NTRU를 결합한 하이브리드 세션 보호 프로토콜을 이용한 금융 오픈 API 환경의 거래 세션 안전성 강화
Enhancing Security of Transaction Session in Financial Open API Environment Using Hybrid Session Protection Protocol Combined with NTRU
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
현재 금융거래 서비스에서 보편적으로 사용하는 RSA와 ECC 같은 공개키 암호 알고리즘은 양자 컴퓨터가 실현되면 더 이상 안전성을 보장할 수 없으므로 기존 레거시 알고리즘을 양자내성암호로 전환해야 한다. 하지만 다양한 서비스에 사용 중인 알고리즘을 교체하는 데에는 상당한 시간이 소요될 것으로 예상된다. 다가올 전환기를 대비하기 위하여 두 알고리즘을 결합하는 하이브리드 방식에 관한 연구가 필요하다. 본 논문에서는 레거시 알고리즘인 ECDH 알고리즘과 양자내성암호 알고리즘인 NTRU 알고리즘을 결합하여 세션키를 생성하는 하이브리드 세션키 교환 프로토콜을 제안한다. TLS 1.3 기반 하이브리드 키 교환을 위해 IETF에서 제안한 방식들을 적용해본 결과 기존 금융거래 세션 보호 솔루션에 우리가 제안한 프로토콜을 사용하면 안전성을 강화할 수 있을 것으로 기대된다.
Abstract
Public key cryptography algorithm such as RSA and ECC, which are commonly used in current financial transaction services, can no longer guarantee security when quantum computers are realized. Therefore it is necessary to convert existing legacy algorithms to Post-Quantum Cryptography, but it is expected that will take a considerable amount of time to replace them. Hence, it is necessary to study a hybrid method combining the two algorithms in order to prepare the forthcoming transition period. In this paper we propose a hybrid session key exchange protocol that generates a session key by combining the legacy algorithm ECDH and the Post-Quantum Cryptographic algorithm NTRU. We tried the methods that proposed by the IETF for TLS 1.3 based hybrid key exchange, and as a result, it is expected that the security can be enhanced by applying the protocol proposed in this paper to the existing financial transaction session protection solution.
참고문헌 (35)
- P. W. Shor, "Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer", SIAM review, 41(2), pp.303~332 (1999)
- "Post-Quantum Cryptography"[URL]
- "Post-Quantum Cryptography: call for proposals"[URL]
- "CECPQ1 results"[URL]
- "The TLS Post-Quantum Experiment"[URL]
- "CECPQ2"[URL]
- Saarinen, O. M. Juhani, "Mobile energy requirements of the upcoming NIST post-quantum cryptography standards", 2020 8th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud), pp.23~30 (2020)
- D. Sikeridis, "Assessing the overhead of post-quantum cryptography in TLS 1. 3 and SSH", Proceedings of the 16th International Conference on emerging Networking Experiments and Technologies, pp.149~156 (2020)
- Current status and prospects of security technology along with digital finance, "Y. Yeong-rok", Financial Security Institute, ~, pp.CRR-VIII-2020-②-196 (2020)
- "Payment and settlement statistics"[URL]
- "Financial open API"[URL]
- "Banking open API system status and performance"[URL]
- Independent security check guide for institutions using open API in the financial sector, "Financial Security Institute Convergence Security Department Fintech Security Team", Financial Security Institute, Yongin, ~, pp.AGR-VI-2018-②-81 (2018)
- Guide to utilizing encryption technology in the financial sector, "Financial Security Institute Security Research Department Security Technology Research Team", Financial Security Institute, ~, pp.AGR-VII-2018-②- (2018)
- RFC 8446, "The Transport Layer Security (TLS) Protocol Version 1.3", IETF, ~ (2018)
- "Saving banks also open the era of ‘open banking’... What are the characteristics of mobile app for each saving banks?", Korea Financial Newspaper, ~ (2021)
- F. Arute, "Quantum supremacy using a programmable superconducting processor", Nature, 574, pp.505~510 (2019)
- "IBM’s roadmap for scaling quantum technology"[URL]
- M. Mosca, "Setting the scene for the ETSI quantum-safe cryptography workshop", e-proceedings of 1st Quantum-Safe-Crypto Workshop (2013)
- "Post-Quantum Cryptography: Selected Algorithms 2022"[URL]
- "PQC Standardization Process: Third Round Candidate Announcement"[URL]
- The 2nd round of the NIST PQC standardization process, "D. Moody", National Institute of Standards and Technology, ~ (2019)
- G. Alagic, "Status report on the second round of the NIST post-quantum cryptography standardization process" (2020), US Department of Commerce, NIST
- "NTRU-Algorithm specifications and supporting documentation"[URL]
- 성효은, "다중 사용자 환경에서 효과적인 키 교환을 위한 GPU 기반의 NTRU 고속구현", 정보보호학회논문지, 31(3), pp.481~496 (2021), 한국정보보호학회[DOI]
- "Hybrid key exchange in TLS 1.3"[URL]
- R. Azarderakhsh, "Post-quantum cryptography in embedded IoT devices", ICMC 2020 (2020)
- NIST, "NIST SP 800-56C Rev.2, Recommendation for Key-Derivation Methods in Key-Establishment Schemes", NIST, ~ (2020)
- RFC, "RFC 5869, HMAC-based extract-and-expand key derivation function (HKDF)", IETF, ~ (2010)
- "8byte Protocol"[URL]
- B. Hess, "Hybrid key agreement", KEM construction and integration to IPsec IKEv2 VPN, 2020, ~
- 김나영, "PRF-기반 키유도함수에서카운터 입력 형태에 따른 증명가능 안전성", 정보보호학회논문지, 25(3), pp.547~557 (2015), 한국정보보호학회[DOI]
- "OpenSSL"[URL]
- "CRYSTALS-KYBER: Algorithm Specifications And Supporting Documentation (version 3.02)"[URL]