• Title, Summary, Keyword: CNG library

Search Result 3, Processing Time 0.036 seconds

Analysis of SSL Communication Process in CNG Crypto Library (CNG 암호 라이브러리에서의 SSL 통신과정 분석)

  • Lee, Kyungroul;Oh, Insu;Lee, Sun-Young;Yim, Kangbin
    • The Journal of Korean Institute of Communications and Information Sciences
    • /
    • v.42 no.5
    • /
    • pp.1027-1037
    • /
    • 2017
  • By a spread of utilizing environment of the CNG library, it is required to analyze its vulnerability. For this reason, in this paper, we analyzed SSL communication process in CNG library. This study is expected to draw vulnerabilities and security threats and improve security criteria for various applications to fully take advantage of the CNG library.

Vulnerability Analysis on the CNG Crypto Library (CNG 암호 라이브러리의 보안 취약점 분석)

  • Lee, Kyungroul;Oh, Insu;Lee, Sun-Young;Yim, Kangbin
    • The Journal of Korean Institute of Communications and Information Sciences
    • /
    • v.42 no.4
    • /
    • pp.838-847
    • /
    • 2017
  • CNG which was released as a substitute of the previous CAPI (Cryptography API) library from Microsoft is constructed with individual modules based on the plug-in architecture, this means CNG is exceedingly helpful in the cost of development as well as the facility of extension. On the opposite side of these advantages, considerations on security issues are quite insufficient. Therefore, a research on security assurance is strongly required in the environment of distributing and utilizing the CNG library, hence, we analyze possible security vulnerabilities on the CNG library. Based on analyzed vulnerabilities, proof-of-concept tools are implemented and vulnerabilities are verified using them. Verified results are that contents of mail, account information of mail server, and authentication information of web-sites such as Amazon, E-bay, Google, and Facebook are exposed in Outlook program and Internet Explorer program using CNG library. We consider that the analyzed result in this paper can improve the security for various applications using CNG library.

An Analysis of a Structure and Implementation of Error-Detection Tool of Cryptography API-Next Generation(CNG) in Microsoft (마이크로소프트의 차세대 암호 라이브러리 구조에 관한 연구 및 오류-검출 도구 구현)

  • Lee, Kyungroul;You, Ilsun;Yim, Kangbin
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.26 no.1
    • /
    • pp.153-168
    • /
    • 2016
  • This paper introduces a structure, features and programming techniques for the CNG(Cryptography API: Next Generation), which is the substitution of the CAPI(Cryptography API) from Microsoft. The CNG allows to optimize a scope of functions and features because it is comprised of independent modules based on plug-in structure. Therefore, the CNG is competitive on development costs and agility to extend. In addition, the CNG supports various functions for the newest cryptographic algorithm, audit, kernel-mode programming with agility and possible to contribute for core cryptography services in a new environment. Therefore, based on these advantageous functions, we analyze the structure of CNG to extend it for the enterprise and the public office. In addition, we implement an error-detection tool for program which utilizes CNG library.