DOCSLIB.ORG

Evaluation of Some Blockcipher Modes of Operation

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Evaluation of Some Blockcipher Modes of Operation Evaluation of Some Blockcipher Modes of Operation Phillip Rogaway University of California, Davis Dept. of Computer Science Davis, California, USA E-mail: [email protected] URL: http://www.cs.ucdavis.edu/∼rogaway February 10, 2011 Evaluation carried out for the Cryptography Research and Evaluation Committees (CRYPTREC) for the Government of Japan ii Contents 1. Summary .......................................... 1 2. Preliminaries ....................................... 10 I Confidentiality Modes 15 3. ECB Mode ......................................... 24 4. CBC, CFB, and OFB Modes ............................. 30 5. CTR Mode ......................................... 45 6. XTS Mode ......................................... 53 II Authenticity Modes 66 7. CBC-MAC Algorithms 1–6 .............................. 72 8. CMAC Mode ....................................... 92 9. HMAC Mode ....................................... 97 10. GMAC Mode .......................................106 III Authenticated-Encryption Modes 112 11. CCM Mode ........................................117 12. Galois/Counter Mode ..................................125 Bibliography 138 End ................................................153 iii iv Acknowledgments Many thanks to Mihir Bellare for his drafting the chapter on HMAC. We also corresponded on other random matters that came up as I carried out this study. More broadly, many of the viewpoints embodied in this evaluation were co-developed with Mihir over a great many years. I received numerous insightful and useful comments, corrections, and answers to questions from colleagues Morris Dworkin, Niels Ferguson, Shai Halevi, Viet Tung Hoang, Ted Krovetz, David McGrew, Chanathip Namprempre, Bart Preneel,andKan Yasuda. My heartfelt thanks to everyone named for all your time and kind assistance. The work of this report was supported by the Cryptography Research and Evaluation Com- mittees (CRYPTREC), Japan. My contacts at the Mitsubishi Research Institute have included Dai Mochinaga, Miyako Ohkubo,andSachiko Yamada. Thanks for arranging contract formalities, answering questions, and providing documentation. I hope my report will serve your needs well. Phillip Rogaway February 2011 v vi Chapter 1 Summary 1.1. Overview. This report analyzes the security of some 17 cryptographic modes of operation described within some eight U.S. or international standards. Most of the schemes are well- known; many are widely used. The modes under consideration are the encryption schemes ECB, CBC, CFB, OFB, CTR, and XTS; the message authentication codes CMAC, HMAC, GMAC, and MAC Algorithms 1–6 of ISO 9797-1:1999; and the authenticated-encryption schemes CCM and GCM. The containing standards are FIPS 198-1, ISO/IEC 9797-1:1999, NIST SP 800-38A, NIST SP 800-38B, NIST SP 800-38C, NIST SP 800-38D, NIST SP 800-38E, and by reference from the last standard, IEEE 1619-2007 [61–65, 90, 91, 159]. Despite the modes being standardized and well-known, the quality varies. Some schemes are quite sensible and modern, while the value of others seems to be mostly in their legacy significance, or as building blocks for other schemes. In many cases it is unclear, to me, if a mode “ought” to be included in the CRYPTREC portfolio; the problem is that some well-entrenched schemes are, in fact, rather poor and dated designs. Correspondingly, I take my main goal as the description of what is known about each scheme, rather than an explication of what I think “should” be done. Still, I sometimes do offer opinions. I have tried to avoid being overly technical in these pages. The scope is too large, and the schemes too well-studied, for it to make sense to try to write up fresh proofs for everything. Doing so would easily turn this already-long manuscript into a book-length treatment. Instead, I have tried to explain the various results, point the reader to the relevant literature, and explain how, I think, the results should be interpreted. I divide the modes into three categories: (I) confidentiality modes, (II) authenticity modes, and (III) authenticated-encryption modes. See Figure 1.1. When I contracted for this project, CRYPTREC organized matters differently: eight techniques partitioned into two categories, named “modes of operation” and “message authentication codes.” I would like to clarify that all the schemes of this report can be viewed as modes of operation. 1.2. Evaluative approach. I have tried to instill a degree of uniformity in the evaluative process. I will, for each mode, be answering some or all of the following questions 1.2.1 What cryptographic problem does the mode try to solve? Problem identification is crucial, yet often ignored. A definition is sought, in the tradition of provable-security cryptography. Sometimes problem identification is trivial; we know, for example, that CCM is supposed to be a nonce-based authenticated-encryption scheme because the 1 1. Summary 2. Preliminaries Part III. Part I. Part II. Authenticated Confidentiality Authenticity Encryption 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. ECB CBC, CFB, OFB CTR XTS CBC-MACs CMAC HMAC GMAC CCM GCM blockcipher IV-based encryption schemes Conventional MACs nonce-based MAC nonce-based AEAD schemes Figure 1.1: Roadmap. The chart shows organization and logical dependencies among the chapters and parts of this documents. designers said this, and because the mode springs from that tradition. But what is the cryptographic problem a mode like ECB or XTS is supposed to solve? This is a less trivial question, and sometimes one that cannot be as definitively answered. Modes are often designed to achieve many aims, not all of them clear, formalized, or well understood. 1.2.2 What does the apparatus of provable security have to say about the mode’s security? Can one establish that the mode does its now-identified job under well-believed crypto- graphic assumptions? If so, under what assumptions? For blockcipher-based schemes, the preferred assumption is security as a pseudorandom-permutation (PRP). How tight are the reductions to breaking the underlying PRP? 1.2.3 What attacks are known against the scheme? Is there a quantitative gap between the known attacks and the proven bounds? Does the gap matter? 1.2.4 How efficient is the scheme? There are multiple characteristics that can matter for efficiency, and the relevant ones depend on that scheme’s goal. 1.2.5 How widely-used is the scheme already? If a mode has a long history or is extensively deployed, this alone can be a reason for standardization, other problems with the scheme notwithstanding. 1.2.6 How simple is the scheme? Good modes of operation are pretty things, elegant and minimal for accomplishing their aims. 1.2.7 How robust is the scheme against misuse? If one can expect that a scheme will rou- tinely be misused—used in ways contrary to what is required of the mode or guaranteed by the mode—this is certainly a problem. 1.2.8 How well understood is the scheme? Has the mechanism been widely studied? Have the important questions been answered, or do there remain important gaps in what we know? 1.2.9 How good is the specification document that describes the mode? While some might claim that a mechanism transcends the virtues or failings of its description, I believe the opposite, that the quality of the specification is part and parcel of the quality of the 2 scheme. For one thing, the specification document impacts the likelihood of a scheme being correctly or incorrectly used. Another aspect of this report is the simple fact of organizing this menagerie of modes in some coherent way. The taxonomy of Figure 1.1 was not the only possible approach. 1.3. The positive role of the standards bodies. This report takes a fresh look at eight different standards—six from NIST and one each from the IEEE and ISO/IEC. Overall, the assessment I will give may sound fairly critical about this body of work. This does not repre- sent my actual view. Quite the opposite; the modes are, collectively, quite good, and NIST, in particular, has shown commendable leadership in their work on standardizing (or “recommend- ing”) modes of operation. If it was once true that, in cryptography, each standards body liked to wait around for the other to act, this most definitely is not the case today. Some of the negativism one will see in this report may be a bit half-hearted and pro forma: academics are supposed to be critical of what we review; it is wired in our brains. Any piece of completed work could have been better done, and a critique should bring out these shortcomings. A negative-sounding critique should not be understood as an overall negative opinion of a standard or a mode contained therein; it is par for the course. More concretely, I would make the following comments to help balance the possibly negative- sounding tenor of this report. First, that all of the modes embodied in FIPS 198-1 and NIST Recommendations SP 800-38B (CMAC), SP 800-38C (CCM), SP 800-38D (GCM), and SP 800- 38E—standards for HMAC, CMAC, CCM, GCM, and XTS, respectively—owe their existence to the provable-security tradition. In standardizing this set of techniques, NIST has ushered in a new age in symmetric cryptography, one where everything “above” the level of a blockcipher (or hash function or compression function) is designed using, and proven with, the provable- security chest of tools and ideas. Recommendation SP 800-38A, while not standardizing any fundamentally new technique, expanded the repertoire of sanctioned modes by including a method—CTR mode—that gains its importance equally
Load more

Recommended publications
  • GPU-Based Password Cracking on the Security of Password Hashing Schemes Regarding Advances in Graphics Processing Units
    Radboud University Nijmegen Faculty of Science Kerckhoffs Institute Master of Science Thesis GPU-based Password Cracking On the Security of Password Hashing Schemes regarding Advances in Graphics Processing Units by Martijn Sprengers [email protected] Supervisors: Dr. L. Batina (Radboud University Nijmegen) Ir. S. Hegt (KPMG IT Advisory) Ir. P. Ceelen (KPMG IT Advisory) Thesis number: 646 Final Version Abstract Since users rely on passwords to authenticate themselves to computer systems, ad- versaries attempt to recover those passwords. To prevent such a recovery, various password hashing schemes can be used to store passwords securely. However, recent advances in the graphics processing unit (GPU) hardware challenge the way we have to look at secure password storage. GPU's have proven to be suitable for crypto- graphic operations and provide a significant speedup in performance compared to traditional central processing units (CPU's). This research focuses on the security requirements and properties of prevalent pass- word hashing schemes. Moreover, we present a proof of concept that launches an exhaustive search attack on the MD5-crypt password hashing scheme using modern GPU's. We show that it is possible to achieve a performance of 880 000 hashes per second, using different optimization techniques. Therefore our implementation, executed on a typical GPU, is more than 30 times faster than equally priced CPU hardware. With this performance increase, `complex' passwords with a length of 8 characters are now becoming feasible to crack. In addition, we show that between 50% and 80% of the passwords in a leaked database could be recovered within 2 months of computation time on one Nvidia GeForce 295 GTX.
    [Show full text]
  • Security Evaluation of Stream Cipher Enocoro-128V2
    Security Evaluation of Stream Cipher Enocoro-128v2 Hell, Martin; Johansson, Thomas 2010 Link to publication Citation for published version (APA): Hell, M., & Johansson, T. (2010). Security Evaluation of Stream Cipher Enocoro-128v2. CRYPTREC Technical Report. Total number of authors: 2 General rights Unless other specific re-use rights are stated the following general rights apply: Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal Read more about Creative commons licenses: https://creativecommons.org/licenses/ Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. LUND UNIVERSITY PO Box 117 221 00 Lund +46 46-222 00 00 Security Evaluation of Stream Cipher Enocoro-128v2 Martin Hell and Thomas Johansson Abstract. This report presents a security evaluation of the Enocoro- 128v2 stream cipher. Enocoro-128v2 was proposed in 2010 and is a mem- ber of the Enocoro family of stream ciphers. This evaluation examines several different attacks applied to the Enocoro-128v2 design. No attack better than exhaustive key search has been found.
    [Show full text]
  • IMPLEMENTATION and BENCHMARKING of PADDING UNITS and HMAC for SHA-3 CANDIDATES in FPGAS and ASICS by Ambarish Vyas a Thesis Subm
    IMPLEMENTATION AND BENCHMARKING OF PADDING UNITS AND HMAC FOR SHA-3 CANDIDATES IN FPGAS AND ASICS by Ambarish Vyas A Thesis Submitted to the Graduate Faculty of George Mason University in Partial Fulfillment of The Requirements for the Degree of Master of Science Computer Engineering Committee: Dr. Kris Gaj, Thesis Director Dr. Jens-Peter Kaps. Committee Member Dr. Bernd-Peter Paris. Committee Member Dr. Andre Manitius, Department Chair of Electrical and Computer Engineering Dr. Lloyd J. Griffiths. Dean, Volgenau School of Engineering Date: ---J d. / q /9- 0 II Fall Semester 2011 George Mason University Fairfax, VA Implementation and Benchmarking of Padding Units and HMAC for SHA-3 Candidates in FPGAs and ASICs A thesis submitted in partial fulfillment of the requirements for the degree of Master of Science at George Mason University By Ambarish Vyas Bachelor of Science University of Pune, 2009 Director: Dr. Kris Gaj, Associate Professor Department of Electrical and Computer Engineering Fall Semester 2011 George Mason University Fairfax, VA Copyright c 2011 by Ambarish Vyas All Rights Reserved ii Acknowledgments I would like to use this oppurtunity to thank the people who have supported me throughout my thesis. First and foremost my advisor Dr.Kris Gaj, without his zeal, his motivation, his patience, his confidence in me, his humility, his diverse knowledge, and his great efforts this thesis wouldn't be possible. It is difficult to exaggerate my gratitude towards him. I also thank Ekawat Homsirikamol for his contributions to this project. He has significantly contributed to the designs and implementations of the architectures. Additionally, I am indebted to my student colleagues in CERG for providing a fun environment to learn and giving invaluable tips and support.
    [Show full text]
  • Horizontal PDF Slides
    1 2 Speed, speed, speed $1000 TCR hashing competition D. J. Bernstein Crowley: “I have a problem where I need to make some University of Illinois at Chicago; cryptography faster, and I’m Ruhr University Bochum setting up a $1000 competition funded from my own pocket for Reporting some recent work towards the solution.” symmetric-speed discussions, Not fast enough: Signing H(M), especially from RWC 2020. where M is a long message. Not included in this talk: “[On a] 900MHz Cortex-A7 NISTLWC. • [SHA-256] takes 28.86 cpb ::: Short inputs. • BLAKE2b is nearly twice as FHE/MPC ciphers. • fast ::: However, this is still a lot slower than I’m happy with.” 1 2 3 Speed, speed, speed $1000 TCR hashing competition Instead choose random R and sign (R; H(R; M)). D. J. Bernstein Crowley: “I have a problem where I need to make some Note that H needs only “TCR”, University of Illinois at Chicago; cryptography faster, and I’m not full collision resistance. Ruhr University Bochum setting up a $1000 competition Does this allow faster H design? funded from my own pocket for TCR breaks how many rounds? Reporting some recent work towards the solution.” symmetric-speed discussions, Not fast enough: Signing H(M), especially from RWC 2020. where M is a long message. Not included in this talk: “[On a] 900MHz Cortex-A7 NISTLWC. • [SHA-256] takes 28.86 cpb ::: Short inputs. • BLAKE2b is nearly twice as FHE/MPC ciphers. • fast ::: However, this is still a lot slower than I’m happy with.” 1 2 3 Speed, speed, speed $1000 TCR hashing competition Instead choose random R and sign (R; H(R; M)).
    [Show full text]
  • Lecture9.Pdf
    Merkle- Suppose H is a Damgaord hash function built from a secure compression function : several to build a function ways keyed : m : = H Ilm 1 . end FCK ) (k ) Prep key , " " ↳ - Insecure due to structure of Merkle : can mount an extension attack: H (KH m) can Barnyard given , compute ' Hlkllmllm ) by extending Merkle- Danged chain = : m : 2 . FCK ) 11k) Append key , Hlm ↳ - - to : Similar to hash then MAC construction and vulnerable same offline attack adversary finds a collision in the - - > Merkle and uses that to construct a for SHA I used PDF files Barnyard prefix forgery f , they ↳ - Structure in SHA I (can matches exploited collision demonstration generate arbitrary collisions once prefix ) ' = : FCK m - H on h 3. method , ) ( K HMH K) for reasonable randomness ( both Envelope pseudo assumptions e.g , : = - = i - - : F ( m m } : h K m h m k 4. nest ( ki ) H Ck H (k m ( , and m ( ) is a PRF both Two , kz , ) (ka HH , )) F- , ) ) Falk , ) , ) key , - of these constructions are secure PRFS on a variable size domain hash- based MAC ✓ a the - nest with correlated : HMAC is PRF / MAC based on two key (though keys) : = m H H ka m HMACCK ( K H ( , )) , ) , where k ← k ④ and kz ← k to , ipad opad and and are fixed ( in the HMAC standard) ipad opad strings specified I 0×36 repeated %x5C repeated : k . a Since , and ka are correlated need to make on h remains under Sety , stronger assumption security leg , pseudorandom related attack) Instantiations : denoted HMAC- H where H is the hash function Typically , HMAC- SHAI %" - - HMAC SHA256
    [Show full text]
  • Analysis of Selected Block Cipher Modes for Authenticated Encryption
    Analysis of Selected Block Cipher Modes for Authenticated Encryption by Hassan Musallam Ahmed Qahur Al Mahri Bachelor of Engineering (Computer Systems and Networks) (Sultan Qaboos University) – 2007 Thesis submitted in fulfilment of the requirement for the degree of Doctor of Philosophy School of Electrical Engineering and Computer Science Science and Engineering Faculty Queensland University of Technology 2018 Keywords Authenticated encryption, AE, AEAD, ++AE, AEZ, block cipher, CAESAR, confidentiality, COPA, differential fault analysis, differential power analysis, ElmD, fault attack, forgery attack, integrity assurance, leakage resilience, modes of op- eration, OCB, OTR, SHELL, side channel attack, statistical fault analysis, sym- metric encryption, tweakable block cipher, XE, XEX. i ii Abstract Cryptography assures information security through different functionalities, es- pecially confidentiality and integrity assurance. According to Menezes et al. [1], confidentiality means the process of assuring that no one could interpret infor- mation, except authorised parties, while data integrity is an assurance that any unauthorised alterations to a message content will be detected. One possible ap- proach to ensure confidentiality and data integrity is to use two different schemes where one scheme provides confidentiality and the other provides integrity as- surance. A more compact approach is to use schemes, called Authenticated En- cryption (AE) schemes, that simultaneously provide confidentiality and integrity assurance for a message. AE can be constructed using different mechanisms, and the most common construction is to use block cipher modes, which is our focus in this thesis. AE schemes have been used in a wide range of applications, and defined by standardisation organizations. The National Institute of Standards and Technol- ogy (NIST) recommended two AE block cipher modes CCM [2] and GCM [3].
    [Show full text]
  • MD5 Collisions the Effect on Computer Forensics April 2006
    Paper MD5 Collisions The Effect on Computer Forensics April 2006 ACCESS DATA , ON YOUR RADAR MD5 Collisions: The Impact on Computer Forensics Hash functions are one of the basic building blocks of modern cryptography. They are used for everything from password verification to digital signatures. A hash function has three fundamental properties: • It must be able to easily convert digital information (i.e. a message) into a fixed length hash value. • It must be computationally impossible to derive any information about the input message from just the hash. • It must be computationally impossible to find two files to have the same hash. A collision is when you find two files to have the same hash. The research published by Wang, Feng, Lai and Yu demonstrated that MD5 fails this third requirement since they were able to generate two different messages that have the same hash. In computer forensics hash functions are important because they provide a means of identifying and classifying electronic evidence. Because hash functions play a critical role in evidence authentication, a judge and jury must be able trust the hash values to uniquely identify electronic evidence. A hash function is unreliable when you can find any two messages that have the same hash. Birthday Paradox The easiest method explaining a hash collision is through what is frequently referred to as the Birthday Paradox. How many people one the street would you have to ask before there is greater than 50% probability that one of those people will share your birthday (same day not the same year)? The answer is 183 (i.e.
    [Show full text]
  • GCM) for Confidentiality And
    NIST Special Publication 800-38D Recommendation for Block DRAFT (April, 2006) Cipher Modes of Operation: Galois/Counter Mode (GCM) for Confidentiality and Authentication Morris Dworkin C O M P U T E R S E C U R I T Y Abstract This Recommendation specifies the Galois/Counter Mode (GCM), an authenticated encryption mode of operation for a symmetric key block cipher. KEY WORDS: authentication; block cipher; cryptography; information security; integrity; message authentication code; mode of operation. i Table of Contents 1 PURPOSE...........................................................................................................................................................1 2 AUTHORITY.....................................................................................................................................................1 3 INTRODUCTION..............................................................................................................................................1 4 DEFINITIONS, ABBREVIATIONS, AND SYMBOLS.................................................................................2 4.1 DEFINITIONS AND ABBREVIATIONS .............................................................................................................2 4.2 SYMBOLS ....................................................................................................................................................4 4.2.1 Variables................................................................................................................................................4
    [Show full text]
  • Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives
    Self-encrypting deception: weaknesses in the encryption of solid state drives Carlo Meijer Bernard van Gastel Institute for Computing and Information Sciences School of Computer Science Radboud University Nijmegen Open University of the Netherlands [email protected] and Institute for Computing and Information Sciences Radboud University Nijmegen Bernard.vanGastel@{ou.nl,ru.nl} Abstract—We have analyzed the hardware full-disk encryption full-disk encryption. Full-disk encryption software, especially of several solid state drives (SSDs) by reverse engineering their those integrated in modern operating systems, may decide to firmware. These drives were produced by three manufacturers rely solely on hardware encryption in case it detects support between 2014 and 2018, and are both internal models using the SATA and NVMe interfaces (in a M.2 or 2.5" traditional form by the storage device. In case the decision is made to rely on factor) and external models using the USB interface. hardware encryption, typically software encryption is disabled. In theory, the security guarantees offered by hardware encryp- As a primary example, BitLocker, the full-disk encryption tion are similar to or better than software implementations. In software built into Microsoft Windows, switches off software reality, we found that many models using hardware encryption encryption and completely relies on hardware encryption by have critical security weaknesses due to specification, design, and implementation issues. For many models, these security default if the drive advertises support. weaknesses allow for complete recovery of the data without Contribution. This paper evaluates both internal and external knowledge of any secret (such as the password).
    [Show full text]
  • Authenticated Encryption for Memory Constrained Devices
    Authenticated Encryption for Memory Constrained Devices By Megha Agrawal A thesis submitted in partial fulfillment for the degree of Doctor of Philosophy in Computer Science & Engineering to the Indraprastha Institute of Information Technology, Delhi (IIIT-Delhi) Supervisors: Dr. Donghoon Chang (IIIT Delhi) Dr. Somitra Sanadhya (IIT Jodhpur) September 2020 Certificate This is to certify that the thesis titled - \Authenticated Encryption for Memory Constrained Devices" being submitted by Megha Agrawal to Indraprastha Institute of Information Technology, Delhi, for the award of the degree of Doctor of Philosophy, is an original research work carried out by her under our supervision. In our opinion, the thesis has reached the standards fulfilling the requirements of the regulations relating to the degree. The results contained in this thesis have not been submitted in part or full to any other university or institute for the award of any degree/diploma. Dr. Donghoon Chang September, 2020 Department of Computer Science Indraprastha Institute of Information Technology, Delhi New Delhi, 110020 ii To my family Acknowledgments Firstly, I would like to express my sincere gratitude to my advisor Dr. Donghoon Chang for the continuous support of my Ph.D study and related research, for his patience, motivation, and immense knowledge. His guidance helped me in all the time of research and writing of this thesis. I could not have imagined having a better advisor and mentor for my Ph.D study. I also express my sincere gratitude to my esteemed co-advisor, Dr. Somitra Sanadhya, who has helped me immensely throughout my Ph.D. life. I thank my fellow labmates for the stimulating discussions, and for all the fun we have had in during these years.
    [Show full text]
  • Report on the AES Candidates
    Rep ort on the AES Candidates 1 2 1 3 Olivier Baudron , Henri Gilb ert , Louis Granb oulan , Helena Handschuh , 4 1 5 1 Antoine Joux , Phong Nguyen ,Fabrice Noilhan ,David Pointcheval , 1 1 1 1 Thomas Pornin , Guillaume Poupard , Jacques Stern , and Serge Vaudenay 1 Ecole Normale Sup erieure { CNRS 2 France Telecom 3 Gemplus { ENST 4 SCSSI 5 Universit e d'Orsay { LRI Contact e-mail: [email protected] Abstract This do cument rep orts the activities of the AES working group organized at the Ecole Normale Sup erieure. Several candidates are evaluated. In particular we outline some weaknesses in the designs of some candidates. We mainly discuss selection criteria b etween the can- didates, and make case-by-case comments. We nally recommend the selection of Mars, RC6, Serp ent, ... and DFC. As the rep ort is b eing nalized, we also added some new preliminary cryptanalysis on RC6 and Crypton in the App endix which are not considered in the main b o dy of the rep ort. Designing the encryption standard of the rst twentyyears of the twenty rst century is a challenging task: we need to predict p ossible future technologies, and wehavetotake unknown future attacks in account. Following the AES pro cess initiated by NIST, we organized an op en working group at the Ecole Normale Sup erieure. This group met two hours a week to review the AES candidates. The present do cument rep orts its results. Another task of this group was to up date the DFC candidate submitted by CNRS [16, 17] and to answer questions which had b een omitted in previous 1 rep orts on DFC.
    [Show full text]
  • Implementation and Performance Analysis of PBKDF2, Bcrypt, Scrypt Algorithms
    Implementation and Performance Analysis of PBKDF2, Bcrypt, Scrypt Algorithms Levent Ertaul, Manpreet Kaur, Venkata Arun Kumar R Gudise CSU East Bay, Hayward, CA, USA. [email protected], [email protected], [email protected] Abstract- With the increase in mobile wireless or data lookup. Whereas, Cryptographic hash functions are technologies, security breaches are also increasing. It has used for building blocks for HMACs which provides become critical to safeguard our sensitive information message authentication. They ensure integrity of the data from the wrongdoers. So, having strong password is that is transmitted. Collision free hash function is the one pivotal. As almost every website needs you to login and which can never have same hashes of different output. If a create a password, it’s tempting to use same password and b are inputs such that H (a) =H (b), and a ≠ b. for numerous websites like banks, shopping and social User chosen passwords shall not be used directly as networking websites. This way we are making our cryptographic keys as they have low entropy and information easily accessible to hackers. Hence, we need randomness properties [2].Password is the secret value from a strong application for password security and which the cryptographic key can be generated. Figure 1 management. In this paper, we are going to compare the shows the statics of increasing cybercrime every year. Hence performance of 3 key derivation algorithms, namely, there is a need for strong key generation algorithms which PBKDF2 (Password Based Key Derivation Function), can generate the keys which are nearly impossible for the Bcrypt and Scrypt.
    [Show full text]