Multi-application smart card with elliptic curve cryptosystem certificate

Elliptic curve cryptosystems (ECCs) are becoming more popular because of the reduced number of key bits required in comparison to other cryptosystems (for example, a 160 bit ecc has roughly the same security as 1024 bit RSA). ECCs are especially suited to smart cards because of the limited memory and computational power available on these devices. This paper discusses an optimized implementation of the elliptic curve Digital Signature Algorithm implemented over the field $GF(p)$ on a Motorola smart card. Algorithms for point addition, point doubling and scalar multiplication are compared according to their timings. The effects of different memory usage, code size and speed tradeoffs which were considered during the implementation are discussed. Also, optimized point addition and doubling algorithms are presented.

The use of public-key cryptosystems (PKC) received considerable attention. They are beneficial in encryption as well as signing which play an essential role in electronic banking and financial transactions. Elliptic Curve Cryptography (ECC) is one of best public key techniques because of its small key size and high security. Secure applications in smart cards present implementation challenges particular to the platform's memory, bandwidth, and computation constraints. ECC's unique properties make it especially well suited to smart card applications. ECC systems provide the highest strength per bit of any cryptosystem known today. The paper presents a new method for smart card implementation of elliptic curves, explaining how ECC can not only significantly reduce the cost, but also accelerate the deployment of smart cards in new applications. ECC permits reductions in key and certificate size that translate to smaller memory requirements (especially for EEPROM), which represent significant cost savings. This added functionality can play an effective role in electronic payment and online banking technologies.

Recently the study and implementation of elliptic curve cryptosystems (ECC) have developed rapidly and its achievements have become a center of attraction. ECC has the advantage of high-speed processing in software even on restricted environments such as smart cards. In this paper, we concentrate on implementation of ECC over a field of prime characteristic on a 16-bit microcomputer M16C (10MHz). We report a practical software implementation of a cryptographic library which supports 160-bit elliptic curve DSA (ECDSA) signature generation, verification and SHA-1 on the processor. This library also includes general integer arithmetic routines for applicability to other cryptographic algorithms. We successfully implemented the library in 4Kbyte code/data size including SHA-1, and confirmed a speed of 150msec for generating an ECDSA signature and 630msec for verifying an ECDSA signature on M16C.

Authentication with key agreement (AKA) protocols are implemented to provide identity authentication and session keys for communication entities. In order to reduce the heavy trust reliance on key generator center (KGC) in identity based AKA protocols, a certificateless based AKA (CLAKA) protocol for client-server environment without the third-party (i.e., KGC) is introduced in this paper. The proposed protocol is constructed based on elliptic curve cryptosystem (ECC) and multi-factor protections (such as password, biometrics, and smart card). Moreover, security proof based on BAN-logic is carried out and shows that our protocol can provide mutual authentication, user anonymity, dynamic identity and perfect forward security, and resist to user impersonation attack, server spoofing attack and privileged insider attack. Meanwhile, security and efficiency analysis shows that our proposed protocol outperforms the previous related ones.

Remote mutual authentication is an important part of security, along with confidentiality and integrity, for systems that allow remote access over untrustworthy networks, like the Internet. In 2006, Shieh-Wang pointed out the weakness of Juang's remote mutual authentication scheme using smart card and further proposed a novel remote user authentication scheme using smart card. However, this paper demonstrates that Shieh-Wang's scheme still does not provide perfect forward secrecy and is vulnerable to a privileged insider's attack. We also present an improved scheme based on the Elliptic Curve Diffie-Hellman problem (ECDHP) and secure one-way hash function, in order to isolate such security problems.

Investigating the literature reveals the fact that the key management protocols play a vital role in protecting the security and privacy of medical data in telecare medical information systems. Recently, Tseng et al . have proposed an interesting elliptic curve cryptosystem (ECC) based self-certified key management scheme that can yield secure channel for the communications of secure sensors (cluster members) and access point (cluster head). After careful consideration, we found that their scheme suffers from the cluster head impersonation, replay, and key replicating attacks. In addition, in the secure session phase, there are some errata and a point multiplication that is undefined in the ECC and hence is mathematically incorrect. Finally, yet importantly, their presented scheme has been adopted for a similar application by other authors with the same problem. Therefore, in this paper, we first try to elaborate the existing errata and security threats. Second, we propose a modified version, which is free from the challenges of their scheme. Eventually, we propose a novel anonymous ECC-based self-certified two-factor key management scheme that not only provides the desired security features, but also has much better efficiency than several recently-published schemes, such as the presented one by Tseng et al . Our formal security verification and proof besides the efficiency analysis support our claim.

In this paper, a new proxy digital signature scheme based on the elliptic curve cryptosystem is proposed to solve the problems such as the low work efficiency and the weak in delegation authority control, which are existing in the known proxy digital signature schemes. By introducing the thought of public key self certified, the new scheme can finish all the verify operations such as confirming the warrant, verifying the proxy digitial signature signed by the proxy signer, verifying the certificate of original signer and the proxy signer in one step. It also has the ability to control the scope of delegation reliably, and can prevent the abuse of proxy digital signature power. In the new scheme, none of the public key certificates and additional operations such as identify, provable and authentication are needed, and none trusted CA server is needed too. Compared with the existing proxy signature schemes, the new scheme has higher work efficiency, lower bandwidth, stronger security. The proposed scheme provides a successful solution to the existing problems in the known proxy digital signature schemes, and has great practical value and application prospect.

The internet of things (IoT) has brought the properties of convenience, intelligence, and manageability into our daily lives. Nevertheless, it also gives malicious attackers lots of opportunity to compromise our private information. Hence, the security issue over IoT has become an emergent and crucial research topic. Kalra and Sood (2015) proposed an authentication scheme for IoT device and cloud server. Unfortunately, Chang et al. (2017) have pointed out the weaknesses of Kalra and Sood's scheme and provided proper improvements. However, we have found that the improved version still exist potential risks. Thus, we aim to develop a brand-new ECC-based authentication mechanism for offering a secure session between an IoT device and a cloud server. In particular, the new method is proved secure under the examination of AVISPA, which is a formal verification tool.

In this final of three related articles about smart card technology, the authors discuss the JavaCard, a much-hyped technology that is finally taking off as a multiapplication smart card. The main reason for the hype is JavaCard's potential. Not only would it let all Java programmers develop smart card code, but such code could be downloaded to cards that have already been issued to customers.

Radio Frequency Identification (RFID) has grown tremendously and has been widely applied in various applications. RFID tags are becoming very attractive devices installed a small microchip for identification of products. This chip functionality makes it possible to verify the authenticity of a product. It is well known that elliptic curve cryptosystem (ECC) receive much attention due to their small key sizes and efficient computations. Recently, some ECC-based authentication schemes are proposed to apply well to the limited resources of the tags. Unfortunately, these schemes ignore some security and operational issues. In this paper, we proposed a secure ECC-based RFID authentication scheme to achieve mutual authentication using both secure ID-verifier transfer and challenge-response protocols. Moreover, the proposed scheme can satisfy the security requirements of RFID. Performance analysis and function comparisons demonstrate that the proposed scheme is well suited for RFID tags with the scarceness of resources.

Applications on multi-application smart cards contain sensitive data and can exchange information. Thus a major concern is that these applications should not exchange data unless permitted by their respective policy. As modern smart cards allow post-issuance installation and removal of applications, traditional approaches for information flow analysis are not suitable. We suggest the Security-by-Contract approach for loading time application certification on the card, that will enable the stakeholders with the means to ensure the compliance of every update of the card with their security policy. We describe an extension of the card security architecture to deal with verification for different types of updates and present a Java Card prototype implementation of the Policy Checker with performance measurements.

The Consumer-Oriented Trusted Service Manager (CO-TSM) model has been recognised as a significant advancement in managing applications on Near Field Communication (NFC)-enabled mobile devices and multi-application smart cards. Traditional Trusted Service Manager (TSM) models, while useful, often result in market fragmentation and limit widespread adoption due to their centralised control mechanisms. The CO-TSM model addresses these issues by decentralising management and offering greater flexibility and scalability, making it more adaptable to the evolving needs of embedded systems, particularly in the context of the Internet of Things (IoT) and Radio Frequency Identification (RFID) technologies. This paper provides a comprehensive analysis of the CO-TSM model, highlighting its application in various technological domains such as smart cards, HCE-based NFC mobile phones, TEE-enabled smart home IoT devices, and RFID-based smart supply chains. By evaluating the CO-TSM model’s architecture, implementation challenges, and practical deployment scenarios, this paper demonstrates how CO-TSM can overcome the limitations of traditional TSM approaches. The case studies presented offer practical insights into the model’s adaptability and effectiveness in real-world scenarios. Through this examination, the paper aims to underscore the CO-TSM model’s role in enhancing scalability, flexibility, and user autonomy in secure embedded device management, while also identifying areas for future research and development.

Wireless sensor networks are usually deployed in harsh environment or a hostile environment, vulnerable to various attacks. A key agreement scheme is proposed in order to solving the problem that traditional key system can not withstand attacks from internal node captured. The way of judgment node credibility is to calculate the trust value by establishing node communication behavior reputation model. Trusted neighbors exchange public key certificate by the base station to generate and signed. A new authenticated key agreement is designed based on each other's Identity information and public key certificates, combined with the elliptic curve cryptosystem. The program can resist the malicious behavior of the internal and external nodes effectively, make network security and survivability enhance significantly compared with other programs, make the network have good scalability, and ensure the key forward security and backward security.

Several security schemes constructed using ECC-based self-certified public key cryptosystems

The paper presents a new password authentication and key-exchange protocol suitable for remote user without verification table and exchanging keys over an untrusted network. The new protocol resists dictionary attacks mounted by either passive or active network intruders,even an insider attacker, allowing, in principle, even weak password phrases to be used safely. It also offers perfect forward secrecy, which protects past sessions and passwords against future compromises. Finally, user passwords are stored in a form that is not plaintext-equivalent to the password itself, so an attacker who captures the smart card cannot use it directly to compromise security and gain immediate access to the host. The proposed protocol’s security, simplicity, and speed make it ideal for a wide range of real-world applications in which secure password authentication is required. Compared with the related works, the proposed scheme is more efficient and practical for distributed or portable devices.