Go to the main menu
Skip to content
Go to bottom
REFERENCE LINKING PLATFORM OF KOREA S&T JOURNALS
> Journal Vol & Issue
Journal of the Korea Institute of Information Security and Cryptology
Journal Basic Information
Journal DOI :
Korea Institutes of Information Security and Cryptology
Editor in Chief :
Volume & Issues
Volume 18, Issue 6B - Dec 2008
Volume 18, Issue 6A - Dec 2008
Volume 18, Issue 5 - Oct 2008
Volume 18, Issue 4 - Aug 2008
Volume 18, Issue 3 - Jun 2008
Volume 18, Issue 2 - Apr 2008
Volume 18, Issue 1 - Feb 2008
Selecting the target year
Memory-efficient Public Key Encryption with Keyword Search in Server
Kwon, Eun-Jeong ; Seo, Jae-Woo ; Lee, Pil-Joong ; Park, Young-Man ; Lee, Hae-Gyu ; Kim, Yeong-Heon ; Chong, Hak-Jin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 3~15
In 2000, Song. et. al. firstly proposed the Searchable Keyword Encryption System that treated a problem to search keywords on encrypted data. Since then, various Searchable Keyword Encryption Systems based on symmetric and asymmetric methods have been proposed. However, the Searchable Keyword Encryption Systems based on public key system has a problem that the index size for searching keywords on encrypted data increases linearly according to the number of keyword. In this paper, we propose the method that reduces the index size of Searchable Keyword Encryption based on public key system using Bloom Filter, apply the proposed method to PEKS(Public key Encryption with Keyword Search) that was proposed by Boneh. et. al., and analyze efficiency for the aspect of storage.
Secure RSA with CRT Protected Against Fault Attacks without using Checking Procedure
Kim, Sung-Kyoung ; Kim, Tae-Hyun ; Han, Dong-Guk ; Park, Young-Ho ; Hong, Seok-Hie ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 17~25
Because Chinese Remainder Theorem based RSA (RSA CRT) offers a faster version of modular exponentiation than ordinary repeated squaring, it is promoting with standard. Unfortunately there are major security issues associated with RSA CRT, since Bellcore announced a fault-based cryptanalysis against RSA CRT in 1996. In 1997, Shamir developed a countermeasure using error free immune checking procedure. And soon it became known that the this checking procedure can not effect as the countermeasures. Recently Yen proposed two hardware fault immune protocols for RSA CRT, and this two protocols do not assume the existence of checking procedure. However, in FDTC 2006, the method of attack against the Yen's two protocols was introduced. In this paper, the main purpose is to present a countermeasure against the method of attack from FDTC 2006 for CRT-RSA. The proposed countermeasure use a characteristic bit operation and dose not consider an additional operation.
Security Analysis on the Full-Round SCO-1
Jeong, Ki-Tae ; Lee, Chang-Hoon ; Kim, Jong-Sung ; Hong, Seok-Hie ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 27~35
In this paper we show that the full-round SCO-1 is vulnerable to the related-key differential attack. The attack on the full-round SCO-1 requires
related-key chosen ciphertexts and
full-round SCO-1 decryptions. This work is the first known attack on SCO-1.
Differential Cryptanalysis of a 20-Round Reduced SMS4 Block Cipher
Kim, Tae-Hyun ; Kim, Jong-Sung ; Sung, Jae-Chul ; Hong, Seok-Hie ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 37~44
The 128-bit block cipher SMS4 which is used in WAPI, the Chinese WALN national standard, uses a 128-bit user key with the number of 32 rounds. In this paper, we present a differential attack on the 20-round SMS4 using 16-round differential characteristic. This attack requires
chosen plaintexts with
20-round SMS4 decryptions. This result is better than any previously known cryptanalytic results on SMS4 in terms of the numbers of attacked rounds.
The Related-Key Attack on Grain-v1
Lee, Yu-Seop ; Jung, Ki-Tae ; Sung, Jae-Chul ; Hong, Seok-Hie ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 45~52
The slide resynchronization attack on Grain-v1 was proposed in . Given the keystream sequence, this attack can generate the 1-bit shifted keystream sequence generated by Grain-v1. In this paper, extending the attack proposed in , we propose the key recovery attack on Grain-v1 using the related-key. Using the weakness of the initialization procedure of Grain-v1, this attack recover the master key with
time complexity. This attack is the first known key recovery attack on Grain-v1.
An Analysis of Privacy and Accuracy for Privacy-Preserving Techniques by Matrix-based Randomization
Kang, Ju-Sung ; An, A-Ron ; Hong, Do-Won ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 53~68
We study on the practical privacy-preserving techniques by matrix-based randomization approach. We clearly examine the relationship between the two parameters associated with the measure of privacy breach and the condition number of matrix in order to achieve the optimal transition matrix. We propose a simple formula for efficiently calculating the inverse of transition matrix which are needed in the re-construction process of random substitution algorithm, and deduce some useful connections among standard error and another parameters by obtaining condition numbers according to norms of matrix and the expectation and variance of the transformed data. Moreover we give some experimental results about our theoretical expressions by implementing random substitution algorithm.
Improving The Security Of Quantum Key Distribution And Quantum Authentication By Using CHSH Inequality
Heo, Jin-O ; Hong, Chang-Ho ; Lim, Jong-In ; Yang, Hyoung-Jin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 69~78
We propose to analyze a weakness of quantum key distribution and quantum authentication which use entangled state were proposed by Bao-sen Shi(2001) and to improve the security of the protocol. The existing protocol had a weakness against an impersonation attack of an eavesdropper, because of a only process which authenticated a third party(Center) by users. In this paper, we propose improving the security of the protocol that authenticates users by a third party using check mode which applies CHSH inequality.
A Secure Maintenance Scheme of Secret Data on Trusted Mobile Platform Environment
Kang, Dong-Wan ; Lee, Im-Yeong ; Han, Jin-Hee ; Jun, Sung-Ik ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 79~91
Modern society as an information society, a lot of information is communicated in on-line. Specially, mobile environment based on radio communication has a characteristic of flexibility compared with wire communication and is developed rapidly. However, the more mobile technology is developed the more security for sensitive information is needed. Therefore, MTM(Mobile Trusted Module) is developed and promoted by TCG(Trusted Computing Group), which is an industry standard body to enhance the security level in the mobile computing environment. MTM, hardware security module for mobile environment, offers user's privacy protection, platform integrity verification, and individual platform attestation. On the other hand, secure migration scheme is required in case secret data or key is transferred from one platform to the other platform. In this paper, we analyze migration schemes which were described in TCG standard and other papers and then propose security maintenance scheme for secret data using USIM(Universal Subscriber Identity Module).
Development of Template Compensation Algorithm for Interoperable Fingerprint Recognition using Taylor Series
Jang, Ji-Hyeon ; Kim, Hak-Il ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 93~102
Fingerprint sensor interoperability refers to the ability of a system to compensate for the variability introduced in the finger data of individual due to the deployment of different sensors. The purpose of this paper is the development of a compensation algorithm by which the interoperability of fingerprint recognition can be improved among various different fingerprint sensors. In this paper we show that a simple transformation derived to form a Taylor series expansion can be used in conjunction with a set of corresponding minutia points to improve the correspondence of finer fingerprint details within a fingerprint image. This is demonstrated by an applying the transformation to a database of fingerprint images and examining the minutiae match scores with and without the transformation. The EER of the proposed method was improved by average 60.94% better than before compensation.
Designing Reliable P2P Transmission Mechanism Against MITM Attack
Kim, Sang-Choon ; Kwon, Hyeonk-Chan ; Nah, Jae-Hoon ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 103~109
Many Internet application provide the PKI(public key infrastructure)-based service to provide authentication and message integrity. Several researchers proposed PKI-based p2p network framework. However, in the real world, the use of PKI is not suitable for peer to peer network, because the peer-to-peer network is an open and dynamic network. Moreover, currently there is no nation-to-nation interoperable certificate. In this paper, we designed reliable p2p file sharing application without public key infrastructure. To do this we propose reliable public key distribution mechanism to distribute public key safely without PKI infrastructure for two-tier super-peer architecture. In our system, each peer generates and distributes its public/private key pairs, and the public key is securely distributed without PKI. The proposed mechanism is safe against MITM attack. This mechanism can be applied various P2P applications such as file sharing, IPTV, distributed resource sharing and so on
An Extended SAML Delegation Model Based on Multi-Agent for Secure Web Services
Kim, Kyu-Il ; Won, Dong-Ho ; Kim, Ung-Mo ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 111~122
Web service is defined to support interoperable machine to machine interaction over a network and defined as distributed technologies. Recently in web service environment, security has become one of the most critical issues. An attacker may expose user privacy and service information without authentication. Furthermore, the users of web services must temporarily delegate some or all of their behalf. This results in the exposure of user privacy information by agents. We propose a delegation model for providing safety of web service and user privacy in ubiquitous computing environments. In order to provide safety of web service and user privacy, XML-based encryption and a digital signature mechanism need to be efficiently integrated. In this paper, we propose web service management server based on XACML, in order to manage services and policies of web service providers. For this purpose, we extend SAML to declare delegation assertions transferred to web service providers by delegation among agents.
The Effects of Security Policies, Security Awareness and Individual Characteristics on Password Security Effectiveness
Kim, Jong-Ki ; Kang, Da-Yeon ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 123~133
Information securiry is considered important due to the side effect generated from the expansion of information system and rapid increase of the use of internet. Nevertheless, we are getting unconscious of the importance of information security. The purpose of this research is to empirically analyze that the effects of security policies, security awareness and individual characteristics on password security effectiveness. Based on the analysis of research model using structural equation modeling technique, security policies were influencing individual characteristics and improving user's security awareness. Also individual characteristics and security awareness had positive impact on security effectiveness.
A Study on Risk Analysis Methode Using Case-Based Reasoning
Lee, Hyeak-Ro ; Ahn, Seong-Jin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 135~141
The risk enlargement of cyber infringement and hacking is one of the latest hot issues. To solve the problem, the research for Security Risk Analysis, one of Information Security Technique, has been activating. However, the evaluation for Security Risk Analysis has many burdens; evaluation cost, long period of the performing time, participants’ working delay, countermeasure cost, Security Management cost, etc. In addition, pre-existing methods have only treated Analyzing Standard and Analyzing Method, even though their scale is so large that seems like a project. the Analyzing Method have no option but to include assessors’ projective opinion due to the mixture using that both qualitative and quantitative method are used for. Consequently, in this paper, we propose the Security Risk Analysis Methodology which manage the quantitative evaluation as a project and use Case-Based Reasoning Algorithm for define the period of the performing time and for select participants.
Proposal for Service Model for Internet Identity Management
Song, Jung-Hwan ; Kang, Yeon-Jung ; Jang, Hwan-Seok ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 143~152
The incredible progress of information and communication technology has allowed various information and communication services to emerge in the Web environment. Such a service is initiated when the user provides his/her personal information to the service provider and is then given an identifier and authentication data. A series of the processes is inconvenient as it requires authentication by the service provider each time that the user requests the service. Furthermore, as the user subscribes to more services, the volume of ID and authentication information increases. This compels the users to use an ID that is easy to remember or to register the same ID over and over, increasing the risk of ID hacking. It is clear that such threats will become more serious as our lives become more dependent upon the Internet and as the Internet service environment advances. With the introduction of different services, the need to efficiently manage ID has been raised. In this paper, a Internet Identity Management Service that enables the control of the flow of the user’s personal information, which is used and stored for the Internet service, is proposed from the user's perspective.
Image-based CAPTCHA Using Multi-Image Composition and Its Secure Operation
Kang, Jeon-Il ; Maeng, Young-Je ; Kim, Koon-Soon ; Nyang, Dae-Hun ; Lee, Kyung-Hee ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 153~166
According to the growth of the internet and the usage of software agents, the CAPTCHA that is a method for taking apart humans and computers has been widely deployed and used. As the results of many research activities, the CAPTCHA, which is spoken for a distorted image material including random text, has known to be easily breakable via artificial intelligence techniques. As one of alternatives for those text-based CAPTCHAs, methods using photos are concerned and various image-based CAPTCHAs are suggested. However, image-based CAPTCHAs still have some problems. In this paper, we discuss what are the problems in each image-based CAPTCHA and propose a new image-based CAPTCHA using image composition as the solution of those problems. Furthermore, for the secure operation of the CAPTCHA, we suggest a communication protocol that works without the virtual session and consider possible security and usability problems in the protocol.
Improvement of AACS Security Framework with Access Control to Personal Contents
Kim, Dae-Youb ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 167~174
As both a digital camera and a digital camcorder are popularized in recent years, UCC created by general users is also popularized. Unfortunately, according to that, the lack of privacy is also increasing more and more. The UCC is saved on the recordable media(Media) like DVD and deposited personally as well as distributed through Internet portal service. If you use Internet portal service to put up your contents, you can partially prevent the violation of privacy using security technologies such as authentication and illegal copy protection offered by internet portal service providers. Media also has technologies to control illegal copy. However, it is difficult to protect your privacy if your Media having personal contents is stolen or lost. Therefore, it is necessary to develope an additional security mechanism to guarantee privacy protection when you use Media. In this paper, we describe AACS framework for Media Security and propose improved AACS framework to control the access to personal contents saved on Media.
Determinant Whether the Data Fragment in Unallocated Space is Compressed or Not and Decompressing of Compressed Data Fragment
Park, Bo-Ra ; Lee, Sang-Jin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 175~185
It is meaningful to investigate data in unallocated space because we can investigate the deleted data. However the data in unallocated space is formed to fragmented and it cannot be read by application in most cases. Especially in case of being compressed or encrypted, the data is more difficult to be read. If the fragmented data is encrypted and damaged, it is almost impossible to be read. If the fragmented data is compressed and damaged, it is very difficult to be read but we can read and interpret it sometimes. Therefore if the computer forensic investigator wants to investigate data in unallocated space, formal work of determining the data is encrypted of compressed and decompressing the damaged compressed data. In this paper, I suggest the method of analyzing data in unallocated space from a viewpoint of computer forensics.
Countermeasures to the Vulnerability of the Keyboard Hardware
Jeong, Tae-Young ; Yim, Kang-Bin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 18, issue 4, 2008, Pages 187~194
This paper proposes an effective countermeasure to an intrinsic hardware vulnerability of the keyboard controller that causes sniffing problem on the password authentication system based on the keyboard input string. Through the vulnerability, some possible attacker is able to snoop whole the password string input from the keyboard even when any of the existing keyboard protection software is running. However, it will be impossible for attackers to gather the exact password strings if the proposed policy is applied to the authentication system though they can sniff the keyboard hardware protocol. It is expected that people can use secure Internet commerce after implementing and applying the proposed policy to the real environment.