Go to the main menu
Skip to content
Go to bottom
REFERENCE LINKING PLATFORM OF KOREA S&T JOURNALS
> Journal Vol & Issue
Journal of the Korea Institute of Information Security and Cryptology
Journal Basic Information
Journal DOI :
Korea Institutes of Information Security and Cryptology
Editor in Chief :
Volume & Issues
Volume 19, Issue 6 - Dec 2009
Volume 19, Issue 5 - Oct 2009
Volume 19, Issue 4 - Aug 2009
Volume 19, Issue 3 - Jun 2009
Volume 19, Issue 2 - Apr 2009
Volume 19, Issue 1 - Feb 2009
Selecting the target year
Improved Security Analysis of Reduced SMS4 Block Cipher
Kim, Tae-Hyun ; Kim, Jong-Sung ; Hong, Seok-Hie ; Sung, Jae-Chul ; Lee, Chang-Hoon ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 3~10
In this paper, we introduce improved differential and linear attacks on the SMS4 block cipher which is used in the Chinese national standard WAPI (WLAN Authentication and Privacy Infrastructure, WLAN - Wireless Local Area Network): First, we introduce how to extend previously known differential attacks on SMS4 from 20 or 21 to 22 out of the full 32 rounds. Second, we improve a previously known linear attack on 22-round reduced SMS4 from
encryptions, by using a new linear approximation.
Matching Performance-Based Comparative Study of Fingerprint Sample Quality Measures
Jin, Chang-Long ; Kim, Hak-Il ; Elliott, Stephen ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 11~25
Fingerprint sample quality is one of major factors influencing the matching performance of fingerprint recognition systems. The error rates of fingerprint recognition systems can be decreased significantly by removing poor quality fingerprints. The purpose of this paper is to assess the effectiveness of individual sample quality measures on the performance of minutiae-based fingerprint recognition algorithms. Initially, the authors examined the various factors that influenced the matching performance of the minutiae-based fingerprint recognition algorithms. Then, the existing measures for fingerprint sample quality were studied and the more effective quality measures were selected and compared with two image quality software packages, (NFIQ from NIST, and QualityCheck from Aware Inc.) in terms of matching performance of a commercial fingerprint matcher (Verifinger 5.0 from Neurotechnologija). The experimental results over various Fingerprint Verification Competition (FVC) datasets show that even a single sample quality measure can enhance the matching performance effectively.
A Proposal of Wavelet-based Differential Power Analysis Method
Ryoo, Jeong-Choon ; Han, Dong-Guk ; Kim, Sung-Kyoung ; Kim, Hee-Seok ; Kim, Tae-Hyun ; Lee, Sang-Jin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 27~35
Differential Power Analysis (DPA) based on the statistical characteristics of collected signals has been known as an efficient attack for uncovering secret key of crypto-systems. However, the attack performance of this method is affected very much by the temporal misalignment and the noise of collected side channel signals. In this paper, we propose a new method based on wavelet analysis to surmount the temporal misalignment and the noise problem simultaneously in DPA. The performance of the proposed method is then evaluated while analyzing the power consumption signals of Micro-controller chips during a DES operation. The experimental results show that our proposed method based on wavelet analysis requires only 25% traces compared with those of the previous preprocessing methods to uncover the secret key.
A Study On User-centric Identity Information Management Model In Internet Environment
Rhy, Hae-Gyu ; Shin, Hyeon-Shik ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 37~50
Experimental Analysis of Optical Fault Injection Attack for CRT-RSA Cryptosystem
Park, Jea-Hoon ; Moon, Sang-Jae ; Ha, Jae-Cheol ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 51~59
The CRT-RSA cryptosystem is very vulnerable to fault insertion attacks in which an attacker can extract the secret prime factors p, q of modulus N by inserting an error during the computational operation on the cryptographic chip. In this paper, after implementing the CRT-RSA cryptosystem, we try to extract the secret key embedded in commercial microcontroller using optical injection tools such as laser beam or camera flash. As a result, we make sure that the commercial microcontroller is very vulnerable to fault insertion attacks using laser beam and camera flash, and can apply the prime factorization attack on CRT-RSA Cryptosystem.
Lightweight RFID Authentication Protocols Based on Hash Function
Ha, Jae-Cheol ; Baek, Yi-Roo ; Kim, Hwan-Koo ; Park, Jea-Hoon ; Moon, Sang-Jae ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 61~72
To guarantee security between the tag and back-end server and implementation efficiency in low power tag, we propose two typed mutual authentication protocols in RFID system. One is static-ID authentication scheme which is well suitable in distributed server environments. The other is dynamic-ID scheme which is additively satisfied forward security. In proposed scheme, it does not need any random number generator in tag and requires only one(maximally three) hash operation(s) in tag or server to authenticate each other. Furthermore, we implement the proposed schemes in RFID smart card system and verify its normal operations.
Efficient and Secure User Authentication and Key Agreement In SIP Networks
Choi, Jae-Duck ; Jung, Sou-Hwan ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 73~82
This paper proposes an efficient and secure user authentication and key agreement scheme instead of the HTTP digest and TLS between the SIP UA and server. Although a number of security schemes for authentication and key exchange in SIP network are proposed, they still suffer from heavy computation overhead on the UA's side. The proposed scheme uses the HTIP Digest authentication and employs the Diffie-Hellman algorithm to protect user password against dictionary attacks. For a resource-constrained SIP UA, the proposed scheme delegates cryptographically computational operations like an exponentiation operation to the SIP server so that it is more efficient than the existing schemes in terms of energy consumption on the UA. Furthermore, it allows the proposed scheme to be easily applied to the deployed SIP networks since it does not require major modification to the signaling path associated with current SIP standard.
Cooperative Architecture for Centralized Botnet Detection and Management
Kwon, Jong-Hoon ; Im, Chae-Tae ; Choi, Hyun-Sang ; Ji, Seung-Goo ; Oh, Joo-Hyung ; Jeong, Hyun-Cheol ; Lee, Hee-Jo ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 83~93
In recent years, cyber crimes were intended to get financial benefits through malicious attempts such as DDoS attacks, stealing financial information and spamming. Botnets, a network composed of large pool of infected hosts, lead such malicious attacks. The botnets have adopted several evasion techniques and variations. Therefore, it is difficult to detect and eliminate them. Current botnet solutions use a signature based detection mechanism. Furthermore, the solutions cannot cover broad areas enough to detect world-wide botnets. In this study, we suggest an architecture to detect and regulate botnets using cooperative design which includes modules of gathering network traffics and sharing botnet information between ISPs or nations. Proposed architecture is effective to reveal evasive and world-wide botnets, because it does not depend on specific systems or hardwares, and has broadband cooperative framework.
Modeling and Simulation for Performance Evaluation of VoIP Spam Detection Mechanism
Kim, Ji-Yeon ; Kim, Hyung-Jong ; Kim, Myuhng-Joo ; Jeong, Jong-Il ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 95~105
Spam call is one of the main security threat in VoIP services. In this paper, we have designed simulation model for performance evaluation of VoIP spam defense mechanism. The simulation model has functions for performance evaluation such as calls generation and input/output comparison. Four representative caller models have been developed for performance evaluation and each model has its own characteristics as statistical parameters. The target mechanism of performance evaluation is SPIT(Spam over Internet Telephony) level decision algorithm, and we have derived SPIT levels of caller models. The performance evaluation model is designed using the DEVS formalism and DEVSJAVA
is exploited for development and execution of simulation models.
An Efficient Method for Analyzing Network Security Situation Using Visualization
Jeong, Chi-Yoon ; Sohn, Seon-Gyoung ; Chang, Beom-Hwan ; Na, Jung-Chan ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 107~117
Network administrator recognizes the abnormal phenomenon in the managed network by using the alert messages generated in the security devices including the intrusion detection system, intrusion prevention system, firewall, and etc. And then the series of task, which searches for the traffic related to the alert message and analyzes the traffic data, are required to determine where the abnormal phenomenon is the real network security threat or not. There are many alert messages to have to inspect in order to determine the network security situation. Also the much times are needed so that the network administrator can analyze the security condition using existing methods. Therefore, in this paper, we proposed an efficient method for analyzing network security situation using visualization. The proposed method monitors anomalies occurred in the entire IP address's space and displays the detail information of a security event. In addition, it represents the physical locations of the attackers or victims by linking GIS information and IP address. Therefore, it is helpful for network administrator to rapidly analyze the security status of managed network.
Secure Key Exchange Protocols against Leakage of Long-tenn Private Keys for Financial Security Servers
Kim, Seon-Jong ; Kwon, Jeong-Ok ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 119~131
The world's widely used key exchange protocols are open cryptographic communication protocols, such as TLS/SSL, whereas in the financial field in Korea, key exchange protocols developed by industrial classification group have been used that are based on PKI(Public Key Infrastructure) which is suitable for the financial environments of Korea. However, the key exchange protocols are not only vulnerable to client impersonation attacks and known-key attacks, but also do not provide forward secrecy. Especially, an attacker with the private keys of the financial security server can easily get an old session-key that can decrypt the encrypted messages between the clients and the server. The exposure of the server's private keys by internal management problems, etc, results in a huge problem, such as exposure of a lot of private information and financial information of clients. In this paper, we analyze the weaknesses of the cryptographic communication protocols in use in Korea. We then propose two key exchange protocols which reduce the replacement cost of protocols and are also secure against client impersonation attacks and session-key and private key reveal attacks. The forward secrecy of the second protocol is reduced to the HDH(Hash Diffie-Hellman) problem.
A Study on Improving Spam Management Index
Yoo, Jin-Ho ; Lim, Jong-In ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 133~142
Although the average amount of spam users receive a day is statistically decreasing in Korea, they still complain of spam and insist there is a gap between the amount of spam users receive in reality and the amount of spam the users feel due to spam. This study analyzes the cause of the gap and suggests the way of complementing the traditional measure of the amount of spam receipt. In addition, we provide the conceptual framework of 'spam management index' that explains the overall spam counteract performances from the users' point of view. Especially, we develop the method of measuring 'spam stress' which can be used as an qualitative output element. Finally we apply the model in Korea to develop spam counteract policies.
Development of Skills Framework for Information Security Workforce
Jun, Hyo-Jung ; Kim, Tae-Sung ; Yoo, Jin-Ho ; Gee, Sang-Ho ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 143~152
Successful industries that have maintained their competitiveness are characterized by well-established skills framework system. Skills framework establishes the agreed-upon, industry-identified knowledge, skills and abilities required to succeed in the workplace. Skills framework forms a solid foundation for the development of outcomes-based instruction and assessment, thus it benefits industry, students, educators and government. Each group has a major stake in the education of our students and in the efficient development of a productive workforce. Particularly in fast-changing fields like information security, relevant data that accurately reflect current and future knowledge and skills enable timely direction of resources, development and revision of industry-relevant curriculum, and efficient development of career information and job profiles. Skills framework occupies an indispensable position in any dialog concerning education or training in technical fields. In this study, we develop the skills framework for information security professionals.
Development of Mobile Alarm System using Message Tree for Personal Information Management
Jang, Eun-Young ; Kim, Hyung-Jong ; Hwang, Jun ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 153~162
When a private information security incident occurs, the people who own the information are not acknowledged about their information leakage until those affairs appear in public media. This research aims at developing a mobile alarm system for acknowledging suspicious events to the information owners. The mobile alarm system was designed considering the limited user interface of mobile terminal and concept of "personal information leakage message tree" is deployed. The message tree contains every possible situation about personal information leakage and the leaves of the tree has several choices that the information owner can select. This message tree concept enables each information owner to manager his or her information leakage situation by just pushing a few buttons of mobile device. The contribution of this paper is in design of a comprehensive alarm message tree and development of mobile alarm system containing the message tree concept.
Key Agreement Algorithms Based on Co-cyclic Hadamard Matrices
Choe, Chang-Hui ; Kim, Jeong-Su ; Lee, Moon-Ho ;
Journal of the Korea Institute of Information Security and Cryptology, volume 19, issue 3, 2009, Pages 163~167
In this paper, we analyze key agreement algorithms based on co-cyclic Jacket matrices, and propose key agreement algorithms based on co-cyclic Hadamard matrices to fix the problem. The performance of our proposal is better than conventional one's and the construction of the matrices is very simple. Also time complexity of our proposal is proportional to the factor that determinees the size of the matrix, and the length of the key. So our proposal is fast and will be useful for the communcations of two or three users, especially for those have low computing power.