• ETRI Journal
• /
• v.38 no.4
• /
• pp.724-734
• /
• 2016

To achieve confidentiality, integrity, authentication, and non-repudiation simultaneously, the concept of signcryption was introduced by combining encryption and a signature in a single scheme. Certificate-based encryption schemes are designed to resolve the key escrow problem of identity-based encryption, as well as to simplify the certificate management problem in traditional public key cryptosystems. In this paper, we propose a new certificate-based signcryption scheme that has been proved to be secure against adaptive chosen ciphertext attacks and existentially unforgeable against chosen-message attacks in the random oracle model. Our scheme is not based on pairing and thus is efficient and practical. Furthermore, it allows a signcrypted message to be immediately verified by the public key of the sender. This means that verification and decryption of the signcrypted message are decoupled. To the best of our knowledge, this is the first signcryption scheme without pairing to have this feature.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.9 no.3
• /
• pp.1210-1230
• /
• 2015

Android is the world's most utilized smartphone OS which consequently, also makes it an attractive target for attackers. The most representative method of hacking used against Android apps is known as repackaging. This attack method requires extensive knowledge about reverse engineering in order to modify and insert malicious codes into the original app. However, there exists an easier way which circumvents the limiting obstacle of the reverse engineering. We have discovered a method of exploiting the Android code-signing process in order to mount a malware as an example. We also propose a countermeasure to prevent this attack. In addition, as a proof-of-concept, we tested a malicious code based on our attack technique on a sample app and improved the java libraries related to code-signing/verification reflecting our countermeasure.

• International Commerce and Information Review
• /
• v.1 no.2
• /
• pp.205-228
• /
• 1999

Intercompany online businesses can offer digital information to each company, and yet without legal verification business activities are less efficient. Just one single country cannot control this problem with its own EC law and now international cooperations are being required. Currently, International Regularization is the main agenda among the international organizations such as UNCITRAL, OECD and WTO and so on. Furthermore, most of the advanced nations, including the USA and EU, announce their fundamental strategies for the multilateral regularization in their favor. At the present stage, South Korea's Electronic Commerce law and Digital Signature law went into effect as from July 1, 1999, indicating that they can strike the keynote of the systematic infrastructure for the electronic commerce transactions in this country.

• ETRI Journal
• /
• v.36 no.3
• /
• pp.469-478
• /
• 2014

RSA signature algorithms using the Chinese remainder theorem (CRT-RSA) are approximately four-times faster than straightforward implementations of an RSA cryptosystem. However, the CRT-RSA is known to be vulnerable to fault attacks; even one execution of the algorithm is sufficient to reveal the secret keys. Over the past few years, several countermeasures against CRT-RSA fault attacks have tended to involve additional exponentiations or inversions, and in most cases, they are also vulnerable to new variants of fault attacks. In this paper, we review how Shamir's countermeasure can be broken by fault attacks and improve the countermeasure to prevent future fault attacks, with the added benefit of low additional costs. In our experiment, we use the side-channel analysis resistance framework system, a fault injection testing and verification system, which enables us to inject a fault into the right position, even to within $1{\mu}s$. We also explain how to find the exact timing of the target operation using an Atmega128 software board.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2002.11b
• /
• pp.178-181
• /
• 2002

본 논문에서는 서명의 동적 특징에 기반한 구간 분할과 3단계 정합을 특징으로 하는 온라인서명 인증 시스템을 제안한다. 온라인 서명 인증을 위해 구간 분할에 이은 구간별 정합이 널리 연구, 적용되어왔다. 그러나 기존의 구간 분할법은 정적 특징인 서명의 모양에 기반하므로 모조의 단서를 제공하는 위험이 있었다. 제안한 방법은 전자 펜의 속도나 가속도 등과 같은 동적 특징을 기반으로 구간 분할을 수행하므로써 모조가 어렵게 하였다. 분할된 구간들은 모델 서명의 구간들과 보강된 동적 프로그래밍(DP) 기법으로 대응 구간들을 찾도록 하였으며, 이 과정에서 정적 특징량을 제한 조건으로 사용하므로써 안정되게 대응 구간을 추출하였다. 또한 서명 특징들에 가중치를 부여하고, 정합 단계를 세 단계로 분리하므로써 상충 관계에 있는 Type Ⅰ과 Ⅱ오류를 최소화하였다. 실험은 온라인 서명 특징들간의 비교 분석을 통해 그들의 가중치를 결정하는 근거를 보이고, 동적 특징에 기반한 구간 분할의 유효성을 보였다.

• Proceedings of the Korean Institute of Intelligent Systems Conference
• /
• 2004.10a
• /
• pp.271-274
• /
• 2004

기존의 참조서명과 입력서명을 비교하는 방법 중 분절 단위 비교 방법은 전역적 방법과 점단위 방법에 비하여 우수한 장점을 가지고 있다. 그러나 분절 단위 비교 방법은 인식률과 직접적인 관계가 있는 분절의 불안정 문제점이 있다. 본 연구에서는 분절 단위 비교 방법을 이용한 서명검증의 신뢰도를 향상시키기 위해 두 가지 형태의 모델을 구축하였다. 우선 기존에 사용된 구간 분할 매칭 방법을 사용하여 매칭도를 산출하였다. 다음으로 서명의 분할된 영역을 주성분 분석 기법에 의해 특징 벡터를 산출한 후 HMM에 의해 서명 모델을 구축하였다. 산출된 두 특징을 융합하는 방법으로는 SVM 분류기를 사용하였다 실험 결과 제안된 기법은 분절 단위 기반의 구간분할매칭 기법에 비해 우수한 성능을 나타냈다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2007.10a
• /
• pp.106-107
• /
• 2007

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.4
• /
• pp.1864-1876
• /
• 2016

Card-Not-Present (CNP) transactions taking place remotely over the Internet are becoming more prevalent. Cardholder authentication should be provided to prevent the CNP fraud resulting from the theft of stored credit card numbers. To address the security problems associated with CNP transactions, the use of a virtual card number derived from the transaction details for the payment has been proposed, instead of the real card number. Since all of the virtual card number schemes proposed so far are based on a password shared between the cardholder and card issuer, transaction disputes due to the malicious behavior of one of the parties involved in the transaction cannot be resolved. In this paper, a new virtual card number scheme is proposed, which is associated with the cardholder's public key for signature verification. It provides strong cardholder authentication and non-repudiation of the transaction without deploying a public-key infrastructure, so that the transaction dispute can be easily resolved. The proposed scheme is analyzed in terms of its security and usability, and compared with the previously proposed schemes.

• Transactions of the Korean Society of Mechanical Engineers
• /
• v.17 no.12
• /
• pp.3045-3054
• /
• 1993

The mechanics related with piston-slap induced vibration has been studied in terms of non-dimensionalized dynamic equation of motion, various non-dimensional parameters such as non-dimensional side-thrust force and non-dimensional impact velocity throughout the numerical simulation. Experimental verification on the suggested prediction method has been also performed by using single cylinder engine which was carefully designed and manufactured to wisely control the engine parameters, especially clearance and the mass of piston. The predicted and experimentally observed vibration signature confirm that the proposed method is practically useful.

• ETRI Journal
• /
• v.41 no.6
• /
• pp.863-872
• /
• 2019

Elliptic curve cryptography is a relatively lightweight public-key cryptography method for key generation and digital signature verification. Some lightweight curves (eg, Curve25519 and Curve Ed448) have been adopted by upcoming Transport Layer Security 1.3 (TLS 1.3) to replace the standardized NIST curves. However, the efficient implementation of Curve Ed448 on Internet of Things (IoT) devices remains underexplored. This study is focused on the optimization of the Curve Ed448 implementation on low-end IoT processors (ie, 8-bit AVR and 16-bit MSP processors). In particular, the three-level and two-level subtractive Karatsuba algorithms are adopted for multi-precision multiplication on AVR and MSP processors, respectively, and two-level Karatsuba routines are employed for multi-precision squaring. For modular reduction and finite field inversion, fast reduction and Fermat-based inversion operations are used to mitigate side-channel vulnerabilities. The scalar multiplication operation using the Montgomery ladder algorithm requires only 103 and 73 M clock cycles on AVR and MSP processors.