Analysis of Distinguishable Security between the One-Time Password Extraction Function Family and Random Function Family
Source abstract
Abstract
A one-time password is a security system that uses a password that is only used once for authentication, and it is commonly used in multi-factor authentication systems. The process of generating an OTP is very similar to generating pseudorandom sequences in cryptography. However, since only a part of the bit string is used in OTP, an algorithm is needed to extract that part. In addition, the OTP process also includes converting the value of the bit string value into decimal form for human perception. This paper focuses on analyzing the extraction function, which is the step before the hexadecimal is reprocessed into the decimal form. We analyze a function family, which includes functions used in the process of extracting a bit string in terms of distinguishable security. As a result, we conclude that the OTP extraction function family is vulnerable in terms of distinguishable security compared to the random function family.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: User Authentication and Security Systems · Biometric Identification and Security · Chaos-based Image/Signal Encryption
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Hyundai Autoever Co., Ltd., Platform Element Technology Team, 12, Teheran-ro 113-gil, Gangnam-gu, Seoul 06171, Republic of Korea
Financial Information Security, Kookmin University, 77 Jeongneung-ro, Seongbuk-gu, Seoul 02707, Republic of Korea
Funding
Institute for Information & Communications Technology Promotion(IITP)
References (24)
Show source-provided references
1. Kim, H.K., Han, J.H., Park, C.I., and Yi, O.Y. (2020). Analysis of Vulnerabilities That Can Occur When Generating One-Time Password. Appl. Sci., 10.10.3390/app10082961 ↗
2. Kim, H.K., Kim, D.H., and Yi, O.Y. (2022). Wireless Communications and Mobile Computing, Hindawi.10.1155/2022/9584894 ↗
3. Secure authentication-management human-centric scheme for trusting personal resource information on mobile cloud computing with blockchain10.1186/s13673-018-0136-7 ↗
4. Cheng, F. (2010). International Conference on Mobile Wireless Middleware, Operating Systems, and Applications, Springer.
5. Menezes, A.J., Katz, J., Van Oorschot, P.C., and Vanstone, S.A. (1996). Handbook of Applied Cryptography, CRC Press.
6. Stinson, D.R., and Paterson, M. (2018). Cryptography: Theory and Practice, CRC Press.10.1201/9781315282497 ↗
7. Barker, E.B., and Kelsey, J.M. (2012). Sp 800-90a: Recommendation for Random Number Generation Using Deterministic Random Bit Generators, National Institute of Standards and Technology. Technical Report.10.6028/NIST.SP.800-90a ↗
8. Barker, E. (2016). NIST Special Publication 800-57 Part 1 Revision 4, Recommendation for Key Management Part 1: General.10.6028/NIST.SP.800-57pt1r4 ↗
9. Turan, M.S., Barker, E., Kelsey, J., McKay, K.A., Baish, M.L., and Boyle, M. (2018). Sp800-90b: Recommendation for the Entropy Sources Used for Random Bit Generation, NIST Special Publication.10.6028/NIST.SP.800-90B ↗
10. Choi, H., Ju, W.H., Kim, H.E., and Yeom, Y.J. (2020). Guideline for the Collection and Application of Noise Sources on Operating Systems, Telecommunication Technology Association. TTAS.KO-12.0235/R2.
11. Kim, H.E., Ju, W.H., Choi, H., and Yeom, Y.J. (2018). Guideline for Testing Noise Sources Used in Software Cryptographic Modules, Telecommunication Technology Association. TTAK.KO-12.0341.
12. An, J.W. (2010). A Study on Interactive Authentication Method Using Mobile One Time Password Interlocked Transaction for Secure Electronic Financial Transactions. [Master’s Thesis, Kookmin University].
13. Jaehoon, N., and Ujin, G. (2009). TTAK.KO-12.0120: Assurance Level of One-Time Password Authentication Service, TTA.
14. Kaur, N., Devgan, M., and Bhushan, S. (2016, January 16–18). Robust login authentication using time-based OTP through secure tunnel. Proceedings of the 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom), New Delhi, India.
15. M’Raihi, D., Machani, S., Pei, M., and Rydell, J. (2011, March 01). Totp: Time-Based One-Time Password Algorithm. Internet Request for Comments. Available online: https://tools.ietf.org/html/rfc6238.10.17487/rfc6238 ↗
16. Barker, E., and Kelsey, J. (2016). Recommendation for Random Bit Generator (RBG) Constructions, National Institute of Standards and Technology. Technical Report.
17. Gu, H. (2012). TTAK.KO-12.0193: Algorithm Profile for One-Time Password, TTA.
18. Haller, N., Metz, C., Nesser, P., and Straw, M. (2020, March 01). A One-Time Password System. Network Working Group Request for Comments. Available online: https://tools.ietf.org/html/rfc2289.
19. M’Raihi, D., Bellare, M., Hoornaert, F., Naccache, D., and Ranen, O. (2020, March 01). HOTP: An HMAC-Based One-Time Password Algorithm. The Internet Society, Network Working Group. RFC4226. Available online: https://tools.ietf.org/html/rfc4226.
20. Huiwon, S., and Ujin Gang, S.S. (2009). TTAK.KO-12.0100: Security Requirements for OTP Key Management, TTA.
21. Provable Security of PRF-based Key Derivation Functions according to Input Types of Counters
22. Bellare, M., and Rogaway, P. (2005). Introduction to Modern Cryptography, CRC.
23. Park, H.J. (2020). A Study on the Security Evaluation for Cryptographically Secure Random Number Generators. [Ph.D. Thesis, Department Financial Information Security, Kookmin University].
24. Sun, H., Sun, K., Wang, Y., and Jing, J. (2015, January 12–16). TrustOTP: Transforming smartphones into secure one-time password tokens. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA.10.1145/2810103.2813692 ↗