• Journal of information and communication convergence engineering
• /
• 제5권4호
• /
• pp.346-350
• /
• 2007

Almost all network systems provide an authentication mechanism based on user ID and password. In such system, it is easy to obtain the user password using a sniffer program with illegal eavesdropping. The one-time password and challenge-response method are useful authentication schemes that protect the user passwords against eavesdropping. In client/server environments, the one-time password scheme using time is especially useful because it solves the synchronization problem. It is the stability that is based on Square Root Problem, and we would like to suggest PBSI(Password Based Secure Identification), enhancing the stability, for all of the well-known attacks by now including Off-line dictionary attack, password file compromise, Server and so on. The PBSI is also excellent in the aspect of the performance.

• Journal of information and communication convergence engineering
• /
• 제3권4호
• /
• pp.213-216
• /
• 2005

Almost all network systems provide an authentication mechanism based on user ID and password. In such system, it is easy to obtain the user password using a sniffer program with illegal eavesdropping. The one-time password and challenge-response method are useful authentication schemes that protect the user passwords against eavesdropping. In client/server environments, the one-time password scheme using time is especially useful because it solves the synchronization problem. It is the stability that is based on Square Root Problem, and we would like to suggest PBI(password Based Identification), enhancing the stability, for all of the well-known attacks by now including Off-line dictionary attack, password file compromise, Server and so on. The PBI is also excellent in the aspect of the performance.

• 정보보호학회논문지
• /
• 제18권1호
• /
• pp.3-10
• /
• 2008

패스워드를 기반으로 하는 사용자 인증 및 키 교환 프로토콜은 사용자들이 쉽게 기억할 수 있는 패스워드를 사용하기 때문에 대부분의 경우에 패스워드 추측공격에 취약하다는 문제점이 있다. 본 논문에서는 동일 서버를 사용하는 두 사용자간의 패스워드 기반 키 교환 프로토콜과 패스워드 기반 인증 프로토콜이 모두 오프라인 패스워드 추측공격에 안전하지 못함을 보인다.

• 정보처리학회논문지C
• /
• 제11C권3호
• /
• pp.277-286
• /
• 2004

사용자의 인증기술로 패스워드를 기반으로 하는 메커니즘이 널리 사용되고 있다. 패스워드를 기반으로 하는 메커니즘은 사용자들이 기억하기 쉬운 패스워드를 선택하여 사용하는 경우가 대부분이므로 패스워드 추측 공격(password guessing attack)에 취약하다는 문제점이 있다. 이러한 패스워드 추측 공격을 방지하기 위해 많은 키 분배 프로토콜이 제안되고 있으며, 최근 Seo-Sweeny는 패스워드를 기반으로 하는 인증키 동의(SAKA Simple Authenticated Key Agreement) 프로토콜을 제안하였다. 본 논문에서는 먼저, 패스워드를 기반으로 하는 SAKA 프로토콜과 이를 개선한 방식들의 키 설정 및 키 확인 과정을 살펴보고, 각각의 프로토콜이 본 논문에서 정의한 Advanced Modification 공격에 대해 취약함을 보인다. 그리고 Advanced Modification 공격에 대해 안전한 패스워드 기반 인증 키 동의 프로토콜을 제안한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제9권12호
• /
• pp.5135-5149
• /
• 2015

Communications among multi-party must be fast, cost effective and secure. Today's computing environments such as internet conference, multi-user games and many more applications involve multi-party. All participants together establish a common session key to enable multi-party and secure exchange of messages. Multi-party password-based authenticated key exchange scheme allows users to communicate securely over an insecure network by using easy-to-remember password. Kwon et al. proposed a practical three-party password-based authenticated key exchange (3-PAKE) scheme to allow two users to establish a session key through a server without pre-sharing a password between users. However, Kwon et al.'s scheme cannot meet the security requirements of key authentication, key confirmation and anonymity. In this paper, we present a novel, simple and efficient multi-party password-based authenticated key exchange (M-PAKE) scheme based on the elliptic curve cryptography for mobile environment. Our proposed scheme only requires two round-messages. Furthermore, the proposed scheme not only satisfies security requirements for PAKE scheme but also achieves efficient computation and communication.

• International Journal of Computer Science & Network Security
• /
• 제23권3호
• /
• pp.161-168
• /
• 2023

It is a common practice to use a password in order to restrict access to information, or in a general sense, to assets. Right selection of the password is necessary for protecting the assets more effectively. Password finding/cracking try outs are performed for deciding which level of protection do used or prospective passwords offer, and password cracking algorithms are generated. These algorithms are becoming more intelligent and succeed in finding more number of passwords in less tries and in a shorter duration. In this study, the performances of possible password finding algorithms are measured, and a hybrid algorithm based on the performances of different password cracking algorithms is generated, and it is demonstrated that the performance of the hybrid algorithm is superior to the base algorithms.

• 한국컴퓨터정보학회논문지
• /
• 제17권9호
• /
• pp.65-73
• /
• 2012

기존의 텍스트 기반 패스워드들은 추측, 사전 공격, 키로거, 사회공학, 훔쳐 보기, 스파이웨어 등의 공격에 취약하고, 이는 모바일 환경에서 더욱 심각한 문제이다. 훔쳐보기 공격은 패스워드에 대한 대표적인 공격방법 중 하나로, 공격자는 로그인 과정을 직접 관찰하거나 사용자의 인증 과정을 녹화하는 방식으로 패스워드에 대한 정보를 얻을 수 있다. 이러한 취약점을 보완하기 위한 연구를 진행하였다. 본 논문에서 제안하는 패턴 기반의 숫자 패스워드 인증 기술에서는 길이가 긴 패턴 시퀀스로 사용자 인증함으로써 기존 패스워드의 보안성을 강화시키려 하였으며, 높은 보안성을 제공하면서 사용자로 하여금 4개의 숫자만을 기억하도록 하여 사용의 편의성은 침해하지 않으려 하였다. 그 결과로, 사용하기 편리하고 훔쳐보기 공격과 전사적 대입 공격을 방지하기 위한 새로운 패스워드 시스템을 제안하고 이에 대한 보안성과 유용성을 검토하고자 한다.

• 정보보호학회논문지
• /
• 제16권2호
• /
• pp.121-127
• /
• 2006

최근에 Chang등$^[9]$은 Yeh등$^[8]$이 제안한 패스워드 기반의 인증된 키교환 프로토콜의 성능을 향상시키기 위하여 새로운 패스워드 기반의 키교환 프로토콜과 패스워드 변경 프로토콜을 제안하였다. 그러나 Wang등$^[10]$은 Chang등의 패스워드 변경 프로토콜이 사전공격과 서비스거부 공격에 취약함을 제시하였다. 본 논문에서는 Chang등의 패스워드 변경 프로토콜에 존재하는 문제점을 해결하기 위한 개선된 프로토콜을 제안한다. 본 논문에서 제안한 프로토콜에서는 주고받는 메시지에서 패스워드를 유추하고 유추된 패스워드를 검증하는 것이 불가능하도록 메시지의 형태를 변경한다. 제안한 프로토콜은 기존의 패스워드 기반의 프로토콜이 갖는 장점을 유지하면서 이 방식의 문제점들을 효율적으로 해결한다.

• 디지털산업정보학회논문지
• /
• 제14권4호
• /
• pp.125-134
• /
• 2018

Lamport firstly suggested password base authentication scheme and then, similar authentication schemes have been studied. Due to the development of Internet network technology, remote user authentication using smart card has been studied. Li et al. analyzed authentication scheme of Chen et al. and then, Li et al. found out the security weakness of Chen et al.'s scheme such forward secrecy and the wrong password login problem, and proposed an a new smart card based user password authentication scheme. But Liu et al. found out that Li et al.'s scheme still had security problems such an insider attack and man-in-the-middle attack and then Liu et al. proposed an efficient and secure smart card based password authentication scheme. This paper analyzed Liu et al.'s authentication and found out that Liu et al.'s authentication has security weakness such as no perfect forward secrecy, off-line password guessing attack, smart-card loss attack, and no anonymity. And then, this paper proposed security enhanced efficient smart card based password authentication scheme using fuzzy extraction technology.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권11호
• /
• pp.5755-5772
• /
• 2019

Security is becoming more important as society changes rapidly. In addition, today's ICT environment demands changes in existing security technologies. As a result, password authentication methods are also changing. The authentication method most often used for security is password authentication. The most-commonly used passwords are text-based. Security enhancement requires longer and more complex passwords, but long, complex, text-based passwords are hard to remember and inconvenient to use. Therefore, authentication techniques that can replace text-based passwords are required today. Graphical passwords are more difficult to steal than text-based passwords and are easier for users to remember. In recent years, researches into graphical passwords that can replace existing text-based passwords are being actively conducting in various places throughout the world. This article surveys recent research and development directions of graphical password authentication systems in Korea. For this purpose, security authentication methods using graphical passwords are categorized into technical groups and the research associated with graphical passwords performed in Korea is explored. In addition, the advantages and disadvantages of all investigated graphical password authentication methods were analyzed along with their characteristics.