• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.7
• /
• pp.3371-3396
• /
• 2016

Authentication protocols for multi-server architectures have gained momentum in recent times due to advancements in computing technologies and associated constraints. Lu et al. recently proposed a biometrics and smartcards-based authentication scheme for multi-server environment. The careful analysis of this paper demonstrates Lu et al.'s protocol is susceptible to user impersonation attacks and comprises insufficient data. In addition, this paper proposes an improved authentication with key-agreement protocol for multi-server architecture based on biometrics and smartcards. The formal security of the proposed protocol is verified using the widely accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool to ensure that our protocol can withstand active and passive attacks. The formal and informal security analysis, and performance analysis sections determines that our protocol is robust and efficient compared to Lu et al.'s protocol and existing similar protocols.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.10 no.2
• /
• pp.388-395
• /
• 2009

Three-party authenticated key exchange protocol based on smartcards using XOR and hash function operation instead of the public key operation has been proposed in 2006. Recently, it is doing for research because of increasing interest in privacy. This paper pointed out that proposed three-party authenticated key exchange protocol in 2006 has some problems; it is user anonymity and slow wrong input detection, and then we proposed new one to overcome these problems.

• The KIPS Transactions:PartA
• /
• v.9A no.4
• /
• pp.429-440
• /
• 2002

Smartcard is a kind of computing device with it's own processor and memory Thus, the international money market is going to accomodate the use of smartcards instead of traditional magnetic cards for the future money market. EMV is a standard protocol for smartcards, proposed by Europay, Mastercard, and Visa, which are three famous international settlement organizations. This paper presents the implementation of EMV specifications for the smartcard terminals for supporting various application programs. This paper shows that the implemented EMV terminal passes the international approval tests.

• The KIPS Transactions:PartC
• /
• v.12C no.7 s.103
• /
• pp.959-964
• /
• 2005

Recently, Kim et al. proposed ID-based authentication schemes using smartcards and fingerprints. However, Scott showed that they were vulnerable to the passive eavesdropping attack. Thereby, this paper proposes an enhanced ID-based authentication scheme to solve the problems in Kin et al. scheme. Especially, the proposed scheme solves the ID repairability problem commonly shared in the previous ID based Cryptosystems. The proposed ID-based authentication scheme supports the advantages in the previous ID-based authentication scheme and solves the problems in them effectively.

• Journal of Korea Society of Industrial Information Systems
• /
• v.10 no.2
• /
• pp.59-66
• /
• 2005

Recently, Ku and Chen(Ku-Chen) showed some problems in the password based remote user authentication scheme using smartcards proposed by Chien et al. and proposed an improvement from it. This paper shows some weaknesses in the Ku-Chen's scheme, especially the replay attacks, and proposes two authentication protocols to solve the problems in it. First of all, an authentication protocol using synchronized timestamps is proposed to solve the problem in the Ku-Chen's protocol. Then, a nonce-based authentication protocol is proposed to solve the inherent problems in the synchronized timestamp-based authentication protocols. The proposed authentication protocols support the advantages in the previous password-based authentication protocols and solve the problems in them effectively.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.1
• /
• pp.99-107
• /
• 2005

ARIA is a 128-bit block cipher having 128-bit, 192-bit, or 256-bit key length. The cipher is a substitution and permutation encryption network (SPN) and uses an involutional binary matrix. This structure was efficiently developed into light weight environments or hardware implementations. This paper shows that a careless implementation of an ARIA on smartcards is vulnerable to a differential power analysis attack This attack is realistic because we can measure power consumption signals at two kinds of S-boxes and two types of substitution layers. By using the two round key, we extracted the master key (MK).

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.6
• /
• pp.73-80
• /
• 2006

Recently, Sun et el. proposed a three-party authenticated key exchange protocol using the public key of the server and the derived verifier from the Password of a user. This paper proposes a password-based three-party authenticated key exchange protocol using smartcards. Since the proposed protocol has very low computation cost by using XOR and hash function operation instead of the public key operation, and reduces the count of message transmission to 20% compared with the protocol of Sun et el., it can execute an effective authenticated key exchange. Furthermore, the proposed protocol is safe from password guessing attack by not saving passwords in the server, and it is also safe from server compromise attack because the server cannot know the shared session key between the two users.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.10 no.10
• /
• pp.2750-2759
• /
• 2009

In this paper, we analyze vulnerabilities in a remote authentication protocol using smartcards which was proposed by Bindu et al. and propose an improved scheme. The proposed scheme can prevent from restricted replay attack and denial of service attack by replacing time stamp with random number. In addition, this protocol can guarantee user anonymity by transmitting encrypted user's ID using AES cipher algorithm. The computational load in our protocol is decreased by removing heavy exponentiation operations and user efficiency is enhanced due to addition of password change phase in which a user can freely change his password. Furthermore, we really implement the proposed authentication protocol using a STM smartcard and authentication server. Then we prove the correctness and effectiveness of the proposed remote authentication system.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2006.06a
• /
• pp.148-152
• /
• 2006

스마트카드에 대한 전자파 분석 공격은 스마트카드 내의 마이크로프로세서가 연산될 때, 방사하는 의도되지 않은 전자파를 수집하여 비밀정보를 알아내는 공격이다. 이 경우에는 스마트카드에 어떤 훼손도 가하지 않고 비밀정보를 알아낼 수 있어, 기존에 국내외적으로 활발히 연구된 전력 분석 공격보다 더욱 현실적이고, 강력한 공격이다. 본 논문은 국내에서는 처음으로 스마트카드에 대한 전자파 분석 공격인 SEMA와 DEMA 공격 실험을 하였다. 그 결과 공개키 알고리즘인 RSA에 SEMA 공격을 성공하였고, 이에 대한 방어대책을 적용하여 방어를 하였다. 그리고, 국내 표준 블록 암호 알고리즘인 ARIA에 DEMA 공격을 적용하여, 비밀키를 알아냈다.

• Journal of Appropriate Technology
• /
• v.7 no.2
• /
• pp.172-187
• /
• 2021

In remote villages without access to modern IT technology, simple devices such as smartcards can be used to carry out business transactions. These devices typically store multiple business applications from multiple vendors. Although devices must prevent malicious or accidental security breaches among the applications, a secure communication channel between two applications from different vendors is often required. In this paper, first, we propose a method of establishing secure communication channels between applications in embedded operating systems that run on multi-applet smart cards. Second, we enforce the high assurance using an intransitive noninterference security policy. Thirdly, we formalize the method through the Z language and create the formal specification of the proposed secure system. Finally, we verify its correctness using Rushby's unwinding theorem.