Gateway Threshold Password-based Authenticated Key Exchange Secure against Undetectable On-line Dictionary Attack

A three-party password-based authenticated key exchange (PAKE) protocol allows two clients registered with a trusted server to generate a common cryptographic key from their individual passwords shared only with the server. A key requirement for three-party PAKE protocols is to prevent an adversary from mounting a dictionary attack. This requirement must be met even when the adversary is a malicious (registered) client who can set up normal protocol sessions with other clients. This work revisits three existing three-party PAKE protocols, namely, Guo et al.’s (2008) protocol, Huang’s (2009) protocol, and Lee and Hwang’s (2010) protocol, and demonstrates that these protocols are not secure against offline and/or (undetectable) online dictionary attacks in the presence of a malicious client. The offline dictionary attack we present against Guo et al.’s protocol also applies to other similar protocols including Lee and Hwang’s protocol. We conclude with some suggestions on how to design a three-party PAKE protocol that is resistant against dictionary attacks.

International audience

Indistinguishability under chosen-ciphertext attack (IND-CCA) is now considered the de facto security notion for public-key encryption. However, this sometimes offers a stronger security guarantee than what is needed. In this study, the authors consider a weaker security notion, termed as indistinguishability under plaintext-checking attacks (IND-PCA), in which the adversary has only access to an oracle indicating whether or not a given ciphertext encrypts a given message. After formalising this notion, the authors design a new public-key encryption scheme satisfying it. The new scheme is a variant of the Cramer–Shoup encryption scheme with shorter ciphertexts. Its security is also based on the plain decisional Diffie–Hellman (DDH) assumption. Additionally, the algebraic properties of the new scheme allow proving plaintext knowledge using Groth–Sahai non-interactive zero-knowledge proofs or smooth projective hash functions. Finally, as a concrete application, the authors show that, for many password-based authenticated key exchange (PAKE) schemes in the Bellare–Pointcheval–Rogaway security model, they can safely replace the underlying IND-CCA encryption schemes with their new IND-PCA one. By doing so, they reduce the overall communication complexity of these protocols and obtain the most efficient PAKE schemes to date based on plain DDH.

In both the EU and US, there are safe harbour provisions in place that should, under certain conditions, provide online service providers (OSPs) with immunity in the case of intellectual property infringement by third parties. However, the significant litigation against OSPs demonstrates that the safe harbour provisions are neither effective nor efficient. By providing OSPs with immunity against third party liability, safe harbour provisions contribute to a climate where the behaviour of OSPs is dominated by short-term business interests which are conducive neither to the enforcement of intellectual property rights by the OSPs nor to legal certainty for proprietors, internet users and OSPs alike.The precondition for invoking safe harbour provisions, that one remain passive and only act reactively, leads to wilful blindness, although OSPs are best positioned to filter infringing use of content proactively. This article therefore asserts that the safe harbour provisions must be replaced by strict intermediary liability. As will be pointed out below, this transition is not as dramatic as it seems.Safe harbours provisions were drafted at a moment when OSPs, as social media, still needed to be developed. They do not protect proprietors against infringement. Moreover, the protection of OSPs against liability is an illusion. If one extrapolates the development in filter technology one can see that advocating safe harbour provisions has become a rearguard battle and that implementation of strict liability for OSPs is inescapable.

Have you ever felt frustrated, annoyed or even enraged when interacting online with one service provider, but thoroughly enjoyed your experiences with another? Do you find some websites not only easier to use, but more enjoyable too? Online service providers now need to think beyond basic concepts of functionality and ease-of-use and consider the emotional experiences that their services engender. This paper indicates a new fundamental direction for research that links online service design with emotional experiences. It is necessary to connect information systems (IS) research with psychology, philosophy, and even physiology and neuroscience to take advantage of the rapid advances in these fields. One positive online emotional experience, namely enjoyment, was selected as the research theme. Three studies with seven websites were conducted. The research is significant as it shows how assessment of a complex emotion can deepen understanding of online service provision and go beyond attention to functional needs. Subsequent innovations in services have high potential benefit in terms of productivity gains, increased exports and more satisfied clients in the community.

Cloud computing is a key technology for online service providers. However, current online service systems experience performance degradation due to the heterogeneous and time-variant incoming of user requests. To address this kind of diversity, we propose a hierarchical approach for resource management in hybrid clouds, where local private clouds handle routine requests and a powerful third-party public cloud is responsible for the burst of sudden incoming requests. Our goal is to answer (1) from the online service provider’s perspective, how to decide the local private cloud resource allocation, and how to distribute the incoming requests to private and/or public clouds; and (2) from the public cloud provider’s perspective, how to decide the optimal prices for these public cloud resources so as to maximize its profit. We use a Stackelberg game model to capture the complex interactions between users, online service providers and public cloud providers, based on which we analyze the resource allocation in private clouds and pricing strategy in public cloud. Furthermore, we design efficient online algorithms to determine the public cloud provider’s and the online service provider’s optimal decisions. Simulation results validate the effectiveness and efficiency of our proposed approach.

With the rise in technology and the influx of diverse goods and services readily available on the internet today, online shopping has become an everyday thing in the global space through the use of technology-based channels like smartphones, tablets, laptops and others alike. Despite the incidence and daily growth this global phenomena, not all counties or parts of the world have been able to fully grasp the idea and use it to their benefit. A good example being Ghana, although close to 50% of the population has access to the internet as of January 2020 (DataReportal 2020) with about 15.1 million smartphone devices (Omondi 2020) many Ghanaians prefer traditional marketing to electronic commerce (e-commerce). With the above being noted, it is of no doubts that the online shopping community in Ghana is one that requires attention and retention by online goods and service providers. Making it a daunting task on online goods and service providers to focus on ways maintain this market and equally figure out ways to get on board new customers. This is in line with Shin et al. (2013) , who asserted that online shopping behavior involves encouraging an online consumer to purchase and repurchase a product from the same online retailer. Many researchers, authors and marketers have researched factors that influence an online consumer’s repurchases intention. This study has therefore been done after a look into past and existing literature which to a degree suggests that there hasn’t been research conducted in the area of online consumers’ repurchase intention from the same online retailer. Keywords: Online Shopping, E-commerce, Repurchase Intention, Consumer Behavior, Ghana DOI: 10.7176/EJBM/13-8-01 Publication date: April 30 th 2021

The online service provider provision of the Digital Millennium Copyright Act—Section 512 of the Copyright Act—limits the liability of online or Internet service providers whose users infringe the copyrights of others. While the provision limits liability, it also offers significant powers to a copyright holder seeking to prosecute online copyright infringers. This article traces the legislative development of the provision, examining initial opposition by copyright holders in the music industry. That opposition changed to support after considerable expansion of the original proposal. The article concludes that the music industry successfully lobbied within a three-month window before the first version of the Digital Millennium Copyright Act was presented to Congress in May 1998. The expanded version of the provision included substantial new subpoena powers and takedown requirements.

Three-party password-based authenticated key exchange (3-party PAKE) protocols make two communication parties establish a shared session key with the help of a trusted server, with which each of the two parties shares a predetermined password. Recently, with the first formal treatment for 3-party PAKE protocols addressed by Abdalla et al., the security of such protocols has received much attention from cryptographic protocol researchers. In this paper, we consider the security of 3-party PAKE protocols against undetectable on-line dictionary attacks which are serious and covert threats for the protocals. We examine two 3-party PAKE schemes proposed recently by Abdalla et al. and reveal their common weakness in resisting undetectable on-line dictionary attacks. With reviewing the formal model for 3-party PAKE protocols of Abdalla et al. and enhancing it by adding the authentication security notion for the treatment of undetectable attacks, we then present an efficient generic construction for 3-party PAKE protocols, and prove it enjoys both the semantic security and the authentication security.

The US Digital Millennium Copyright Act (DMCA) of 1998 [1] adopted a notice-and-take-down procedure to help tackle alleged online infringements through online service providers' actions. The European Directive 2000/31/EC (e-Commerce Directive) [2] introduced similar liability exemptions, but did not specify any take-down procedure. Many intermediary (host, and online search engine) service providers even in Europe have followed this notice-and-take-down procedure to enable copyright owners to issue notices to take down allegedly infringing Web resources. However, the accuracy of take-down is not known, and notice receivers do not reveal clear information about how they check the legitimacy of these requests, about whether and how they check the lawfulness of allegedly infringing content, or what criteria they use for these actions. In this paper, we use Google's Transparency Report as the benchmark to investigate the information content of take-down notices and the accuracy of the resulting take-downs of allegedly infringing Web resources. The analysis of copyright infringement is limited to the five scenarios most frequently encountered in our study of Web resources. Based on our investigation, we propose a Content-Linking-Context (CLC) model of the criteria to be considered by intermediary service providers to achieve more accurate take-down.

Privacy technologies support the provision of online services while protecting user privacy. Cryptography lies at the heart of many such technologies, creating remarkable possibilities in terms of functionality while offering robust guarantees of data confidentiality. The cryptography literature and discourse often represent that these technologies eliminate the need to trust service providers, i.e., they enable users to protect their privacy even against untrusted service providers. Despite their apparent promise, privacy technologies have seen limited adoption in practice, and the most successful ones have been implemented by the very service providers these technologies purportedly protect users from. The adoption of privacy technologies by supposedly adversarial service providers highlights a mismatch between traditional models of trust in cryptography and the trust relationships that underlie deployed technologies in practice. Yet this mismatch, while well known to the cryptography and privacy communities, remains relatively poorly documented and examined in the academic literature---let alone broader media. This paper aims to fill that gap. Firstly, we review how the deployment of cryptographic technologies relies on a chain of trust relationships embedded in the modern computing ecosystem, from the development of software to the provision of online services, that is not fully captured by traditional models of trust in cryptography. Secondly, we turn to two case studies---web search and encrypted messaging---to illustrate how, rather than removing trust in service providers, cryptographic privacy technologies shift trust to a broader community of security and privacy experts and others, which in turn enables service providers to implicitly build and reinforce their trust relationship with users. Finally, concluding that the trust models inherent in the traditional cryptographic paradigm elide certain key trust relationships underlying deployed cryptographic systems, we highlight the need for organizational, policy, and legal safeguards to address that mismatch, and suggest some directions for future work.

<p>This thesis looks for a way to overcome the failure of consent as a means of addressing privacy problems associated with online services. It argues that consent to collection and use of personal data is an imperfect mechanism for individual authorisation because data privacy in relation to online services is a dynamic, continuous process. If people are to have autonomous choice in respect of their privacy processes, then they need to be able to manage these processes themselves. After careful examination of online services which pinpoints both the privacy problems caused by online service providers and the particular features of the online environment, the thesis devises a set of measures to enable individuals to manage these processes. The tool for achieving this is a Privacy Management Model (PMM) which consists of three interlocking functions: controlling (which consent may be a part of), organising, and planning. The thesis then proposes a way of implementing these functions in the context of online services. This requires a mix of regulatory tools: a particular business model in which individuals are supported by third parties (Personal Information Administrators), a set of technical/architectural tools to manage data within the ICT systems of the online service providers, and laws capable of supporting all these elements. The proposed legal measures aim to overcome the shortcomings of procedural principles by implementing a comprehensive model in which substantive legal principle underpins a bundle of statutory-level laws which enable privacy management functions. Those are explained against the background of the General Data Protection Regulation. All of this is designed to change the way decision-makers think about Internet privacy and form the theoretical backbone of the next generation of privacy laws.</p>

Towards a secure service provisioning framework in a Smart city environment

This chapter discusses Online Service Providers (OSPs) and gauges whether they can be defined as a new and unique species of the firm. It is concluded that OSPs have many typical features such as their intermediary role, the dependence on network effects, and a capacity to grow rapidly across borders via the online medium, but that there are few features that distinguish them as a unique species. Yet, it is argued that the intertwined social relation with end-customers, often in co-development milieu combined with the lack of a direct monetary relationship, could be one such unique feature. Therefore, an important challenge, particularly for countries in the global South, is to construct and implement policy frameworks in order to ensure that OSPs and the people using them are embedded in a dynamic but fair environment.

Despite the fact that copyright infringers are being distributed in large quantities through the rapidly developed high-speed information and communications network in recent years, there is no system under the current legislation that allows copyright owners to directly request the online service provider (OSP) to disclose the infringer’s information. Even if the company voluntarily discloses user identity information, it may violate the Act on Promotion of Information and Communications Network Utilization and Information Protection (Information and Communications Network Act). The copyright holder can obtain effective remedy only when he uses OSP’s services to secure the identity information of the person who infringes his copyright. The purpose of the ‘Request System for Requesting Information on Replicators and Transmitters’ is to provide a procedure for the copyright holder to obtain the identity information of the infringer from the OSP within the scope necessary for litigation in order to obtain relief for copyright infringement. However, as requests for information provision are made indiscriminately even for minor copyright infringers, concerns about personal information infringement are increasing. This article examines the specific details of the information provision request system regarding the copy/transmitter, and furthermore, reviews the Information and Communications Network Act that stipulates the same system and foreign legal systems to solve the problem of abuse of information provision request.