• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.39B no.4
• /
• pp.242-250
• /
• 2014

Conventional researches of standard tool validating cryptographic algorithm have been studied for the internet environment, for the mobile internet. It is important to develop the validation tool for establishment of interoperability and convenience of users in the information systems. Therefore, this paper presents the validation tool of Elliptic Curve Cryptography algorithm that can test if following X9.62 technology standard specification. The validation tool can be applied all information securities using DES, SEED, AES, SHA-1/256/384/512, RSA-OAEP V2.0, V2.1, ECDSA, ECKCDSA, ECDH, etc. Moreover, we can enhance the precision of validation through several experiments and perform the validation tool in the online environment.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.17 no.12
• /
• pp.2883-2890
• /
• 2013

Correlation power analysis attack takes place at the point of operating a known value and a hidden value from a master key as an input. The hidden value can be found by analyzing a correlation between the result value and the measured power signal during the operation, witch makes it possible to estimate the master key from the hidden value. However, the correlation power analysis attack can be very difficult by changing the conditions that make the power analysis possible, when the known value and the operation is hidden, when it is impossible to estimate the master key from the hidden value, or when the correlation between the result value and the power signal is considerably lowered. Therefore this study proposes a software countermeasure using a secrete intermediate key to witch these conditions are applied.

• Journal of IKEEE
• /
• v.25 no.1
• /
• pp.174-179
• /
• 2021

An Edwards curve cryptography (EdCC) core supporting point scalar multiplication (PSM) on Edwards curves of Edwards25519 and Edwards448 was designed. For area-efficient implementation, finite field multiplier based on word-based Montgomery multiplication algorithm was designed, and the extended twisted Edwards coordinates system was adopted to implement point operations without division operation. As a result of synthesizing the EdCC core with 100 MHz clock, it was implemented with 24,073 equivalent gates and 11 kbits RAM, and the maximum operating frequency was estimated to be 285 MHz. The evaluation results show that the EdCC core can compute 299 and 66 PSMs per second on Edwards25519 and Edwards448 curves, respectively. Compared to the ECC core with similar structure, the number of clock cycles required for 256-bit PSM was reduced by about 60%, resulting in 7.3 times improvement in computational performance.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.24 no.11
• /
• pp.1470-1476
• /
• 2020

This paper describes a design of a lightweight security system-on-chip (SoC) suitable for the implementation of security protocols for IoT and mobile devices. The security SoC using Cortex-M0 as a CPU integrates hardware crypto engines including an elliptic curve cryptography (ECC) core, a SHA3 hash core, an ARIA-AES block cipher core and a true random number generator (TRNG) core. The ECC core was designed to support twenty elliptic curves over both prime field and binary field defined in the SEC2, and was based on a word-based Montgomery multiplier in which the partial product generations/additions and modular reductions are processed in a sub-pipelining manner. The H/W-S/W co-operation for elliptic curve digital signature algorithm (EC-DSA) protocol was demonstrated by implementing the security SoC on a Cyclone-5 FPGA device. The security SoC, synthesized with a 65-nm CMOS cell library, occupies 193,312 gate equivalents (GEs) and 84 kbytes of RAM.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.6
• /
• pp.57-68
• /
• 2004

Recently, Radio Frequency Identification (RFID) systems stands in the spotlight of industry as a common and useful tool in manufacturing, supply chain management (SCM) and stock management. In the near future, low-cost RFID Electronic Product Code; (EPC) or smart-labels may be a practical replacement for optical barcodes on consumer items. However, manufacturing cheap and small RFID tags, and developing secure RFID authentication Protocols are problems which need to be solved. In spite of advances in semiconductor technology, computation and storage ability of the tag are so limited that it is difficult and too expensive to apply existing crypto-systems to RFID tags. Thus it is necessary to create a new protocol which would require less storage space and lower computation costs and that is secure in the RFID system's environments. In this paper, we propose a RFID authentication protocol that is secure against location tracking and spoofing attacks. Our protocol can be used as a practical solution for privacy protection because it requires less computations in database than the previous RFID authentication protocol.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.2
• /
• pp.83-92
• /
• 2007

In connectionless packet network, if a sender encrypts packets by block chaining mode and send it to receiver, the receiver should decrypt packets in encrypted order that is not received order. Therefore, the performance and efficiency are lowered for crypto communication system. To solve this problem, we propose packet encryption scheme for connectionless packet network that can decrypt the packets independently, even if the received order of packets are changed or packets are missed. The scheme makes new IV(Initial Vector) using IV that created by key exchange process and salt that made by random number. We propose extended Cryptoki API that added packet encryption/decryption functions and mechanism for improving convenience and performance. We implement the scheme and get result that the performance increased about $1.5{\sim}l5.6$ times compare with in case of implementing using Cryptoki API in the test environment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.4
• /
• pp.117-134
• /
• 2010

A passive RFID tag which received attention as a future technology for automatic and quick identification faces some difficulties about security problems such as tag authentication, reader authentication, data protection, and untraceability in addition to cost and reliable identification. A representative passive RFID technology is the ISO/IEC 18000-6 Type C which is an international standard for 900 MHz UHF-band. This standard has some difficulties in applying to the security services such as originality verification, tag's internal information protection, and untraceability, because it does not provide high-level security solution. In this paper, we summarize security requirements of ISO/IEC ITC 1/SC 31 international standardization group, propose security protocols suitable for the UHF-band passive RFID system using a crypto engine, and analyze its security strength. In addition, we verify that it is possible to implement a tag conforming with the proposed security protocols by presenting concrete command/response pairs and cryptographic method.

• Journal of Service Research and Studies
• /
• v.7 no.4
• /
• pp.51-68
• /
• 2017

Financial technology (FinTech) is an emerging financial service sector include innovations in financial literacy and investment, retail banking, education, and crypto-currencies like bitcoin. One of the crucial branch of financial technology-third-party payment (TPP) is undergoing rapid growth, with online/mobile systems replacing offline financial systems. System quality and user attitudes are key perceptions driving third-party payment usage, the importance of these perceptions, however, may be different with countries as users' thinking varies from country to country. Thus, the purpose of this study is to elaborate how factors differ from China to Korea by drawing on the unified theory of acceptance and use of technology (UTAUT2). Additionally, this study also aims to propose a multi-attribute evaluation of the third-party online payment system based on analytic hierarchy process (AHP), fuzzy sets and technique for order performance by similarity to ideal solution (TOPSIS), to examine the relative importance of the perceptions influencing new technology adoption intention. The results showed that the price value has the most significant influence on Chinese perceptions, while the perceived credibility has the most significant effect on Korean perceptions. Sub-criteria also performs different results to Chinese and Korean third-party online payment system.

• Korean Security Journal
• /
• no.62
• /
• pp.9-33
• /
• 2020

This study presents aspects of the financing of terrorism using virtual-currencies. Fisrt of all, this introduces the conventional threat of the financing of terrorism and the analysis of current legal system regarding virtual-currency in South Korea. Next, the financing of terrorism cases are analyzed. With given analysis, the paper deals with its response and future extensions by technical and institutional aspects. The threats of the financing of terrorism are going higher after the appearance of virtual-currencies such as Bitcoin. There are two typical ways to use virtual-currencies by terrorist groups. One is to conduct public fund-raising in the social network system and the dark web. The other is to hack into virtual-currency exchange network in order to steal virtual currencies for developing the weapon of mass destruction. Specifically South Korea is top three country of trading virtual currencies and has been subject to virtual-currency hacking more than 10 cases. However, many countries including South Korea deal with virtual currencies as only innovative technology and means of investment, not the threats of the financing of terrorism. Under these circumstances, there a the legal contradiction. This article points this limit and absurdity. Also, it shows reasonable alternatives. All in all, given these aspects, the article proposes detailed policy directions.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.1
• /
• pp.63-70
• /
• 2009

Recently, in the security token based authentication system, there is an increasing trend of using fingerprint for the token holder verification, instead of passwords. However, the security of the fingerprint data is particularly important as the possible compromise of the data will be permanent. In this paper, we propose an approach for secure fingerprint verification by distributing both the secret and the computation based on the fuzzy vault(a cryptographic construct which has been proposed for crypto-biometric systems). That is, a user fingerprint template which is applied to the fuzzy vault is divided into two parts, and each part is stored into a security token and a server, respectively. At distributing the fingerprint template, we consider both the security level and the verification accuracy. Then, the geometric hashing technique is applied to solve the fingerprint alignment problem, and this computation is also distributed over the combination of the security token and the server in the form of the challenge-response. Finally, the polynomial can be reconstructed from the accumulated real points from both the security token and the server. Based on the experimental results, we confirm that our proposed approach can perform the fuzzy vault-based fingerprint verification more securely on a combination of a security token and a server without significant degradation of the verification accuracy.