Chapter 1

INTRODUCTION

Nowadays, passwords are commonly used by people during a log in process

that controls access to protected computer operating systems, mobile phones, cable
TV decoders, automated teller machines and so on. A computer user may require
passwords for many purposes: logging in to computer accounts, retrieving e-mail
from servers, accessing programs, databases, networks, web sites, and even reading
the morning newspaper online.

Earlier password-based authentication systems transmitted a cryptographic

hash of the password over a public channel which makes the hash value accessible to
an attacker. When this is done, and it is very common, the attacker can work offline,
rapidly testing possible passwords against the true password’s hash value. Studies
have consistently shown that a large fraction of user-chosen passwords are readily
guessed automatically. For example, according to Bruce Schneier, examining data
from a 2006 phishing attack, 55 percent of MySpace passwords would be crack able
in 8 hours using a commercially available Password Recovery Toolkit capable of
testing 200,000 passwords per second in 2006.

Recent research advances in password-based authentication have allowed a

client and a server mutually to authenticate with a password and meanwhile to
establish a cryptographic key for secure communications after authentication. In
general, current solutions for password based authentication follow two models.

The first model, called PKI-based model, assumes that the client keeps the
server’s public key in addition to share a password with the server. In this setting, the
client can send the password to the server by public key encryption. Gong et al. were
the first to present this kind of authentication protocols with heuristic resistant to
offline dictionary attacks, and Halevi and Krawczyk were the first to provide formal
definitions and rigorous proofs of security for PKI-based model.

1
 The second model is called password-only model. Bellovin and Merritt were
the first to consider authentication based on password only, and introduced a set of so-
called “encrypted key exchange” protocols, where the password is used as a secret
key to encrypt random numbers for key exchange purpose. Formal models of security
for the password-only authentication were first given independently by Bellare et al.
And Boyko et al. Katz et al. were the first to give a password-only authentication
protocol which is both practical and provably secure under standard cryptographic
assumption.

Based on the identity-based encryption technique Yi et al. suggested an

identity-based model where the client needs to remember the password only while the
server keeps the password in addition to private keys related to its identity. In this
setting, the client can encrypt the password based on the identity of the server. This
model is between the PKI-based and the password only models.

Typical protocols for password-based authentication assume a single server

stores all the passwords necessary to authenticate clients. If the server is
compromised, due to, for example, hacking, or installing a “Trojan horse,” or even
insider attack, user passwords stored in the server are disclosed. To address this issue,
two-server password-based authentication protocols were introduced in and, where
two servers cooperate to authenticate a client on the basis of password and if one
server is compromised, the attacker still cannot pretend to be the client with the
information from the compromised server.

Current solutions for two-server PAKE are either symmetric in the sense that
two peer servers equally contribute to the authentication, such as, or asymmetric in
the sense that one server authenticates the client with the help of another server, such
as. A symmetric two server PAKE protocol, for example, Katz et al.’s protocol can
run in parallel and establishes secret session keys between the client and two servers,
respectively. In case one of the two servers shuts down due to the denial-of-service
attack, another server can continue to provide services to authenticated clients. In
terms of parallel computation and reliable service, a symmetric protocol is superior to
an asymmetric protocol. So far, only Katz et al.’s two-server PAKE protocol has been
symmetric. But their protocol is not efficient for practical use. An asymmetric two-

2
server PAKE protocol runs in series and only the front-end server and the client need
to establish a secret session key.

Current asymmetric protocols, for example, Yang et al.’s protocol and Jin et
al.’s protocol, need two servers to exchange messages for several times in series.
These asymmetric designs are less efficient than a symmetric design which allows
two servers to compute in parallel. This system presents a new symmetric solution for
two-server PAKE. In all existing two-server PAKE protocols, two servers are
provided random password shares pw1 and pw2 subject to pw1+pw2=pw. Our protocol
provide one server S1 with an encryption of the password ∑(g 2pw,pk2) and another
server S2 with an encryption of the password ∑(g2pw,pk1) where pk1 and pk2 are the
encryption keys of S1 and S2, respectively. In addition, two servers are provided
random password shares b1 and b2 subject to (b1 XOR b2) =H (pw) where H is a hash
function. Like, the password pw is secret unless the two servers collude.

Although the concept of public key cryptosystem is used, our protocol follows
the password-only model. The encryption and decryption key pairs for the two servers
are generated by the client and delivered to the servers through different secure
channels during the client registration, as the client in any two-server PAKE protocol
sends two halves of the password to the two servers in secret, respectively. In fact, a
server should not know the encryption key of another server and is restricted to
operate on the encryption of the password on the basis of the homomorphic properties
of Elgamal encryption scheme. For example, given ∑(g 2pw , pk2), S1 can construct
∑(Ag2pw , pk2), and ∑([Link] , pk2), for any group element A and integer a without the
knowledge of the encryption key pk2.

Security analysis has shown that our protocol is secure against both passive
and active attacks in case that one server is compromised. Performance analysis has
shown that our protocol is more efficient than the existing symmetric and asymmetric
two-server PAKE protocols in terms of parallel computation.

Our protocol can be applied in distributed systems where multiple servers

exist. For example, Microsoft active directory domain service (AD DS) is the
foundation for distributed networks built on Windows server operating systems that
use domain controllers. AD DS provides structured and hierarchical data storage for

3
objects in a network such as users, computers, printers, and services. AD DS also
provides support for locating and working with these objects. For a large enterprise
running its own domain, there must be two AD DS domain controllers, for fault-
tolerance purpose. To authenticate a user on a network, the user usually needs to
provide his/her identification and password to one AD DS domain controller. Based
on our two-server PAKE protocol, the user’s password is splitted into two parts and
stores them, respectively, on the two AD DS domain controllers, which can then
cooperate to authenticate the user. Even if one domain controller is compromised, the
system can still work. In this way, one can achieve more secure AD DS.

4
 Chapter 2

RELATED WORK

Literature Survey

Literature survey is the most important step in software development process.

Before developing the tool it is necessary to determine the time factor, economy and
company strength. Once these things are satisfied, then next step is to determine
which operating system and language can be used for developing the tool. Once the
programmers start building the tool the programmers need lot of external support.
This support can be obtained from senior programmers, from book or from websites.
Before building the system the above consideration are taken into account for
developing the proposed system.

One-Time Verifier-Based Encrypted Key Exchange

This project provides strong security arguments to support the Encrypted Key
Exchange (EKE) -like protocols being standardized by the IEEE P1363.2 Standard
working group (namely the PPK series). This aim can be reached by slightly
modifying the original AuthA protocol (the two encryption primitives are instantiated
using separate mask generation functions but derived from a unique shared password)
to be able to achieve the security notion of forward-secrecy in a provably-secure way.
Our result is a slight departure from previously known results on EKE -like structures
since the security of AuthA is now based on the Gap Diffie-Hellman problem.
Moreover, AuthA is extended into a One-time Password-authentication and Key
exchange (OPKeyX) technology which allows a user to securely log into his account
using a remote un-trusted computer and limits the damages of corruption of the
server.

Authenticated Key Exchange Secure Against Dictionary Attacks

5
 Classic cryptographic protocols based on user-chosen keys allow an attacker
to mount password-guessing attacks. A combination of asymmetric (public-key) and
symmetric (secret-key) cryptography that allow two parties sharing a common
password to exchange confidential and authenticated information over an insecure
network is introduced. In particular, a protocol relying on the counter-intuitive motion
of using a secret key to encrypt a public key is presented. Such protocols are secure
against active attacks, and have the property that the password is protected against
offline dictionary attacks.

The Decision Diffie-Hellman problem

The Decision Diffie-Hellman assumption (DDH) is a gold mine. It enables one

to construct efficient cryptographic systems with strong security properties. In our
project recent applications of DDH as well as known results regarding its security are
also surveyed.

Yang’s Protocol

In 2007, Jin et al. [18] further improved Yang’s protocol[21] and proposed a
two-server PAKE protocol with less communication rounds. In their protocol, the
client sends B=g1a g2π to SS, SS forwards B1=B/g1b1g2π1 to CS, CS returns A1=g1b2, B1=
(B1/ g2π2)b2= g1(a-b1)b2 to SS, SS computes B3=(B2A1b1)b3=gab2b3 and responds A2= A1b3,
S1=H(B3) to the client, where H is a hash function. Next, SS and the client
authenticate each other by checking if they can agree on the same secret session key
g1ab2b3, where a,(b1,b3),b2 are randomly chosen by the client, SS and CS, respectively.
The advantage of Jin et al.’s protocol is that it needs less communication rounds than
Yang et al.’s protocol in without introducing additional computation complexity. Like
Yang et al.’s protocols, the disadvantage of Jin et al.’s protocol is the protocol
structure which requires two servers to compute in series.

6
 Chapter 3

SYSTEM ANALYSIS

System analysis is the description of a system into its component pieces to

study how the component pieces are study and work.

3.1. Software Requirement Specifications

Software Requirement Specification is the starting point of software

developing activity. As system grew more complex it became evident that the goal of
the entire system cannot be easily comprehended. Hence the needs for the
requirements phase are use. The software project is initiated by the client needs. The
SRS is the means of translating the ideas of the minds of clients (the input) into a
formal document. The purpose of the software requirement specification is to reduce
the communication gap between the clients and developers. Software Requirement
Specification is the medium through which the client and user needs are accurately
specified. It forms the basis of software development. A good SRS should satisfy all
the parties of involved in the system. The SRS phase consists of two basic activities.

3.1.1. Purpose

In a server all the passwords necessary to authenticate clients are stored that is
in a single server. If the server is compromised, due to, for example, hacking or even
insider attacks, passwords stored in the server are all disclosed. In our project, a
scenario where two servers cooperate to authenticate a client is considered and if one
server is compromised, the attacker still cannot pretend to be the client with the
information from the compromised server. This provides more security than others.

3.1.2 Scope

Our protocol provides explicit authentication in the sense that each party know
that other parties have established their secret session keys correctly if the message

7
authentication by the party succeeds. If the client C accepts the messages M4 and M5,
the client C is confirmed that the servers S 1 and S2 will compute their secret session
keys with the client C correctly. If the server S 1 accepts the message M6, the server S1
is confirmed that the client C has computed the same secret session key SK 1, and the
client C and the server S2 have established their secret session key correctly.

3.1.3. Objective

The primary objective is to provide authentication with key exchange, where

the client can establish different cryptographic keys with the two servers, respectively.
By using security analysis one can show that our protocol is secure against passive
and active attacks in case that one of the two servers is compromised.

3.1.4. Existing System

Earlier password-based authentication systems transmitted a cryptographic

hash of the password over a public channel which makes the hash value accessible to
an attacker. When this is done, and it is very common, the attacker can work offline,
rapidly testing possible passwords against the true password’s hash value. Studies
have consistently shown that a large fraction of user-chosen passwords are readily
guessed automatically.

Recent research advances in password-based authentication have allowed a

client and a server mutually to authenticate with a password and meanwhile to
establish a cryptographic key for secure communications after authentication. In
general, current solutions for password based. Authentication follows two models.

The first model, called PKI-based model, assumes that the client keeps the
server’s public key in addition to share a password with the server. In this setting, the
client can send the password to the server by public key encryption. Gong et al. were
the first to present this kind of authentication protocols with heuristic resistant to
offline dictionary attacks, and Halevi and Krawczyk were the first to provide formal
definitions and rigorous proofs of security for PKI-based model.

The second model is called password-only model. Bellovin and Merritt were
the first to consider authentication based on password only, and introduced a set of so-

8
 called “encrypted key exchange” protocols, where the password is used as a secret
key to encrypt random numbers for key exchange purpose. Formal models of security
for the password-only authentication were first given independently by Bellare et al.
and Boyko et al. Katz et al. were the first to give a password-only authentication
protocol which is both practical and provably secure under standard cryptographic
assumption.

Limitations

• The hash value accessible to an attacker.

• The attacker can work offline, rapidly testing possible passwords against the true
password’s hash value.

3.1.5 Proposed System

In this project, we considered two servers to authenticate a client so that the

burden of storing all the passwords in a single sever is reduced and even if one server
is compromised, the attacker still cannot pretend to be the client with the information
from the compromised server as per the paper submitted by Xun Yi, San Ling, and
Huaxiong Wang [21]. Current solutions for two-server PAKE are either symmetric in
the sense that two peer servers equally contribute to the authentication or asymmetric
in the sense that one server authenticates the client with the help of another server.
This paper presents a symmetric solution for two-server PAKE, where the client can
establish different cryptographic keys with the two servers, respectively. Our protocol
runs in parallel and is more efficient than existing symmetric two-server PAKE
protocol.
In our system we provided one server S 1 with an encryption of the password
∑(g2pw,pk2) and another server S2 with an encryption of the password ∑(g 2pw,pk1)
where pk1 and pk2 are the encryption keys of S 1 and S2, respectively. In addition, two
servers are provided random password shares b1 and b2 subject to (b1 XOR b2) =H
(pw) where H is a hash function. Like, the password pw is secret unless the two
servers collude.

Advantages

9
• Establish a cryptographic key for secure communications after authentication.

3.1.6. Problem Statement

In most of existing two-server PAKE protocols such as, it is assumed or

implied that the discrete logarithm of g 2 to the base g1 is unknown to anyone.
Otherwise, their protocols are insecure. Our initialization can ensure that nobody is
able to know the discrete logarithm of g 2 to the base g1 unless the two servers collude.
It is well known that the discrete logarithm problem is hard, and our model assumes
that the two servers never collude.

The two secure channels are necessary for all two server PAKE protocols,
where a password is split into two parts, which are securely distributed to the two
servers, respectively, during registration. Although the concept of public key
cryptosystem is referred, the encryption key of one server should be unknown to
another server and the client needs to remember a password only after registration

3.2. Functional Requirements

The functionality can be achieved in two stages-input selection and applying

the inputs on different algorithms which produces efficient algorithm.

Input: user login details and any files for uploading.

Processing: The input is given to the algorithm.

Output: authenticate the user and access files.

3.3. Non-functional Requirements

Performance: User requests are to be responded quickly and send the required file to
destination properly.

Cost: The cost of product development and maintenance should be minimum.

Software Requirements:

• Operating System : Windows XP

10
 • Technology : JAVA.
• Database : Mysql 5.5
• Database Connectivity :JDBC

Hardware Requirements:

• Speed : 2.30 GHz

• Processor : Intel i3.
• RAM : 1 GB
• Hard Disk : 350 GB
• Key Board : Standard Windows Keyboard
• Mouse : Two or Three Button Mouse
• Monitor : SVGA

11
 Chapter 4

SYSTEM DESIGN

Object oriented design is concerned with developing an object-oriented model

of a software system to implement the identified requirements. It is the process of
defining the components, interfaces, objects, classes, attributes and operations that
will satisfy the requirements. Typically start with the candidate objects defined during
the analysis, but add much more rigor to their definition. Then add or change objects
as needed to refine a solution.

The designer’s goal is how the outputs to be produced and in what format
samples of the output are also presented. The processing phases are handled through
the program construction and testing. Finally details related to justification of the
system and an estimate of the impact of the candidate system on the user and the
organization are documented and evaluated by management as a step towards
implementation.

The importance of software design can be stated in a single word “Quality”.

Design provides us with representations of software that can be assessed for quality.
Design is the only way that can be able to accurately translate a customer’s
requirements into a finished software product or system without design risk, building
an unstable system, that might fail it if small changes are made or may be difficult to
test, or one who’s quality can’t be tested. So it is essential phase in the development
of a software product.

Object-oriented design can yield the following benefits:

Maintainability through simplified mapping to the problem domain, which provides

for less analysis effort, less complexity in system design, easier verification by the
user.

12
Reusability of the design artifacts, which saves time and cost.

Productivity gains through direct mapping of features of Object-Oriented

Programming Languages.

4.1. System Architecture

System Architecture describes “the overall structure of the system and the
ways in which the structure provides conceptual integrity”.

Architecture is the hierarchical structure of a program components (modules),

the manner in which these components interact and the structure of data that are used
by that components.

The proposed system architecture is as follows and in this the efficiency is good.

Fig. [Link]

4.1.1 Modules

1. Diffie-Hellman Key Exchange Protocol.

2. ElGamal Encryption Scheme.
3. Initialization.
4. Registration.

13
Module Description

Diffie-Hellman Key Exchange Protocol

The Diffie-Hellman key exchange protocol was invented by Diffie and Hellman in
1976. It was the first practical method for two users to establish a shared secret key
over an unprotected communications channel. Although it is a non authenticated key
exchange protocol, it provides the basis for a variety of authenticated protocols.
Diffie-Hellman key exchange protocol was followed shortly afterward by RSA, the
first practical public key cryptosystem.

ElGamal Encryption Scheme

• Each user has a private key x.
• Each user has three public keys: prime modulus p, generator g and public
Y =gx mod p.
• Security is based on the difficulty of DLP.
• Secure key size > 1024 bits (today even 2048 bits).
• Elgamal is quite slow; it is used mainly for key authentication protocols.
Initialization

The two peer servers S1 and S2 jointly choose a cyclic group G of large prime
order q with a generator g1 and a secure hash function H : {0; 1}*->Zq, which maps a
message of arbitrary length into an l-bit integer, where l= log2 q. Next, S 1 randomly
chooses an integer s1 from Zq and S2 randomly chooses an integer s2 from Zq , and S 1
and S2 exchange g1s1 and g1s2 . After that, S1 and S2 jointly publish public system
parameters G, q, g1, g2, H where g2= gs1s2.

Registration

14
 The two secure channels are necessary for all two server PAKE protocols, where a
password is split into two parts, which are securely distributed to the two servers,
respectively, during registration. Although we refer to the concept of public key
cryptosystem, the encryption key of one server should be unknown to another server
and the client needs to remember a password only after registration.

4.2 UML Design

UML stands for Unified Modeling Language. Taking SRS document of

analysis as input to the design phase drawn UML diagrams. The UML is only
language so is just one part of the software development method. The UML is process
independent, although optimally it should be used in a process that should be driven,
architecture-centric, iterative, and incremental. The UML is language for visualizing,
specifying, constructing, documenting the articles in a software-intensive system.

A modeling language is a language whose vocabulary and rules focus on the

conceptual and physical representations of the system. A modeling language such as
the UML is thus a standard language for software blueprints.

The UML is a graphical language, which consists of all interesting systems.

There are also different structures that can transcend what can be represented in a
programming language.

There are different diagrams in UML

Data Flow Diagram

The DFD is also called as bubble chart. It is a simple graphical formalism that
can be used to represent a system in terms of the input data to the system, various
processing carried out on these data, and the output data is generated by the system.

15
Data-flow Diagram

User
Login

Check
yes No

File Sharing UnAuhtorized

Key Generation

Elgamal Encryption

File Search

Elgamal Decryption EndProcess

Fig. [Link]-flow diagram

4.2.1. Use Case Diagram

Use Case during requirement elicitation and analysis to represent the

functionality of the system. Use Case describes a function provided by the system that
yields a visible result for an actor.

The identification of actors and use cases result in the definition of the
boundary of the system i.e., differentiating the tasks accomplished by the system and
the tasks accomplished by its environment. The actors are outside the boundary of the
system, whereas the Use cases are inside the boundary of the system. Use Cases
describe the behavior of the system as seen from the actor’s point of view. It describes
the function provided by the system as a set of events that yield a visible result for the
actor.

16
Use Case diagram for User

Registrattion

User
key generation

File upload

File access

Fig. [Link] Case diagram

4.2.2 Class diagram

Class diagrams model class structure and contents using design elements such
as classes, packages and objects. Class diagram describe three different perspectives
when designing a system- conceptual, specification and implementation. Classes are
composed of three things: name, attributes, and operations. Class diagrams also
display relationships such as containment, inheritance, associations etc. The
association relationship is most common relationship in a class diagram. The
association shows the relationship between instances of classes.

Class diagram

User Server1
username name
password password
location
fileuplaod()
filesearch() register1()
filedownload()

Server2
name
password
email

register2()
generateprivatekey()

17
 Fig. [Link] Diagram

4.2.3 Interaction diagrams

Sequence diagrams

Sequence diagram displays the time sequence of the objects participating in

the interaction. This consists of the vertical dimension (time) and horizontal
dimension (different objects).

Object: Object can be viewed as an entity at a particular point in time with a specific
value and as a holder of identity that has different values over time.

Actor: An Actor represents a coherent set of roles that users of a system play when
interacting with the use cases of the system.

Message: A message is sending of a signal from one sender object to other receiver
object(s).

Sequence diagram for User

Server 1 Server 2 Login File Logout

Registraton Registration download/search
: user
1: Server1 registration

2: server2 Registration
3: Login

4: File download/search

5: Logout

Fig [Link] diagram for User

18
Collaboration diagrams

Collaboration diagram displays an interaction organized around the objects

and their links to one another. Numbers are used to show the sequence of messages.

Collaboration Diagram for User

1: Server1 registration Server 1

Registraton
2: server2 Registration

: user
3: Login Server 2
Registration
5: Logout

4: File download/search
Login
File download/search
Logout

[Link] diagram for User

19
4.2.4 Activity diagram

An activity diagram shows the flow from activity to activity. An activity is a

going non-atomic execution with in a state machine. An activity results in some
action, results in a change of state or return of a value.

Activity Diagram commonly contains

 Activity states and action states.

 Transitions.
 Objects, it may contain nodes and constraints.

Activity states and action states: An executable atomic computation is called action
state, which cannot be decomposed. Activity state is non atomic, decomposable and
takes some duration to execute.

Transition: It is the path from one state to the next state, represented as simple
directed line.

Branching: When an alternate path exists, branching arises which is represented by

open diamond. It has an incoming transition, two or more outgoing transitions.

Forking and joining: The synchronization bar when split one flow into two or more
flows is called fork. When two or more flows are combined at synchronization bar,
the bar is called join.

Swim Lanes: Group work flow is called swim lanes. All groups are portioned by
vertical solid lines. Each swim lane specifies locus of activities and has a unique
name. Each swim lane is implemented by one or more classes. Transition may occur
between objects across swim lanes.

20
Activity diagram

START

Check login No

Yes

User login

Check Login
File share

File search

Key Entered

Check Key
No
Correct

Dictionary File
Attack Download

Logout

Fig. 4.6 Activity diagram

21
 Chapter 5

IMPLEMENTATION

Implementation is the stage where the theoretical design is turned into a

working system. The most crucial stage in achieving a new successful system and in
giving confidence on the system for the users that will work efficiently and
effectively. The system will be implemented only after thorough testing and if it is
found to work according to the specification.

5.1. Overview of Software Used

This application is developed and executed with J2SDK1.6.0 handling the

J2SE java part with user interface Swing Component.

Java

It is robust, object oriented, multi-threaded, distributed, secure and platform

independent language. It has wide variety of package to implement our requirement
and number of classes and methods can be utilized for programming purpose. These
features make the programmers to implement the required concept and algorithm in a
easier way in Java.

The Java Platform

A platform is the hardware or software environment in which a program runs.

Platforms like Windows 2000, Linux, Solaris, and MacOS. Most platforms can be
described as a combination of the operating system and hardware. The Java platform
differs from most other platforms in that it’s a software-only platform that runs on top
of other hardware-based platforms.

The Java platform has two components.

 The Java Virtual Machine (Java VM)

22
  The Java Application Programming Interface (Java API)

JDBC

In an effort to set an independent database standard API for Java; Sun

Microsystems developed Java Database Connectivity, or JDBC. JDBC offers a
generic SQL database access mechanism that provides a consistent interface to a
variety of RDBMSs. This consistent interface is achieved through the use of “plug-in”
database connectivity modules, or drivers. If a database vendor wishes to have JDBC
support, he or she must provide the driver for each platform that the database and Java
run on.

NetBeans

NetBeans is an integrated development environment (IDE) for developing

primarily with Java, but also with other languages, in particular PHP, C/C++, and
HTML5. It is also an application platform framework for Java desktop applications
and others.

The NetBeans IDE is written in Java and can run on Windows, OS X, Linux,
Solaris and other platforms supporting a compatible JVM.

The NetBeans Platform allows applications to be developed from a set of

modular software components called modules. Applications based on the NetBeans
Platform can be extended by third party developers.

5.2 Algorithm Explanation

The password-only authenticated key exchange protocol has following

modules.

Modules

1. Diffie-Hellman Key Exchange Protocol.

2. ElGamal Encryption Scheme.
3. Initialization.
4. Registration.

23
Modules Description

Diffie-Hellman Key Exchange Protocol

Diffie–Hellman key exchange (D–H) is a specific method of exchanging

cryptographic keys. It is one of the earliest practical examples of key exchange
implemented within the field of cryptography. The Diffie–Hellman key exchange
method allows two parties that have no prior knowledge of each other to jointly
establish a shared secret key over an insecure communications channel. This key can
then be used to encrypt subsequent communications using a symmetric key cipher.

Consider two users Alice and Bob, who know nothing about each other, but
wish to establish secure communications between them. Diffie-Hellman key exchange
protocol can be used as follows:

• Alice and Bob agree on a cyclic group G of large prime order q with a
generator g.
• Alice randomly chooses an integer a from Z *q and computes X=ga, while Bob
randomly chooses an integer b from Z, q and computes Y=g b. Then Alice and
Bob exchange X and Y.
• Alice computes the secret key K1=Ya=gba, while Bob computes the secret key
k2=Xb =gab.

It is obvious that k1=k2 and thus Alice and Bob have agreed on the same secret
key, by which the subsequent communications between them can be protected.

Elgamal Encryption Scheme

In cryptography, the ElGamal encryption system is an asymmetric key

encryption algorithm for public-key cryptography which is based on the Diffie–
Hellman key exchange. The ElGamal encryption scheme was invented by ElGamal in

24
1985 [12] on the basis of Diffie-Hellman key exchange protocol. It consists of key
generation, encryption, and decryption algorithms as follows:

25
Algorithm

Alice: Prime p &generator g are public keys of Bob Bob:

+ Public key Y=gkmodp

Chooses Private
Chooses random k X

Calculates
K=Yk modp

Calculates Calculates
C1=gkmodp (C1, C2) C1xmodp=K
C2=Mkmodp And recovers
message
M=k-1C2modp

Elgamal = Diffie-Hellman Key Exchange + Encryption by multiplying

mod p

26
Key generation

On input a security parameter k, it publishes a cyclic group G of large prime

order q with a generator g. Then it chooses a decryption key x randomly from Z *q and
computes an encryption key y=gx.

Encryption

On inputs a message mεG and the encryption key y, it chooses an integer r

randomly from Z*q and outputs a cipher text C= ∑ (m, y) = (A, B) = (gr, [Link]).

Decryption

On inputs a cipher text (A, B), and the decryption key x, it outputs the plain
text m=D(C, x) = B/Ax.

Elgamal Security

• Each user has a private key x.

• Each user has three public keys: prime modulus p, generator g and public
Y = gxmodp.
• Security is based on the difficulty of DLP.
• Secure key size > 1024 bits (today even 2048 bits).
• Elgamal is quite slow; it is used mainly for key authentication protocols.
Initialization

The two peer servers S1 and S2 jointly choose a cyclic group G of large prime
order q with a generator g2 and a secure hash function H : {0; 1}*->Zq, which maps a
message of arbitrary length into an l-bit integer, where l= log 2q. Next, S1 randomly
chooses an integer s1 from Zq and S2 randomly chooses an integer s2 from Zq, and S1
and S2 exchange g1s1 and g1s2. After that, S1 and S2 jointly publish public system
parameters G, q, g1, g2, H where g2 = gs1s2.

27
Registration

The two secure channels are necessary for all two-server PAKE protocols,
where a password is split into two parts, which are securely distributed to the two
servers, respectively, during registration. Although the concept of public key
cryptosystem is used, the encryption key of one server should be unknown to another
server and the client needs to remember a password only after registration.

28
 Chapter 6
TESTING

The purpose of testing is to discover errors. Testing is the process of trying to

discover every conceivable fault or weakness in a work product. It provides a way to
check the functionality of components, sub assemblies, assemblies and/or a finished
product. It is the process of exercising software with the intent of ensuring that the
software system meets its requirements and user expectations and does not fail in an
unacceptable manner.

Software testing is an important element of the software quality assurance and

represents the ultimate review of specification, design and coding. The increasing
feasibility of software as a system and the cost associated with the software failures
are motivated forces for well planned through testing.

Testing Objectives

These are several rules that can save as testing objectives they are:

• Testing is a process of executing program with the intent of finding an error.

• A good test case is one that has a high probability of finding an undiscovered
error.
6.1 Types of testing

In order to make sure that the system does not have errors, the different levels of
testing strategies that are applied at differing phases of software development are:
6.1.1 Unit Testing
Unit Testing is done on individual modules as they are completed and become
executable. It is confined only to the designer's requirements. Unit testing is different from
and should be preceded by other techniques, including:
 Inform debugging
 Code inspections.

29
Each module can be tested using the following two Strategies:

Black Box Testing

In this strategy some test cases are generated as input conditions that fully
execute all functional requirements for the program. This testing has been used to find
error in the following categories:
 Incorrect or missing functions.
 Interface errors.
 Errors in data structure or external database access.
 Performance error.
 Initialization and termination errors.
 In this testing only the output is checked for correctness.
 The logical flow of the data is not checked.

White Box testing

In this the test cases are generated on the logic of each module by drawing
flow graphs of that module and logical decisions are tested on all the cases. It has
been uses to generate the test cases in the following cases:

 Guarantee that all independent paths have been executed.

 Execute all loops at their boundaries and within their operational bounds.
 Execute internal data structures to ensure their validity.

6.1.2 Integrating Testing

Integration testing ensures that software and subsystems work together a
whole. It tests the interface of all the modules to make sure that the modules behave
properly when integrated together. It is typically performed by developers, especially
at the lower, module-to-module level. Testers become involved at the higher levels.
6.1.3 System Testing
Involves in - house testing of the entire system before delivery to the user. The aim is
to satisfy the user the system meets all requirements of the client's specifications. It is

30
conducted by the testing organization if a company has one. Test data may range from hand
generated to production.

Requires test scheduling to plan and organize:

 Inclusion of changes/fixes.
 Test data to use
One common approach is graduated testing: as system testing progresses and
(hopefully) fewer and fewer defects are found, the code is frozen for testing for
increasingly longer time periods.
6.1.4 Acceptance Testing
It is a pre-delivery testing in which entire system is tested at client's site on
real world data to find errors.
User Acceptance Test (UAT)
“Beta testing”: Acceptance testing in the customer environment.
Requirements traceability:
 Match requirements to test cases.
 Every requirement has to be cleared by at least one test case.
 Display in a matrix of requirements vs. test cases.

6.2 Test Cases

In general a test case is a set of test data and test programs and their expected
results. A test case in software engineering normally consists of a unique identifier,
requirement references from a design specification, preconditions, events, a series of
steps (also known as actions) to follow, input, output and it validates one or more
system requirements and generates a pass or fail.

31
Test Case 6.1.1

The Objective: Incorrect Login Details

ITEM TEST CONDITION INPUT OUTPUT PASS/

NO SPECIFICATION SPECIFICATION FAIL

If the username or Displays enter

Checking whether the
1 username and password password is not correct username Pass
is correct or not. correct. and password.

[Link] login Test case

32
Test Case 6.1.2

The Objective: Incorrect Cipher Text

ITEM TEST CONDITION INPUT OUTPUT PASS/

NO SPECIFICATION SPECIFICATION FAIL

Checking whether the

If the cipher key is Displays enter
1 entered cipher key is Pass
not correct. correct cipher key.
correct or not.

33
[Link] text Test case

34
Test Case 6.1.3

The Objective: Incorrect Registration

ITEM TEST CONDITION INPUT OUTPUT PASS/

NO SPECIFICATION SPECIFICATION FAIL

Checking whether the

1 Displays enter
username, password If the password is
correct username Pass
entered is correct or not correct.
and password.
not.

35
Fig. 6.4. registration Test case

36
 Chapter 7

RESULT ANALYSIS

The performance of our protocol and compare our protocol with existing
protocols for two-server password-only authentication and key exchange is analyzed.

Participant KMTG protocol Our Protocol

s
Client Comm.>15L Comm.>3L+4l
Comp.20 Comp.4
Rounds.3 Rounds.3
Server Comm.>19L Comm.>16L+4l
Comp.26 Comp.6
Rounds.5 Rounds.3

Both servers in our protocol equally contribute to authentication and key

exchange and have the same communication and computation complexity. It needs to
analyze the performance of one server.

As far as the server S1 is concerned, it receives M1 from the client C,

exchanges M2, M3 with the server S2, replies M4 to C, and receives M6 from C. The
total communication complexity for S 1 is 6L+3l, where L is the size of a group
element in G and l is the size of the hash value, i.e., log 2q. The total computation
complexity for S1 is five exponentiations in G.

The client C broadcasts M1 to S1 and S2, receives M4 and M5 from S1 and S2,
respectively, and broadcasts M6 to S1 and S2. The total communication complexity for
C is 3L+4l, almost half of the communication complexity for S 1. The total
computation complexity is a four exponentiation.

37
 In terms of parallel computation, our protocol has four communication rounds
only. The client C broadcasts M1 to the two servers S1 andS2 in the first round, S1 and
S2 exchange M2 andM3 in the second round, S1 and S2 both reply C with M4 andM5 in
the third round, C broadcasts M6 in the last round. The client C is involved in three
communication rounds.

A naive solution for two-server password-only authentication and key

exchange can be implemented by running two parallel password-authenticated key
exchange (PAKE) sessions between the client and two servers, respectively. At the
end, both servers confirm to each other the outcome of the authentication process.
This solution can be constructed with any existing efficient two-party PAKE protocol,
but is impractical because the client is required to remember two passwords, a
different one for each server.

To the best of our knowledge, Katz et al.’s protocol [20], called the KMTG
protocol for brevity, is the only existing symmetric protocol for two-server password-
only authentication and key exchange. The performance comparison of our protocol
with the KMTG protocol is shown in table. From above table our protocol is much
more efficient than the KMTG protocol in both the client and the server sides.

38
 Chapter 8
CONCLUSIONS AND FUTURE EXTENSIONS

Our project presented an enhanced symmetric protocol for two-server

password-only authentication and key exchange. Security analysis has shown that our
protocol is secure against passive and active attacks in case that one of the two servers
is compromised. Performance analysis has shown that our protocol is more efficient
than the existing symmetric and asymmetric two-server PAKE protocols.

Future Enhancement

In terms of parallel computation, our symmetric protocol has a feature that the
total running time in the two-server side is equal to the total running time of one
server, i.e., transmitting 6L+3l bits and computing five modular exponentiations in
four rounds. However, in the asymmetric YDB protocol and the asymmetric JWX
protocol, the total running time in the two-server side is equal to the sum of two
servers’ running time, i.e., transmitting 8L+3l bits and computing nine modular
exponentiations in 10 rounds in the YDB protocol, and transmitting 11L+3l bits and
computing 12 modular exponentiations in six rounds in the JWX protocol. Even if the
pre-computation is allowed, the two servers in the YDB protocol or the JWX protocol
still need to compute seven modular exponentiations in series. Therefore, our protocol
is even more efficient than the asymmetric YDB protocol and the asymmetric JWX
protocol in terms of the total running time.

Our protocol needs more storage to keep the password authentication

information in the two servers than the YDB protocol and the JWX protocol. Because
of rapidly declining data storage costs, the difference in storage costs between our
protocol and the YDB and JWX protocols is not significant.

39
40
 Chapter 9

REFERENCES

[1] M. Abdalla and D. Pointcheval, “Simple Password-Based En-crypted Key

Exchange Protocols,” Proc. Int’l Conf. Topics in Cryptology (CT-RSA),pp. 191-208,
2005.

[2] M. Abdalla, O. Chevassut, and D. Pointcheval, “One-Time Verifier-Based

Encrypted Key Exchange,”Proc. Eighth Int’l Conf. Theory and Practice in Public Key
Cryptography (PKC ’05),pp. 47-64, 2005.

[3] M. Bellare, D. Pointcheval, and P. Rogaway, “Authenticated Key Exchange

Secure against Dictionary Attacks,”Proc. 19th Int’l Conf. Theory and Application of
Cryptographic Techniques (Eurocrypt ’00), pp. 139-155, 2000.

[4] S. Bellovin and M. Merritt, “Encrypted Key Exchange: Password-Based Protocol

Secure against Dictionary Attack,”Proc. IEEE Symp. Research in Security and
Privacy,pp. 72-84, 1992.

[5] D. Boneh and M. Franklin, “Identity Based Encryption from the Weil
Pairing,”Proc. 21st Ann. Int’l Cryptology Conf. (Crypto ’01), pp. 213-229, 2001.

[6] D. Boneh and M. Franklin, “Identity Based Encryption from the Weil
Pairing,”SIAM J. Computing, vol. 32, no. 3, pp. 586-615, 2003.

[7] D. Boneh, “The Decisional Diffie-Hellman Problem,”Proc. Third Int’l

Algorithmic Number Theory Symp.,pp. 241-250, 1998.

[8] V. Boyko, P. Mackenzie, and S. Patel, “Provably Secure Password-Authenticated

Key Exchange Using Diffie-Hellman,”Proc. 19th Int’l Conf. Theory and Application
of Cryptographic Techniques (Eurocrypt ’00),pp. 156-171, 2000.

41
[9] J. Brainard, A. Jueles, B.S. Kaliski, and M. Szydlo, “A New Two-Server
Approach for Authentication with Short Secret,”Proc. 12 th Conf. USENIX Security
Symp., pp. 201-214, 2003.

[10] W. Diffie and M.E. Hellman, “New Directions in Cryptogra-phy,”IEEE Trans.

Information Theory, IT-22, no. 6, pp. 644-654, Nov. 1976.

[11] M. Di Raimondo and R. Gennaro, “Provably Secure Threshold Password

Authenticated Key Exchange,”Proc. 22nd Int’l Conf. Theory and Applications of
Cryptographic Techniques (Eurocrypt ’03), pp. 507-523, 2003.

[12] T. ElGamal, “A Public Key Cryptosystem and a Signature Scheme Based on

Discrete Logarithms,”IEEE Trans. Information Theory, vol. IT-31, no. 4, pp. 469-
472, July 1985.

[13] W. Ford and B.S. Kaliski Jr., “Server-Assisted Generation of a Strong Secret
from a Password,”Proc. IEEE Ninth Int’l Workshop Enabling Technologies:
Infrastructure for Collaborative Enterprises, pp. 176-180, 2000.

[14] O. Goldreich and Y. Lindell, “Session-Key Generation using Human Passwords

Only,”Proc. 21st Ann. Int’l Cryptology Conf. Advances in Cryptology (Crypto
’01),pp. 408-432, 2001.

[15] L. Gong, T.M.A. Lomas, R.M. Needham, and J.H. Saltzer, “Protecting Poorly-
Chosen Secret from Guessing Attacks,”IEEE J. Selected Areas in Comm.,vol. 11, no.
5, pp. 648-656, June 1993.

[16] S. Halevi and H. Krawczyk, “Public-Key Cryptography and Password

Protocols,”ACM Trans. Information and System Security, vol. 2, no. 3, pp. 230-268,
1999.

[17] D. Jablon, “Password Authentication Using Multiple Servers,” Proc. Conf.

Topics in Cryptology: The Cryptographer’s Track at RSA (RSA-CT ’01), pp. 344-
360, 2001.

42
[18] H. Jin, D.S. Wong, and Y. Xu, “An Efficient Password-Only Two-Server
Authenticated Key Exchange System,” Proc. Ninth Int’l Conf. Information and
Comm. Security (ICICS ’07),pp. 44-56, 2007.

[19] J. Katz, R. Ostrovsky, and M. Yung, “Efficient Password-Authenticated Key

Exchange Using Human-Memorable Pass-words,”Proc. Int’l Conf. Theory and
Application of Cryptographic Techniques: Advances in Cryptology (Eurocrypt
’01),pp. 457-494, 2001.

[20] J. Katz, P. MacKenzie, G. Taban, and V. Gligor, “Two-Server Password-Only

Authenticated Key Exchange,” Proc. Applied Cryptography and Network Security
(ACNS ’05), pp. 1-16, 2005.

[21] Xun Yi, San Ling, and Huaxiong Wang “Efficient Two-Server Password-Only
Authenticated Key Exchange,” IEEE Transactions on Parallel and Distributed
Systems, vol.24, no.9, September 2013

43
 APPENDIX

A.1 Sample Code

package ElGamal;

import [Link].*;

import [Link].*;

import [Link].*;

import [Link].*;

public class KeyGeneration

public static void main(String arg[])

KeyGeneration a=new KeyGeneration();

[Link]("Welcome to Key Generation");

//Prime key

public static String generate_Primekey()

final String bint;

BigInteger p, b, c, secretKey;

44
Random sc = new SecureRandom();

// Prime & generator key calculation

p = [Link](64, sc);

b = new BigInteger("3");

[Link]("****************");

[Link]("\n");

//[Link]("sc = " + sc);

[Link]("prime = " + p);

[Link]("generator = " + b);

[Link]("\n");

[Link]("****************");

bint=[Link]()+","+[Link]()+","+[Link]();

return bint;

//Public Key

public static String generate_Publickey(String pp,String bb, String skey)

BigInteger p, b, c, secretKey;

p = new BigInteger(pp);

b = new BigInteger(bb);

45
secretKey = new BigInteger(skey);

// public key calculation

c = [Link](secretKey, p);

[Link]("\n");

[Link]("Key Generation");

[Link]("\n");

[Link]("****************");

[Link]("\n");

[Link]("public key="+c);

[Link]("\n");

[Link]("****************");

return [Link]();

package ElGamal;

import [Link].*;

import [Link].*;

import [Link].*;

import [Link].*;

public class Elgamal_Encryption

46
{

public static void main(String arg[])

Elgamal_Encryption a=new Elgamal_Encryption();

[Link]("Welcome to Elgamal Encryption");

//Elgamal Encryption

public static String encrypt(String mx,String cc, String pp, String bb, String s)

final String ekey;

BigInteger myx = new BigInteger(mx);

BigInteger m = new BigInteger(s);

BigInteger y = new BigInteger(cc);

BigInteger p = new BigInteger(pp);

BigInteger g = new BigInteger(bb);

BigInteger k = [Link](myx, p);

BigInteger c1 = [Link](myx, p);

BigInteger c2 = ([Link](k)).mod(p);

[Link]("****************");

[Link]("\n");

47
[Link]("Key Encryption K="+k);

[Link]("Key Encryption C1="+c1);

[Link]("Key Encryption C2="+c2);

[Link]("\n");

[Link]("****************");

return [Link]()+","+[Link]()+","+[Link]();

package ElGamal;

import [Link].*;

import [Link].*;

import [Link].*;

import [Link].*;

public class Elgamal_Decryption

public static void main(String arg[])

Elgamal_Decryption a=new Elgamal_Decryption();

[Link]("Welcome to Elgamal Decryption");

48
//Elgamal Encryption

public static String decrypt(String ckey,String c22, String pp)

BigInteger c2 = new BigInteger(c22);

BigInteger p = new BigInteger(pp);

BigInteger k = new BigInteger(ckey);

BigInteger kinv = [Link](p);

BigInteger m = ([Link](c2)).mod(p);

[Link]("****************");

[Link]("\n");

[Link]("Elgamal Decryption");

[Link]("****************");

[Link]("K inverse="+kinv);

[Link]("\n");

[Link]("Recovered Key="+m);

[Link]("\n");

[Link]("****************");

return [Link]();

49
A.2 Input/Output Design

User Login

50
Registration

51
Searching and sharing files

52
Downloading files

53
54
55
Attacks

56