One key requirement for many cryptograhic schemes is the generation of random numbers. Sequences of random numbers are used at several stages of a standard cryptographic protocol. One simple example is a Vernam cipher, where a string of random numbers is added to message string to generate encrypted code. C = M ⊕ K. It has been mathematically shown that this simple scheme is unbreakable if key K is as long as M and is used only once. The security of a cryptosystem shall not be based on keeping the algorithm secret but solely on keeping the key secret. The security of a random number generator (RNG) is related to the difficulty of predicting its future sequence values from past values. The quality and unpredictability of secret data is critical to securing communication by modern cryptographic techniques. The generation of such data for cryptographic purposes typically requires an unpredictable physical source of random data. We studied a chaotic circuit which consisted of an inductor, capacitance, diode and thus used for the BB84 protocol. We have studied both pseudo random and true random number generators and evaluated them through various tests like frequency, correlation, NIST etc.

No abstract

No abstract

No abstract

Security testing involves two approaches; the question of who should do it has two answers. Standard testing organizations using a traditional approach can perform functional security testing. For example, ensuring that access control mechanisms work as advertised is a classic functional testing exercise. Systematic security testing approaches should be seamlessly incorporated into software engineering curricula and software development process. Traditional software engineering textbooks failed to provide adequate methods and techniques for students and software engineers to bring security engineering approaches to software development process generating secure software as well as correct software. This paper argues that a security testing phase should be added to software development process with systematic approach to generating and conducting destructive security test sets following a complete coverage principle. Software engineers must have formal training on writing secure code. The security testing tasks include penetrating and destructive tests that are different from functional testing tasks currently covered in software engineering textbooks Moreover, component-based development and formal methods could be useful to produce secure code, as well as automatic security checking tools. Some experience of applying security testing principles in our software engineering method teaching is reported.