Cryptanalysis and Improvement of ECC Based Authentication and Key Exchanging Protocols

Abstract

Elliptic curve cryptography (ECC) is extensively used in various multifactor authentication protocols. In this work, various recent ECC-based authentication and key exchange protocols are subjected to threat modeling and static analysis to detect vulnerabilities and to enhance them to be more secure against threats. This work demonstrates how currently-used ECC-based protocols are vulnerable to attacks. If protocols are vulnerable, damage could include critical data loss and elevated privacy concerns. The protocols considered in this work differ in their usage of security factors (e.g., passwords, pins and biometrics), encryption and timestamps. The threat model considers various kinds of attacks including denial of service, man in the middle, weak authentication and SQL injection. Countermeasures to reduce or prevent such attacks are suggested. Beyond cryptanalysis of current schemes and the proposal of new schemes, the proposed adversary model and criteria set forth provide a benchmark for the systematic evaluation of future two-factor authentication proposals.

An efficient cryptographic technique using modified Diffie–Hellman in wireless sensor networks

“…However, this procedure is susceptible to man-in-the-middle (MIM) attack. 21 The research in Suresh and Hegadi 22,23 focused on the IoT environment. Dual cryptography architecturesecure network communication (D-SN) is a data security method that uses DNA genes sequence for encryption with RSA and Data Encryption Standard (DES).…”

FPGA Implementation of Elliptic Curve Cryptoprocessor for Perceptual Layer of the Internet of Things

“…Therefore a generator point is shared only between the devices connected to communicate. This concept is implemented in the ECC primitive protocols [21], [23].…”

Further comments on ‘SFVCC: Chaotic map‐based security framework for vehicular cloud computing’

“…By simulating a clogging attack [1–5], an adversary forces a communicating entity to process a forged/replayed authentication request by the adversary impersonating on behalf of a legitimate entity. The clogging attack represents a significant class of denial of services (DoS) attack and quality of services (QoS) degradation attack [3–6].…”

“…By simulating a clogging attack [1–5], an adversary forces a communicating entity to process a forged/replayed authentication request by the adversary impersonating on behalf of a legitimate entity. The clogging attack represents a significant class of denial of services (DoS) attack and quality of services (QoS) degradation attack [3–6]. The clogging attack can be launched through the replay of old messages and get these accepted as legitimate and fresh ones from the receiving entity or adversary can try to construct a forged message, which can pass authentication requests from the receiving entity [6].…”