Open Journal of Applied Sciences, 2016, 6, 893-902 http://www.scirp.org/journal/ojapps ISSN Online: 2165-3925 ISSN Print: 2165-3917 Research and Implementation of Time Synchronous Dynamic Password Based on SM3 Hash Algorithm Dognery Sinaly Silue1,2, Wanggen Wan1,2*, Muhammad Rizwan1,2 1School of Communications and Information Engineering, Shanghai University, Shanghai, China 2Institute of Smart City, Shanghai, China How to cite this paper: Silue, D.S., Wan, Abstract W.G. and Rizwan, M. (2016) Research and Implementation of Time Synchronous Dy- With the rapid development of information technology, demand of network & in- namic Password Based on SM3 Hash Algo- formation security has increased. People enjoy many benefits by virtue of informa- rithm. Open Journal of Applied Sciences, 6, tion technology. At the same time network security has become the important chal- 893-902. http://dx.doi.org/10.4236/ojapps.2016.613077 lenge, but network information security has become a top priority. In the field of authentication, dynamic password technology has gained users’ trust and favor be- Received: November 13, 2016 cause of its safety and ease of operation. Dynamic password, SHA (Secure Hash Al- Accepted: December 25, 2016 gorithm) is widely used globally and acts as information security mechanism against Published: December 28, 2016 potential threat. The cryptographic algorithm is an open research area, and devel- Copyright © 2016 by authors and opment of these state-owned technology products helps secure encryption product Scientific Research Publishing Inc. and provides safeguard against threats. Dynamic password authentication technolo- This work is licensed under the Creative gy is based on time synchronization, using the state-owned password algorithm. SM3 Commons Attribution International hash algorithm can meet the security needs of a variety of cryptographic applications License (CC BY 4.0). http://creativecommons.org/licenses/by/4.0/ for commercial cryptographic applications and verification of digital signatures, Open Access generation and verification of message authentication code. Dynamic password bas- ically generates an unpredictable random numbers based on a combination of spe- cialized algorithms. Each password can only be used once, and help provide high safety. Therefore, the dynamic password technology for network information securi- ty issues is of great significance. In our proposed algorithm, dynamic password is generated by SM3 Hash Algorithm using current time and the identity ID and it va- ries with time and changes randomly. Coupled with the SM3 hash algorithm securi- ty, dynamic password security properties can be further improved, thus it effectively improves network authentication security. Keywords Dynamic Password Authentication, SM3 Hash Algorithm, Network Authentication DOI: 10.4236/ojapps.2016.613077 December 28, 2016 D. S. Silue et al. Security, One Time Password 1. Introduction Internet and mobile communications have developed rapidly; it increases the demand for securing user authentications in terms of managing money and personal informa- tion [1]. However, there is always a risk of monitoring the personal & private data. Therefore, it is necessary to authenticate users securely. If a user sends the same pass- word for every session, an attacker can masquerade as the user and the attacker can get user’s password via the Internet. One-time password authentication methods use one- way functions extensively [2]. Moreover, a synchronous data communication proce- dure is possible for one-time password authentication methods and realizes mutual au- thentication using a one-time password method. So, the user requires one-time pass- word authentication methods that change the verifier every time. When a user logs in to the system, the user sends masking data to the server and the server certifies the user using those masking data and the stored verifier. Then the user and the server use a one-time password authentication method and apply a one-way function. The security of dynamic password system is mainly dependent on the encryption algorithm. Nowa- days, most of the dynamic password technology in the domestic market adopts foreign algorithms, such as RSA, SHA-1, MD4, MD5 and so on [3]. With the growth of such algorithms, probability of cracking these algorithms also increases by time. In 2005 professor Xiaoyun Wang of Shandong University, proposed the cracking strategy of two classic hash algorithm systems (MD5 and SHA-1), so that the collision to crack the hash algorithm has become possible [4]. It has improved construction of signature schemes with forward security in the random oracle model [5]. This shows that in the field of identity authentication, the use of open source algorithms creates more risk of security. For the use of encryption products, No. 273 order of the State Council of Chi- na has published the regulation of the administration of commercial cipher, which shows that country attaches great importance to the information security of the locali- zation. In this paper, the design and implementation of a dynamic password technology based on national commercial encryption standard, are proposed to solve the problem as follows: adopting the national commercial encryption SM3 hash algorithm as an en- cryption algorithm, to achieve the dynamic password authentication and encryption algorithm of domestic design; proposing the time truncated password algorithm based on the time to improve the safety performance of the algorithm [6]. 2. Related Technology 2.1. The Definition of Hash Function Hash function maps arbitrary length input message for fixed length output value, and the fixed length output value is called the input message’s hash value. The definition of the hash function can be expressed as: hn:{ 0,1} *→ { 0,1} ,{ 0,1} * is a set of bits that 894 D. S. Silue et al. represent arbitrary length; {0,1}n is a set of bit strings that represent the length of n. In order to ensure the safety of the hash function, hash length n should be at least 256 bit. Usually there is the key in operation; the hash function is divided into two parts: hash function with key and hash function without key [7]. It is shows as follows. 2.1.1. Hash Function with Key Hash function with hash key keeps the key participation in the process of operation. This kind of hash functions is required to satisfy all the security requirements and the hash value depends on the key input message, and key can calculate the corresponding hash value. It not only provides a complete test as well as provides the function for identity au- thentication, named as message authentication code (MAC). The nature of message and authentication code ensures the generation of right message with hash function [8]. 2.1.2. Hash Function without Key As compared to hash function with key, no key is used by hash function for the input messages, so this type of hash function does not have the function of identity authenti- cation. It provides only integrity checking, such as tampering detection code (MDC). According to the properties of the MDC, it can be divided into weak one-way hash function (OWHF) and strong one-way hash function (CRHF) [9]. 2.2. SM3 Hash Algorithm Decryption The SM3 hash function compresses any message no more than 264-1 bits into a 256-bit hash value. The algorithm first pads any given message into n 512-bit message blocks. The hash function consists of the following two parts: the message expansion and the state update transformation. Message Expansion: The message expansion of SM3 splits the 512-bit message blocks M into 16 words wii (0≤≤ 15) , and expands them into 68 expanded message words wii (0≤≤ 67) and 64 expanded message words w'i (0≤≤ i 63) as follows: wi= Pw ii( −−16 ⊕ w i 9 ⊕( w i − 3 15)) ⊕(wi−13 7) ⊕ wi −6 ,16 ≤≤ i 67, w'iii= w ⊕ w−41,0 ≤≤ i 63, where PXXXX( ) = ⊕( 15) ⊕( 23) State Update Transformation: The state update transformation starts from an ini- tial value (A0, B0, C0, D0, E0, F0, G0, H0) = IV of eight 32-bit words and updates them in 64 steps. In step ii+1( 0 ≤≤ 63) the 32-bit words wi and w'i are used to update the state variables Ai, Bi, Ci, Di, Ei, Fi, Gi, Hi as follows: SS1i=(( A i 12) ++ E ii( T i)) 7, SS2i= SS 1 ii ⊕ ( A 12) , TTFFABCDSSw'1i= i( iii ,,) ++ i 2 i + i , TT2i= GG i( E ii ,, F G i) ++ H i SS 1 i + w i , Ai+1= TT1, ii B ++ 11 = A ii , C = ( B i 9) , D i+1= C i , Ei+10= P( TT2i) , F i ++1= E ii , G 1 = ( F i9,) H i+1= G i . where PX0 ( ) =⊕⊕ X( X9) ( X 17) . 895 D. S. Silue et al. The bitwise Boolean functions FFi( X ii,, Y Z i) and GGi( X ii,, Y Z i) are defined as follows. XYZii⊕ ⊕ i, 0≤≤i 15, FFi( X ii,, Y Z i) = ( XYii∧) ∨( X ii ∧ Z) ∨( YZ ii ∧) 0 ≤≤ i 63, XYZii⊕ ⊕ i, 0≤≤i 15, GGi( X ii,, Y Z i) = ( XYii∧) ∨¬( XZ i ∧ i) 0 ≤ i ≤ 63, If M is the last block, then A64 _ AA( 64⊕⊕⊕ A 0 , B 64 B 0 , C 64 C 0 , D 64 ⊕ D 0 , E 64 ⊕⊕⊕ E 0 , F 64 FG 0 , 64 G 0 , H 64 ⊕ 0 ) is the hash value. Otherwise it is part of the input of the next message block. 2.3. Dynamic Password Generation Algorithm Based on SM3 Dynamic password, also known as a one-time password, which is a one-time e form of a password that changes by time, for user new password is created every time [10] [11]. In a certain time interval, a password can only be used once; repeated use of the same password will be rejected.