature of freshness, confidentiality, known key security and forward security. Compared with the related schemes, our proposed scheme has better security and well suited to scenarios requiring a high level security.

For the vast majority of computer systems, passwords are the method of choice for authenticating users. The most widely and commonly used authentication is traditional “Username” and “Password”. For such authentication generally text (alphanumeric) is used. It is wellknown, however, that passwords are susceptible to attack: users tend to choose passwords that are easy to remember, and often this means that they are also easy for an attacker to obtain by searching for candidate passwords. On the other hand, if a password is hard, then it is often hard to remember. Keeping these things in mind we propose a novel, innovative and more secure way of selecting passwords: Graphical Passwords. In this paper we explore an approach to user authentication that generalizes the notion of a textual password and that, in many cases, improves the security of user authentication over that provided by textual passwords. We design and analyze graphical passwords, which can be input by the user to any device with a graphical input interface. We also try to answer two most important questions: “Are graphical passwords as secure and easy to use as text-based passwords”? “Major design and implementation issues for graphical passwords”? Ankesh Khandelwal Department of Information Technology and Engineering Heritage Institute of Technology, Anandapur, Kolkata -700107, India Shashank Singh Department of Computer Science and Engineering Heritage Institute of Technology, Anandapur, Kolkata -700107, India Niraj Satnalika Department of Instrumentation and Engineering Heritage Institute of Technology, Anandapur, Kolkata -700107, India The full text of the article is not available in the cache. Kindly refer the IJCA digital library at www.ijcaonline.org for the complete article. In case, you face problems while downloading the full-text, please send a mail to editor at editor@ijcaonline.org

Recently, most of information services are provided by the computer network, since the technology of computer communication is developing rapidly, and the worth of information over the network is also increasing with expensive cost. But various attacks to quietly intercept the informations is invoked with the technology of communication developed, and then most of the financial agency currently have used OTP, which is generated by a token at a number whenever a user authenticates to a server, rather than general static password for some services. A 2-factor OTP generating method using the OTP token is mostly used by the financial agency. However, the method is vulnerable to real attacks and therefore the OTP token could be robbed and disappeared. In this paper, we propose a 3-factor OTP way using HMAC to conquer the problems and analyze the security of the proposed scheme.

The password-based authentication is widely used in client-server systems. This research presents a non-exchanged password scheme for password-based authentication. This scheme constructs a Digital Signature (DS) that is derived from the user password. The digital signature is then exchanged instead of the password itself for the purpose of authentication. Therefore, we refer to it as a Password-Based Digital Signature (PBDS) scheme. It consists of three phases, in the first phase a password-based Permutation (P) is computed using the Key-Based Random Permutation (KBRP) method. The second phase utilizes P to derive a Key (K) using the Password-Based Key Derivation (PBKD) algorithm. The third phase uses P and K to generate the exchanged DS. The scheme has a number of features that shows its advantages over other password authentication approaches.

Conventional password-based authentication has been widely used due to its simplicity, familiarity, and cost effectiveness. However, the conventional password-based authentication has a fundamental weak-point that cleartext passwords are kept on client-side devices and networks. In order to acquire a user's password securely, we suggest a novel method that splits the roles of user interface onto two devices. With our method, cleartext passwords are neither stored on any devices nor transmitted over communication channels. Finally, we implement a demo application and analyze our method in the aspects of usability, deployability, and security.

In many e-commerce systems, to counter network eavesdropping/replay attack, OTP concept has been used. However if the OTP itself gets attacked and then there might be possibility of attacking the account of the legitimate client too. This paper proposes a model for improving the security of OTP using ECC with iris biometric for an e-commerce transaction. This model also offers improve security with shorter key length than the RSA and also avoids to remember the private keys as the private keys are generated dynamically as and when required.

Graphical password authentication techniques have been opening new doors in the world of Password Security. This technique acquires graphical password authentication in such a way that it prevents Shoulder Surfing Attack when an adversary is watching a user while user enters a password. Graphical password authentication is more venerable to shoulder attack. The Servers Voice Graphical Authentication having graphical passwords prevents them along with the users ease. This technique involves a server voice coming to a user which the user only listens. Processes and then enters it into a graphical symbol pad. So this technique comprises of a server voice, then a factor of authentication Something You Process and lastly graphical password entrance.

Passwords are used for user authentication, validation, and verification in various software applications (may be Commercial, or Research based). All the existing schemes which are used to generate the password will always provide enough scope for the Intruder (Cracker) to crack or guess the password. All the existing schemes of password generation works on a basic assumption that the resultant password should be easy to remember for a user. This ultimately brings the downfall of the scheme. Therefore, a Password Generator Scheme is proposed here which will restrict the Intruders to crack the password or a scheme should exist which will cause sufficient delay in cracking of a password so that the Generator of the password will change the previous password. Here a strong password generator scheme is proposed by using Image Fusion & Visual key Cryptography.

Security and efficient data transmission without any hurdles caused by external Attackers is an issue in sensor networks. This paper deals with the provision of an assured efficient data transmission in the sensor networks. To ensure this requirement Hash based Message Authentication Code (HMAC) and Message Digest (MD) is envisaged by employing identity based digital signature scheme (IBS). Identity based scheme is an encryption scheme that generates an operation of developing secret code with secret key that protects the data during transmission without any cryptanalysis. To achieve the above requisite the modalities used in HMAC and MD5 which simulates the functional efficiency &security of data transmission in sensor networks.

Conducting financial transactions over the Internet has been widely adopted due to the convenience and usability. However, conducting financial transactions via the Internet may be subjected to many types of attacks including password attacks, malware, phishing, and other unauthorized activities. Many banks have enhanced their security by using One-Time Password (OTP) as another authentication method in addition to traditional username and password. The OTP may be sent to the mobile phone number of the account owner via SMS. Even with the enhanced security measure, internet banking is still vulnerable to different types of attacks such as online phishing. We propose, design, and implement a transaction authentication scheme using HMAC-based mobile OTP and QR Code. Our scheme is resilient to known attacks including, but not limited to, eavesdropping, replay, message modification, and phishing.

The HMAC algorithm is widely used to provide authentication and message integrity in digital communications. However, if the HMAC cryptographic algorithm is implemented in cryptographic circuit, it is vulnerable to side-channel attacks. A typical example is that in 2007, McEvoy proposed an attack strategy for hardware-based implementation of HMAC-SHA2. In this paper, we research on SM3 cryptographic hash algorithm and propose a DPA attack strategy for the software-based implementation of HMAC-SM3. In the experiment, we launch a successful DPA attack on the practical cryptographic circuit and then discuss the security issues about the software-based implementation of HMAC-SM3.