• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.985-996
• /
• 2019

This paper analyzes the source code of FIPS-OpenSSL cryptographic module approved as FIPS cryptographic module in USA and shows how the selftest requirements are implemented as software cryptographic library with respect to pre-operational test and conditional tests. Even though FIPS-OpenSSL follows FIPS 140-2 standard, lots of security requirements are similar between FIPS 140-2 and Korean cryptographic module validation standards. Therefore, analysis from this paper contributes to help Korean cryptographic module vendors develop correct and secure selftest functions on their own cryptographic modules, which results in reducing the test period.

• International journal of advanced smart convergence
• /
• v.13 no.2
• /
• pp.69-79
• /
• 2024

AI technology is a central focus of the 4th Industrial Revolution. However, compared to some existing non-artificial intelligence technologies, new AI adversarial attacks have become possible in learning data management, input data management, and other areas. These attacks, which exploit weaknesses in AI encryption technology, are not only emerging as social issues but are also expected to have a significant negative impact on existing IT and convergence industries. This paper examines various cases of AI adversarial attacks developed recently, categorizes them into five groups, and provides a foundational document for developing security guidelines to verify their safety. The findings of this study confirm AI adversarial attacks that can be applied to various types of cryptographic modules (such as hardware cryptographic modules, software cryptographic modules, firmware cryptographic modules, hybrid software cryptographic modules, hybrid firmware cryptographic modules, etc.) incorporating AI technology. The aim is to offer a foundational document for the development of standardized protocols, believed to play a crucial role in rejuvenating the information security industry in the future.

• Convergence Security Journal
• /
• v.7 no.3
• /
• pp.61-70
• /
• 2007

In Windows operating system, CSPs(Cryptographic Service Providers) are provided for offering a easy and convenient way of using an various cryptographic algorithms to applications. The applications selectively communicate with various CSPs through a set of functions known as the Crypto API(Cryptographic Application Program Interface). During this process, a secure method, accessing data using a handle, is used in order to prevent analysis of the passing parameters to function between CryptoAPI and CSPs. In this paper, our experiment which is using a novel memory traceback method proves that still there is a vulnerability of private key and secret key disclosure in spite of the secure method above-mentioned.

• The Journal of Korean Institute of Electromagnetic Engineering and Science
• /
• v.18 no.10
• /
• pp.1117-1125
• /
• 2007

In this paper, a study has been performed on the design of small loop probe and analysis of induced electromagnetic wave signal from a smartcard for contactless cryptographic analysis. Probes for cryptographic analysis are different from conventional EM probes, because the purpose of proposed probe is to obtain the information for secret key analysis of cryptographic system. The waveform of induced voltage on probe must be very close to radiated waveform from IC chip on smartcard because electromagnetic attack makes an attempt to analyze the radiated waveform from smartcard. In order to obtain secret key information, we need to study about cryptographic analysis using electromagnetic waves, an approximate model of source, characteristic of probe for cryptographic analysis, measurement of electromagnetic waves and calibration of probes. We measured power consumption signal on a smartcard chip and electromagnetic wave signal using proposed probe and compared with two signals of EMA point of view. We verified experimently the suitability of the proposed small loop probe for contactless cryptographic analysis by applying ARIA algorithm.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.193-200
• /
• 2022

Unknown cryptographic communication protocols may have advantage of guaranteeing personal and data privacy, but when used for malicious purposes, it is almost impossible to identify and respond to using existing network security equipment. In particular, there is a limit to manually analyzing a huge amount of traffic in real time. Therefore, in this paper, we attempt to identify packets of unknown cryptographic communication protocols and separate fields comprising a packet by using machine learning techniques. Using sequential patterns analysis, hierarchical clustering, and Pearson's correlation coefficient, we found that the structure of packets can be automatically analyzed even for an unknown cryptographic communication protocol.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.6B
• /
• pp.219-232
• /
• 2008

A novel idea of protocol security analysis is presented based on trusted freshness. The idea has been implemented not only by hand but also by a belief muitisets formalism for automation. The key of the security analysis based on trusted freshness is a freshness principle: for each participant of a cryptographic protocol, the security of the protocol depends only on the sent or received one-way transformation of a message, which includes a trusted freshness. The manual security analysis method and the belief multisets formalism are all established on the basis of the freshness principle. Security analysis based on trusted freshness can efficiently distinguish whether a message is fresh or not, and the analysis results suggest the correctness of a protocol convincingly or the way to construct attacks intuitively from the absence of security properties. Furthermore, the security analysis based on trusted freshness is independent of the idealization of a protocol, the concrete formalization of attackers' possible behaviors, and the formalization of concurrent runs of protocols.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.12 no.12
• /
• pp.6161-6176
• /
• 2018

Pseudorandom numbers are useful in cryptographic operations for using as nonce, initial vector, secret key, etc. Security of the cryptosystem relies on the secret key parameters, so a good pseudorandom number is needed. In this paper, we have proposed a new approach for generation of pseudorandom number. This method uses the three dimensional combinational puzzle Rubik Cube for generation of random numbers. The number of possible combinations of the cube approximates to 43 quintillion. The large possible combination of the cube increases the complexity of brute force attack on the generator. The generator uses cryptographic hash function. Chaotic map is being employed for increasing random behavior. The pseudorandom sequence generated can be used for cryptographic applications. The generated sequences are tested for randomness using NIST Statistical Test Suite and other testing methods. The result of the tests and analysis proves that the generated sequences are random.

• Convergence Security Journal
• /
• v.14 no.4
• /
• pp.55-60
• /
• 2014

In this study, we propose a cryptographic module quality evaluation system referenced by ISO/IEC 9000 quality system with Quality, Quality Factor, Quality Subfactor, Metric. Practical application process encryption algorithm based on the encryption algorithm to encrypt the pros and cons valuation of diagnosis, point selection algorithm, analysis, and quality items(quality factor), eliciting constraints derived, such as the cryptographic module design quality evaluation system is set to step 5. The five steps are examples of field-based diagnostic tool for cryptographic operations, the most essential work to be done in order to derive one will work. 2-Factor encryption module for connection between indicator items(quality factor) to identify and ensure the quality of the item the constraints of the environment are two kinds of cryptographic operations. This study is an encryption module and a practical field application system, it presents the standardized model. We have to meet the rapid changes in information technology. The environment, development and the encryption algorithm applied to model a wide variety of on-site development encryption will be able to expect the efficiency.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.2
• /
• pp.339-346
• /
• 2018

Ransomware is a malicious program that requires money by encrypting data. The damage to ransomware is increasing worldwide, and targeted attacks for corporations, public institutions and hospitals are increasing. As a ransomware is serviced and distributed, its various usually emerge. Therefore, the accurate analysis of ransomware can be a decryption solution not only for that ransomware but also for its variants. In this paper, we analyze a cryptographic elements and encryption process for Erebus found in June, 2017, and investigate its cryptographic vulnerability and memory analysis.

• The KIPS Transactions:PartC
• /
• v.9C no.6
• /
• pp.799-808
• /
• 2002

According to the wide-spread of information transmission system over network, the use of cryptographic system to provide the integrity of transmitted message over network is increasing and the importance of that is emphasized. Because the security of the cryptographic system totally relies on the key, key management is a essential part of cryptographic system. A number of key agreement protocols have been proposed to far, but their rigorous security analysis is still open. In this paper, we analyze the features of Diffie-Hellman based standard key agreement protocols and provide the security analysis of those protocols against several kinds of active attacks.