해시체인 기반 OTP 방식의 안전성 분석
Security Analysis on a Hashchain-based OTP Scheme
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
기존 고정된 패스워드 인증 방식은 패스워드 노출 및 추측 공격에 취약하지만 높은 편리성으로 인해 가장 널리 사용되는 사용자 인증 방식이다. 해시체인 기반 일회용 패스워드 인증 방식은 이러한 패스워드 인증 방식의 문제를 해결한 방식으로 Lamport가 제안한 이후 많은 개선이 이루어져왔다. 특히 2017 년 제안된 일회용 패스워드 방식은 재등록 및 비밀공유가 필요없는 장점이 있지만, 전송되는 정보의 무결성 검증에 한계가 있어 서비스거부 공격에 취약한 문제가 있다. 본 논문에서는 이러한 문제에 대해 설명한 후 이를 해결하기 위한 방식을 제안하고, 제안한 방식의 안전성 및 효율성을 분석하고자 한다.
Abstract
The existing fixed password authentication method is vulnerable to password exposure and guessing attacks, but is the most widely used user authentication method due to high convenience. Since Lamport proposed a hashchain based one-time password(OTP) authentication scheme to solve the problems of the existing password authentication method, many improved schemes have been proposed so far. An OTP scheme proposed in 2017 has the advantage of not requiring secret sharing nor re-registration, however, it suffers from denial of service attack due to the rack of integrity verification. In this paper, we will explain this problem and then suggest a way to solve this problem, and analyze the safety and efficiency of the proposed scheme.
참고문헌 (15)
- L. Lamport, "Password authentication with insecure communication", Communications of the ACM, 24, pp.770~772 (1981)
- 신동진, "재등록이 필요 없는 암호 해시체인 기반의 일회용 패스워드 인증기법", 정보보호학회논문지, 27(6), pp.1251~1259 (2017), 한국정보보호학회[DOI]
- C-S. Park, "One-time password based on hash chain without shared secret and re-registration", Computers & Security, 2, pp.138~146 (2018)
- N. H. Bellcore, "The S", KEY One-Time password system, 1995, pp.1760, ~
- M. H. Eldefrawy, "OTP-based two-factor authentication using mobile phones", Proceedings of the 8th International Conference on Information Technology, pp.327~331 (2011)
- S. Bittle, "Efficient construction of infinite length hash chains with perfect forward secrecy using two independent hash functions", Proceedings of the 11th International Conference on Security and Cryptography, pp.1~8 (2014)
- K. Bicakci, "Infinith length hash chains and their applications", Proceedings of the IEEE International Workshops on Enabling Technologies, pp.57~61 (2002)
- H. Zhang, "A novel self-renewal hash chain and its implementation", Proceedings of the IEEE, 2009, 144~149
- A. G. Chefranov, "One-time password authentication with infinite hash chains. Novel algorithms and techniques in telecommunications, automation and industrial electronics", pp.283~286 (2008), Springer Netherlands
- M. H. Eldefrawy, "One-time password system with infinite nested Hash chains", Security Technology, Disaster Recovery and Business Continuity, International Conferences SecTech and DRBC, pp.161~170 (2010)
- S. Bittl, "Efficient construction of infinite length hash chains with perfect forward secrecy using two independent hash functions", 11th International Conference on Security and Cryptography (SECRYPT), pp.1~8 (2014)
- H. Zhang, "Self-updating hash chains and their implementations", International Conference on Web Information Systems Engineering, pp.387~397 (2006)
- D. Xiao, "Using chebyshev chaotic map to construct infinite length hash chains", International Conference on Communications, Circuits and Systems, pp.11~12 (2004)
- M-Q. Zhang, "A new selfupdating hash chain structure scheme", International Conference on Computational Intelligence and Security, pp.315~318 (2009)
- H. Zhang, "A novel self-renewal hash chain and its implementation", IEEE, 2008, 144~149