Secure authentication protocols to resist off-line attacks on authentication data table

Abstract

In text-based authentication, the passwords along with user names are maintained in the Authentication Data Table (ADT). It is necessary to preserve the privacy of passwords in ADT to avoid offline attacks like brute force attacks, lookup table attacks, etc. In this paper, three password protection schemes, namely Encrypted Image Password (EIP), Dynamic Authentication Data Table (D-ADT), and Extended Encrypted Image Password (EEIP) are proposed for secure authentication. In EIP, the input passwords are first converted to hashed passwords and then transformed into images. Next, these image passwords are encrypted using a novel image password encryption system using chaos functions and confusion-diffusion mechanisms. In D-ADT, the hashed passwords are encrypted using a random key. The major highlight of this scheme is that during every log, the hashed password is encrypted with a new random key while keeping the plain password same as it is. So, during each login of the user, the old encrypted password is replaced with a new encrypted password in the authentication data table. The EEIP scheme combines both approaches. Passwords are converted to images and image passwords are encrypted with the new random key at every login. Performance and security analysis are carried out for the proposed algorithm concerning correlation analysis, differential analysis, entropy analysis, computation time, keyspace, and offline attack analysis.

1. Introduction

Nowadays, in this internet world, common people are becoming regular internet users as compared to the previous decade. Two reasons are behind this: i) availability of smartphones at lower prices because of growth in mobile technology and ii) growth in high-speed internet technology. Hence, businesses but also common people are also far more attracted to online. Today, the availability of mobile apps is increasing such that it is producing a remarkable change in the way common people feel and experience technology. People prefer online services in every sector like banking, shopping, transport, finance, health, marketing, and many more. So, people’s efforts are reduced, and comfort is guaranteed. However, while accessing such online services, the security protocol plays a key role. To access any device or service in this digital world, the first step is authentication i.e. validating the user. But it is observed that a secure authentication mechanism is still challenging because of the hacker’s intelligence. At the same time, the researchers are also continuously providing solutions for secure access through complex computational logic and different input factors. Anyhow all these are ongoing parallel activities taken by hackers and researchers. The solution methodologies include passwords, PINs, hashed passwords, salted passwords, key stretching, graphical passwords, one-time passwords, biometric passwords, and more variations of biometrics (fingerprint, iris, ECG, palm print, etc.). Among these various solutions, passwords and their variations are popular because of their convenience and easy implementation. Unfortunately, this becomes the greatest opportunity for cyber-criminals to focus on this area. Because users have to generate their passwords, there is often a chance that they are unable to create strong and secure credentials.

On the other hand, if passwords are highly secure, then there is a threat of attacks on ADT (Authentication Data Table) on the server side. ADT contains user credentials like user id and password. Hence, it is mandatory in high-security systems that the passwords need to be well protected against attacks. ADTs are much more vulnerable to precomputed table attacks. Due to the high availability of high computation processing units at a low cost, it is becoming easy to construct such precomputed tables. Also, on the internet, there are software tools available that convert a hash value to plain text (e.g., http://reverse-hash-lookup.online-domain-tools.com/). Using such tools, it is possible to create a precomputed table that consists of hashed passwords and corresponding plain passwords. If such precomputed tables are already created, then it is less challenging to find plain passwords from the ADT and break the security system. The attacker may apply faster search techniques like binary search to reveal passwords. After getting ADT, to reveal the passwords from ADT, an attacker may perform attacks such as brute force attack, dictionary attack, lookup table attack, reverse lookup table attack, rainbow table attack, or advanced dictionary attack. Depending on whether precomputation logic is used or not, these attacks are divided into two types: lookup and rainbow table attack comes under theprecomputation based attacks andremaining comes under non-precomputation based attacks. In the first type, because of the precomputation logic, both rainbow and lookup table attacks are easy ways to reveal passwords. In the second type, all four attacks simply try each given password from the password list. In the brute force attack, the password list contains all combinations of characters from a given character set, whereas the dictionary and reverse lookup table often contain frequently used passwords. The advanced dictionary contains the words based on the user practices to construct passwords.

The paper is organized as follows: in Section 2, the related work concerning the authentication and image cryptosystem techniques are discussed, in Section 3, the framework and working of proposed schemes are described. Performance and Security analysis is performed concerning the NIST randomness test, correlation analysis, differential analysis, information entropy analysis, the privacy of the ADT concerning off-line attacks, key space analysis, computational complexity analysis and comparison, and known/chosen plain text attack in Section 4. The conclusions are made in the last Section.

2. Literature survey

In this paper, three password protection schemes, namely Encrypted Image Password (EIP), Dynamic Authentication Data Table (D-ADT), and Extended Encrypted Image Password (EEIP) are proposed for secure authentication. The proposed methodologies use an image cryptosystem for password encryption. Hence, password-based authentication systems, traditional and existing chaos-based image encryption approaches are elaborated.

2.1. Backgound

Researchers have categorized authentication into five types: 1) text-based; 2) graphical-based; 3) biometrics-based; 4) Web-based; and 5) hardware-based solutions [4,5].

Text-based authentication using a password is more popular because of its low cost and easy implementation. The Authentication Data Table (ADT) is available on the server. It contains user credentials such as userid, password, and additional informative attributes. The way in which the user credentials are stored in ADT is important from a security point of view. But, it is observed that passwords are easily cracked because of users’ careless nature [2]. Generally, the user selects familiar words which are easy to remember as a password, and the same password is continued for different systems. The ADT contains userids and passwords which could be stolen by attackers in case of a weak security system or compromised system. Attackers continuously try to leak the security of the system, and at the same time, the corresponding application system should also focus on how to strengthen the security. In reality, the systems that are not strengthening their security protocols regularly are more vulnerable. Since the same passwords are usually used by the user for a long time, attackers may access high-security systems using cracked passwords. Next, after getting ADT, attackers may proceed for off-line attacks [24]. Normally, the ADT contains passwords in the hashed form. Hashed passwords are generated using a cryptographic hash function [3]. The hash function is a one-way mapping function that transforms any length of data into fixed-length data. It is difficult to find plain values directly from hashed values because of one-way mapping. But, researchers found that hashed passwords are not protected well against precomputation table attacks, such as lookup table attacks and rainbow table attacks [22]. Due to decreasing costs and the high availability of high computing, processing, and storage resources, the creation of precomputed tables is possible. These kinds of precomputations are used in the lookup table and rainbow table. So, the above two attacks are increased to more extent. Hence, an attacker could become more successful in cracking the hashed passwords. To protect from such precomputation attacks, the salting of passwords [26] is done. Salt is an array of characters that are inserted into the plain value and then hashed which acts as a noise. The size of the salt and the strength of password security are directly proportional, i.e., if salt is more, then security is also more. Next, to improve the level of security, salt can be dynamic [7]. On the other hand, it is observed that salted passwords are not strong under dictionary attacks. In these attacks, an attacker attempts all the possible passwords from the predefined list, i.e., the dictionary. To protect from a dictionary attack, the key stretching method is useful. In this, weak passwords are converted to enhanced passwords. But, these mechanisms are vulnerable to attacks like Narrow-Pipe Attack [12]. Luo et. al. [17], given an Encrypted Negative Password (ENP) solution. In this, the hash value of the original password is calculated. Next, the negative password is calculated. At last, the negative password is converted into an Encrypted Negative Password using an asymmetric cryptosystem. ENP could protect against lookup table attacks and dictionary attacks. But, the generation of negative passwords is time-consuming. All these techniques with their own advantages and limitations are summarised in Table 1.

Table 1

Summary of existing methodologies

S. No.	Scheme	Methodology	Advantages/Limitations
1	Ref. [3]	Hashed Passwords	1. Easy to implement
			2. Faster
			3. Vulnerable to Precomputation attacks
2	Ref. [26]	Salted Passwords	1. Easy to implement
			2. Speed is inversely proportional to the size of salt
			3. Vulnerable to dictionary attack
3	Ref. [7]	Dynamic salted Passwords	1.Run time salt generation
			2. Vulnerable to dictionary attack
4	Ref. [6]	Key stretching	1. Similar to salting
			2. Speed is inversely proportional to the size of stretching
			3. Vulnerable to Narrow pipe attack
5	Ref. [17]	Cryptographic Hash, Negative Password	1. No offline attacks
			2. High processing time, computationally expensive

2.2. Image cryptosystem

In the proposed system, plain passwords are converted into images, then image passwords are encrypted using a novel image encryption system. Hence, various image encryption techniques are studied here.

Mostly, image encryption follows a chaotic map-based confusion-diffusion model. The idea is based on Fridrich’s substitution-permutation network [10]. Fridrich’s model consists of two phases- confusion and diffusion. In confusion, the pixels of the image are repositioned, and in diffusion, pixel values are modified. The confusion and diffusion operations are made reversible so that decryption is possible. Chaotic map functions are used to generate keystreams required for confusion and diffusion operations. Confusion-diffusion operations are repetitively executed for m and n times to increase the security level. The 1D, 2D, and 3D variations of chaotic functions have been used in different systems. As dimensions increase, the complex, chaotic behavior produced by the chaotic system also increases and the guessing of chaotic behavior becomes complex. On the other hand, the implementation cost of these more dimensional techniques is high due to their complexity [11]. 1D chaos is preferable because of its simplicity, but it has drawbacks like, (1) limited domain for chaos generated values (2) low computational complexity leading to cryptanalysis using correlation and repetitive functions, and (3) the chaos function spreads output sequence values non uniformly [32]. The common approach to encrypt an image is as follows: a two-dimensional digital image is transformed into a byte array, and the required keystreams for confusion and diffusion are produced by chaotic functions. As an example, for confusion, 2-D maps such as the Arnold Cat map, and Henon map are used in [21]. Also, to increase the quality of the cipher image, the rounds of confusion-diffusion are increased. Due to this, the computation time grows. On the other hand, to achieve similar results in fewer confusion/diffusion rounds, operations on the bits are defined. [14,27,31,33] designed the cryptosystem that operates on the bits. In this system, first, the input image is transformed into a bitstream. Next, confusion and diffusion operations are applied. 3-D map along with gray code logic for image encryption is applied in [8]. Next, a Five-dimensional multi-wing hyper-chaos-based system is designed by Li et al. [14]. Here, the keystream is produced by a hyper-chaotic system where the key is derived from the original image. Next, bit/pixel level confusion and diffusion are applied. However, the computational time complexity of such a more dimensional chaotic system is much more. To decrease computational complexity, Zhi–Liang et al. [34] proposed a solution using the logic of bit positions of the pixel. According to information theory, in the image, the most significant 4 bits of pixel contain around 94.125% information. Taking advantage of this, confusion of most significant bits is done while a group of least significant 4 bits is treated as one unit and repositioned individually. Using a Logistic map, each pixel is changed during diffusion. Next, a more efficient method based on BBD (Binary Bit-plane Decomposition) is proposed in [27,31,33].

In addition to the above methodologies, a random number embedding and DNA-level self-adaptive confusion-diffusion is applied in [29]. The magic square theorem is applied for confusion at the pixel level and the octree principle is invoked to achieve pixel bit shifting in [28]. Block-based preprocessing, postprocessing, and shuffling are used in [16]. But, it may require padding because of the fixed size of the blocks. An input image-related rows and columns shuffling, a pixel-level roll shift, and a bit-level cyclic shift are applied in [15]. Focusing on medical image encryption, simple random shuffling, and XOR operations are used in [20] for encryption logic.

Hence, from the above, it is observed that various researchers have designed various logic. The core part is confusion and diffusion of image components that can be block, pixel, or bit. Every method has pros as well as cons. The limitation includes small key space, high computational power, suffering from differential attack and chosen/plain text attacks, fixed keys, etc.

To overcome limitations of the existing authentication schemes as shown in the Table 1, in this paper, three password-based authentication methodologies are designed and implemented for secure authentication through SHA256 and novel image cryptosystem. The proposed scheme EIP is based on image encryption using Fridrich’s confusion-diffusion model. Here, input passwords are initially converted to hashed passwords using the Secure Hash Algorithm (SHA256) and then embedded into the binary image. Next, these image passwords are encrypted using a novel image password encryption system to get grayscale Encrypted Image Passwords as a result. Arnold’s cat map and logistic map are used to generate encryption key streams. The control parameters used for these Chaotic maps are calculated from the value of the hashed password. In the second scheme, D-ADT, initially, input passwords are hashed using SHA256, and the hash value of passwords is ciphered using Random Key. The Random Key is generated using the RANDOM() function. Random Key is encrypted with the key calculated from the hashed password. In this case, the ADT preserves three values, i.e., UserID, Encrypted Password, and Encrypted Random Key. The major highlight of this scheme is that during every login, the hash value of the password is ciphered using a new random key while keeping the plain password the same as it is. The third scheme, EEIP, is a combination of the above two approaches. Here, the passwords are converted to images, and image passwords are encrypted with a new random key at every login. The ADT contains UserID, Encrypted Image Password, and Encrypted Random Key.

2.3. Motivation and contribution

Existing methodologies like hashed password [3], salted password [26], dynamic salted password [7], key stretching [6] are vulnerable to precomputation table attacks, dictionary attacks, and Narrow pipe attack. The overhead of Encrypted Negative Password scheme (ENP) [17], is the generation of negative database for the passwords.

The process of generating negative database passwords is complex and time consuming. The proposed EIP uses a simple and effective procedure of image password. In various authentication techniques, the authentication data table is static. Hence, ADT offline attacks are possible. To overcome these attacks, Dynamic ADT (D-ADT) scheme is proposed. Next, to increase the level of security, the EIP and D-ADT are combined together and a novel Extended EIP (EEIP) scheme is proposed. This EEIP can be used in an application where high security is required like defence, finance etc. To design the above algorithms, a novel image cryptosystem is proposed. Here the key parameters depend on the input image.

The contributions of the proposed paper are:

Passwords are well protected in ADT against offline attacks using novel encryption techniques.

Proposed EIP and EEIP are alternative schemes for Encrypted Negative Password (ENP). ENP requires a negative database password to generate ENP. The process of generating negative database passwords is complex. The proposed EIP uses a simple and effective procedure of image password.

Decryption of encrypted passwords is not required during authentication; rather, a comparison is made in the cipher domain itself.

A novel image cryptosystem whose encryption parameters depend on input image is implemented to achieve a higher level of security.

Passwords are stored in encrypted image form, and encrypted image passwords change during every login by keeping the plain password the same as it is.

3. Proposed system design

In the following subsequent subsections, the proposed three authentication schemes are described and compared.

3.1. Scheme 1-encrypted image password

Figure 1 shows the flow of the proposed Encrypted Image Password (EIP). Initially, the user gives a plain password which is hashed, and the corresponding bitstream is generated. Using this bitstream, three keys are generated. These keys are used to create encrypted image passwords. The detailed working flow of the proposed system is described through subsequent subsections.

Fig. 1.

Data flow diagram of encrypted image password (EIP).

3.1.1. Registration of user

The registration process for a new user is done as given below:

• On the user machine, the user inputs the credentials, including UserId and Password. Next, the entered credentials are sent to the Authentication Server (AS) through a secure channel.

• AS calculates the hash value of UserID using SHA256 and searches UserId in the ADT for the calculated hash. If UserId already exists, AS rejects the registration request and returns a Negative Acknowledgment to the client. Otherwise, step (iii) is executed.

• The received password is hashed using SHA256 and hashed password of length w is obtained.

• $\mathit{w}\times \mathit{w}$ image password is generated from the hashed password using the proposed algorithm $\mathit{passwordToImage}$ .

• Image password is encrypted to get EIP using the proposed $\mathit{imagePasswordEncrypt}$ algorithm using $\mathit{hKey}$ as the key parameter. $\mathit{hKey}$ is produced from $\mathit{hashedPassword}$ .

• AS inserts a record for UserId in the authentication data table and returns Positive Acknowledgment to the client.

Algorithm 1:

PasswordToImage

Algorithm 2:

ImagePasswordEncrypt

3.1.2. User authentication

• On the user machine, the user inputs the credentials, including UserId and Password. Next, the entered credentials are sent to the Authentication Server (AS) through a secure channel.

• AS calculates the hash of UserId using SHA256 and searches UserId in ADT for the calculated hash. If the user does not exist, it stops the authentication process and returns a Negative Acknowledgment to the client. Otherwise, step (iii) is executed.

• The encrypted image password is found from ADT named EIP1.

• The received password is hashed using SHA256, and $\mathit{hashedPassword}$ of length w is obtained. Also, $\mathit{hKey}$ is produced from $\mathit{hashedPassword}$ .

• $\mathit{w}\times \mathit{w}$ image password is generated from $\mathit{hashedPassword}$ using proposed Algorithm 1 $\mathit{passwordToImage}$ .

• Image password is encrypted through Algorithm 2 $\mathit{ImagePasswordEncrypt}$ using $\mathit{hKey}$ , and EIP2 is obtained.

• EIP1 and EIP2 are compared by taking bitwise XOR. If the XOR operation gives ZERO, then return Positive Acknowledgment. Otherwise, return Negative Acknowledgment. The advantage is that the comparison is made in an encrypted domain, and there is no need for decryption for matching.

Image password could be obtained through the following steps as denoted in Fig. 1. First, the received password is hashed using SHA256. Next, the hashed password, i.e., w-bit sequence, is transformed into $\mathit{w}\times \mathit{w}$ binary image password. To convert hashed password to a binary image password, initially, two keys (Key1 and Key2) are derived from $\mathit{hKey}$ using mathematical operations. Key1 and Key2 are used to calculate the control values of two different chaotic maps. By executing these chaotic functions iteratively, two sequences are generated. The first sequence is called as Shuffling Index, and it contains random integer values ranging from (0 to $\mathit{w}-1$ ) of length w. Similarly, the second bitstream of length $\mathit{w}\times \mathit{w}$ is generated and converted into $\mathit{w}\times \mathit{w}$ binary image. Next, the original bits of $\mathit{hashedPassword}$ are embedded row-wise according to Shuffling Index to obtain a binary image. Thus, $\mathit{imagePassword}$ is generated. Finally, $\mathit{imagePassword}$ is encrypted using Algorithm 2 $\mathit{ImagePasswordEncrypt}$ to get EIP. Table 2 gives the intermediate result of the image password.

Table 2

Generation of image password

InputPassword		‘plainPassword’
HashedPassword		101010011110101110011011100100111111000110110101000101001110110011 001001001000100001111110110100100000111000111100011001111101111001 100001000011111110010111011111110110110101010111110001100000101000 00111101001010100110100001000100110010110010111001111000
ShufflingIndex		[0, 77, 127, 91, 228, 31, 75, 17, 160, 50, 219, 41, 1, 84, 210, 216, 159, 104, 43, 73, 152, 119, 197, 116, 20,44, 242, 53, 9, 26,174, 110, 58, 79, 176, 10, 201, 244, 161, 182, 112, 105, 141, 193, 153, 82, 27, 148, 100, 47, 145, 63, 37, 18,224, 170, 162, 179,188,218, 231, 181, 194, 54, 103, 184, 122, 109, 106, 254, 62, 2, 243, 67, 19, 154, 92, 131, 172, 151, 86, 255, 156, 38, 238, 36, 64, 21, 163, 93, 68, 207, 35, 57, 150, 230, 204, 158, 89, 187, 203, 185, 32, 94, 39, 6, 241, 225, 140, 80, 251, 177, 78, 129, 101, 250, 65, 34, 83, 205, 98, 248, 175, 113, 164, 69, 114, 168, 59, 222, 235, 202, 149, 49, 137, 209, 29, 126, 189, 74, 22, 190, 143, 227, 111, 229, 128, 236, 13, 232, 239, 214, 95, 215, 87, 142, 14, 130, 45, 186, 40, 198, 60, 117, 245, 4, 55, 56, 76, 144, 46, 42,136, 125, 191, 252, 107, 199, 246, 183, 173, 135, 30, 124, 171, 99, 169, 118, 157, 51, 192, 249, 200, 52, 120, 90, 11, 132, 247, 15,155, 217, 133, 23, 97, 24, 206, 33, 180, 221, 71,134, 166, 3, 48, 121, 211, 66, 146, 195, 208, 72, 70, 7, 165, 25, 196, 139, 12, 8, 226, 253, 240, 123, 85, 147, 138, 234, 96, 233, 115, 81, 167, 178, 28, 223, 102, 16, 212, 237, 220, 61, 213, 108, 88, 5]
Image Matrix before embed hashedPassword)	Row0	’1’101100000011011111110101000110010011001110010011001011011100101 010100100000000001001
		011011011011110100000101010101110011010010110111011010010011110111 11111001000101000101
		100110001010101000100111010101111011001011011000001010000001110111 1000010000011011010
	$\cdots$	$\cdots$
	Row255	10100’0’1000000111011011010010111010110001000101001111101000010110 011000001101100111011001000100101000110010101111101010100010100101 1111000001011001010111011110001000111111 1100100011101011011011011 1010111110101100100000000011011101111110111111001111011011000
Image Matrix after embed hashedPassword	Row0	110110000001101111111010100011001001100111001001100101101110010101 01001000000000010111
		010010110110110111101000001010101011100110100101110100100111101111 1111001000101000101
		100110001010101000100111010101111011001011011000001010000001110111 1000010000011011010
	$\cdots$	$\cdots$
	Row255	101000100000011101101101001011101011000100010100111110100001011001 100000110110011101100100010010100011001010111110101010001010010111 110000010110010101110111100010001111111110010001110101101101101110 10111110101100100000000011011101111110111111001111011011000

3.1.3. Image password cryptosystem

The block diagram of the proposed image password cryptosystem is shown in Fig. 2. The cryptosystem is based on Fridrich’s confusion-diffusion model. It uses two chaotic maps, viz. Arnold cat map and Logistic map to generate keystreams.

Fig. 2.

Image password encryption.

Arnold’s cat map: This map is two-dimensional that forms the torus into itself and is given below: $$\begin{array}{}\text{(1)}& \hfill \left[\begin{array}{c}\hfill {\mathit{x}}_{\mathit{i}+1}\hfill \\ \hfill {\mathit{y}}_{\mathit{i}+1}\hfill \end{array}\right]=\left[\begin{array}{cc}\hfill 1\hfill & \hfill \mathit{b}\hfill \\ \hfill \mathit{a}\hfill & \hfill \mathit{ab}+1\hfill \end{array}\right]\left[\begin{array}{c}\hfill {\mathit{x}}_{\mathit{i}}\hfill \\ \hfill {\mathit{y}}_{\mathit{i}}\hfill \end{array}\right]mod\mathit{N}& \end{array}$$ where a and b are the positive integers that act as input arguments of the function.

Logistic Map: This map can generate chaotic behavior using: $$\begin{array}{}\text{(2)}& \hfill {\mathit{t}}_{\mathit{n}+1}=\mathit{\mu }{\mathit{t}}_{\mathit{n}}\mathrm{(}1-{\mathit{t}}_{\mathit{n}}\mathrm{)}& \end{array}$$ where ${\mathit{t}}_{\mathit{n}}$ is a number between $\mathrm{(}0\mathrm{,}1\mathrm{)}$ which denotes the ratio of the existing population to the maximum possible population. The values of interest for the control parameter μ lie between $[0\mathrm{,}4]$ .

For image password encryption, initially, the image password is converted into a bit image. Using Arnold’s cat map (1), keys $\mathit{xKeyStream}$ and $\mathit{yKeyStream}$ are generated. Keys are controlled by input values $\mathit{x}\mathrm{,}\mathit{y}\mathrm{,}\mathit{a}$ , and b which are derived from hashedPassword’s $\mathit{hKey}$ . Binary image password $\mathit{BitIP}$ is confused to $\mathit{cBitIP}$ as follows: $$\begin{array}{}\text{(3)}& \hfill \mathit{cBitIP}[\mathit{s}\mathrm{,}\mathit{r}]\leftarrow \mathit{BitIP}[\mathit{xKeyStream}[\mathit{s}]\mathrm{,}\mathit{yKeyStream}[\mathit{r}]]& \end{array}$$ where s and r are row-column indices. Next, bits of $\mathit{cBitIP}$ are encoded into pixels to get confused image password and transformed into pixel list as $\mathit{pList}$ . Diffusion keystream is generated from Logistic map (2). Next, $\mathit{pList}$ is diffused using Logistic map sequence $\mathit{logisticKeyStream}$ and XOR operation as follows: $$\begin{array}{}\text{(4)}& \hfill \mathit{dList}[\mathit{i}]\leftarrow \mathit{pList}[\mathit{i}]\oplus \mathit{logisticKeyStream}[\mathit{i}]& \end{array}$$ Finally, $\mathit{dList}$ is transformed into 2-D to get an encrypted image password $\mathit{EIP}$ . Confusion-diffusion rounds are repetitively executed for m and n times to get more secure $\mathit{EIP}$ . Figure 3 shows the sample image password and the corresponding encrypted image password.

Fig. 3.

Image password and encrypted image password.

3.2. Scheme 2-protecting password by dynamic ADT

In this approach, a trick based on the user’s login is used to change the encrypted password without modifying the original plain password. Figure 4 describes the flow of this scheme. At every successful login, a plain password is hashed using SHA256. The $\mathit{rKey}$ is obtained by applying SHA256 to the random number using the RANDOM() function. This $\mathit{rKey}$ is used as a key to encrypt $\mathit{hashedPassword}$ to obtain encrypted password. Next, $\mathit{hKey}$ is calculated from $\mathit{hashedPassword}$ , and using this $\mathit{hKey}$ as key $\mathit{rKey}$ is encrypted using AES with base64. The ADT contains three attributes i.e. $\mathit{UserId}\mathrm{,}\mathit{EncryptedPassword}$ and $\mathit{Encrypted}\mathit{rKey}$ . In the registration process, a record is appended in ADT for a new user using the above three attributes.

Fig. 4.

Flow of ADT update during each successful login.

During authentication(login), the user gives plain UserId and Password. The password is hashed, and the corresponding $\mathit{hKey}$ is obtained. For a given valid UserID, the encrypted password and encrypted $\mathit{rKey}$ are searched from ADT. Using $\mathit{hKey}$ , encrypted $\mathit{rKey}$ is decrypted and plain $\mathit{rKey}$ is obtained. Now, using plain $\mathit{rKey}$ , encrypted password is decrypted. If the decrypted password is matched with $\mathit{hashedPassword}$ then login is successful. Table 3 illustrates how the encrypted passwords are changing in ADT without changing plain passwords during login of a particular user. Algorithm 3 shows working of Dynamic ADT.

Table 3

Dynamic ADT method-ADT update during login

	Login1
UserId	NitTrichy
Password	Tiruchirappalli
hashedUserId	0dfea81a5d7358e8469b4743d325f17728fd954ba194cc5fc41ca5ada4c5ac1c
hashedPassword	2357c4411be2e220bf481f177ae883c336d7cac02dddd53716ac985cf19cc820
hKey	2ac0c03a9ec254d573b1213fd81a73b73eefb760c9a3a6f416cc1cfd80d5d497
rKey	e48e5ad8fb52e0bb4a2a99ac0c1e55625ccb5ea7049e02bed5bab6ba90eefa7a
Encrypted Password	jKA/jFjki0zhit/LvILVLMZ3x9UwnYkll4UIEK0iY95jJN9Qspyhro998LwJPTBYCa9Pb4DtuQGI tBpM96oqcLj0qdEdbf/v55oF4aijvhU=
Encrypted rKey	nJ2lG5ElohSqPa11Z/Fzg9aJDCYIXveMZJi+eZJBkatXJquWZ1+DwoJOsYsclBd3qO/VA4OaDQKYilvNXSY6NaW7BtpUq1Ef5AG4YMKBzuk=
	Login2
User Id	NitTrichy
Password	Tiruchirappalli
hashedUserId	0dfea81a5d7358e8469b4743d325f17728fd954ba194cc5fc41ca5ada4c5ac1c
hashedPassword	2357c4411be2e220bf481f177ae883c336d7cac02dddd53716ac985cf19cc820
hKey	2ac0c03a9ec254d573b1213fd81a73b73eefb760c9a3a6f416cc1cfd80d5d497
rKey	4a95ca7fed6126c6270b38de5cc7e076c4a505f7e7f370166deb599ba3ec892f
Encrypted Password	RDOoMX34wHC2kAu+XiYanRAGq5tJopVKJRzgKs7/+kwlEQhO+Ja86Ym/j4hRmbwH2miCRIjubu5mJy+ad+Ko2DE5JkNNSlt/Z4Vz4cprA/I=
Encrypted rKey	L32STu0CF+tCWkS4BRkMzgMo6O6zEHhtTySjHUMKPofPRwKdDGlG9yy5ZITaBd7YsUlDjQPKD+S5HF7yKzqdVdja5sjeQlXSwQI09ps/Kj0=
	Login3
User Id	NitTrichy
Password	Tiruchirappalli
hashedUserId	0dfea81a5d7358e8469b4743d325f17728fd954ba194cc5fc41ca5ada4c5ac1c
hashedPassword	2357c4411be2e220bf481f177ae883c336d7cac02dddd53716ac985cf19cc820
hKey	2ac0c03a9ec254d573b1213fd81a73b73eefb760c9a3a6f416cc1cfd80d5d497
rKey	87f8ff24845f4dc4354be4df0dfc1a59219ce69c8945d68e67499c2acf2f165e
Encrypted Password	mFW9i4K719CwF4nMPwQTHiW6YcMSCffvUfGD6wRMTWOuaW2IduyyhCjdLm0VMQOLc2HtEcQrHse1bsMiVVV2ZpEbb8iYxU8Nd7EfDAE4D/M=
Encrypted rKey	PXMItHJJ4j74VTixhmB5BJLOAnU4tXDJdN2HN+4tZ0L6+4jfEhRGeTj1hTsryEa0wGLuC22QIzQpeKxQrwSWfFFPRn6nHdOyBhkRxcMcEaU=

Algorithm 3:

Dynamic ADT

3.3. Scheme 3-extended EIP

In this solution, the previous two approaches are combined. In EIP, during image password encryption, the $\mathit{hKey}$ is used as encryption key which is generated from $\mathit{hashedPassword}$ . To achieve more level of security instead of $\mathit{hashedPassword}$ , a random number-based $\mathit{rKey}$ is used as encryption key similar to the D-ADT approach. So, it is required to preserve the value of $\mathit{rKey}$ also. Now, the ADT consists of three attributes i.e. $\mathit{UserId}\mathrm{,}\mathit{encryptedImagePassword}$ and $\mathit{encryptedrKey}$ . The advantage of this scheme is that the EIP changes during each login while keeping the plain password as it is. Table 4 demonstrates the update of ADT during logins of a particular user at different times. $\mathit{UserId}$ is user name, $\mathit{encryptedImagePassword}$ is the EIP obtained by executing algorithm $\mathit{imagePasswordEncrypt}$ where encryption key is $\mathit{rKey}$ . The $\mathit{imagePasswordEncrypt}$ requires two input parameters i.e. $\mathit{imagePassword}$ and $\mathit{rKey}$ . $\mathit{rKey}$ is encrypted using symmetric key cryptography (e.g.AES), and the key is calculated from $\mathit{hashedPassword}$ . Thus, encrypted $\mathit{rKey}$ is obtained. In the registration process, a record is appended in ADT for a new user using the above three attributes.

Algorithm 4 shows working of Extented EIP. Table 5 illustrates the instances of ADT at different times.

Table 4

Extended EIP-ADT update during login

Login	User Id	Password	rKey	EIP
First Time	NitTrichy	Tiruchirappalli	96a6263803174d8deed802b3d218d83e6ef4b3402c66 cc8e6842b0622774bc08
Second Time	NitTrichy	Tiruchirappalli	c5395cfaa14a4796da8561560261d1f59a9eae3cc952 c127f32aae167676499b
Third Time	NitTrichy	Tiruchirappalli	9148c0deedb6a2e2c92ce0a9070ac489c8909de22697 a14ad70135d417016f2d

Table 5

Extended EIP-ADT

User Id	encrypted rKey	EIP
	Instance 1
NitTrichy	7TtWqjsupUe5TXm5 J8V1QC5IKs/XkaL4GJySnKTIXgc8H6e3fxZnf6 cAJWQPXHUBdhptezExDa9rXnA/ifZVji/+yIl4YGebyC8H6NO61NY=
IITBombay	cV5IplzwsgpL2485ZMg2SUCbKFklO+vTWNEeXjRTwbvJ7E3Iv42CIGW +gzU3mTn33RntHYF91yh9FBB859ndRi23yKhwiPoUQ1rMzAbrNhI=
IITMadras	T5cpDAi1Z5K20ys3B6qp/ckWcvfh9+VYM41JlTsw8c+ZV84ydTMfjqNR/x fNQpdcePdFvZX2wCAIroDoY5Dz3BU4j8GcG62dYbFemRzhtmY=
	Instance 2
NitTrichy	8gMyueAARsm54vh8a7NzLGLGGOk5ALMMcqAIfAhz2U7PGkxUL1Z0L hWdL5XpsANAOFIN6PGU4B/49T8GV1SJkT1a93nkg+PV4sYQYimvfMQ=
IITBombay	5TO/henPt1Ce/eOojVR1dyCGaz/Vs8lEYeOPJKjBLagaLxIK90bO/ZMu ZxIeKRicY6gmH4DbqMjT+c1MfAtJSu+kTEmazkoOWAY82RpKUyQ=
IITMadras	U7a2I6L+kaXKp+R3xQ77/KMCzR9OXvv9UrRMVVejVP0CVf8SXleC KmHv7JgjerFCjK04hp8Zn/mULyLz5DM+aMFqHBMtBgPR3U2F6hDE1s8=
	Instance 3
NitTrichy	7TtWqjsupUe5TXm5 J8V1QC5IKs/XkaL4GJySnKTIXgc8H6e3fxZnf 6cAJWQPXHUBdhptezExDa9rXnA/ifZVji/+yIl4YGebyC8H6NO61NY=
IITBombay	cV5IplzwsgpL2485ZMg2SUCbKFklO+vTWNEeXjRTwbvJ7E3Iv42CIGW +gzU3mTn33RntHYF91yh9FBB859ndRi23yKhwiPoUQ1rMzAbrNhI=
IITMadras	A99dMF4a0cixtDMlg7MMFJpWpUSvz7yRGW9V8DdNrE2pu4AW66DC iNmWJ/AhB5ugPocUzpbY1rDmxmx7OhMLQKahw1GPexM9uQcc0ffUPq0=

Algorithm 4:

Extended EIP

3.4. Comparative analysis of proposed schemes

The proposed schemes are compared with key points as described in Table 6. From this table, it is observed that the EEIP is advantageous in high-security systems because of its enough key space and complex encryption logic. On the other hand, EIP is advantageous in applications where the login frequency is less. In the case of D-ADT, the key space is less, so it is not preferred for high-security systems. If frequent logins are required in a single day, then D-ADT is advantageous.

Table 6

Comparative analysis

Parameter	EIP	D-ADT	EEIP
ADT Attributes	UserID, EIP	UserID, Encrypted Password, Encrypted rKey	UserID, EIP, Encrypted rKey
Matching Speed	Faster than EEIP, Slower than D-ADT	Faster as compared to EIP and EEIP	Slower than EIP and D-ADT
Suitability	For less login applications	For frequent login applications	For frequent login applications
Applications	Income tax	Email	Banking
Limitations	1. Size of encrypted password is more	1. Key space is limited	1. Size of encrypted password is more
		2. Additional attribute need to be preserved	2. Additional attribute need to be preserved
Advantages	Less attributes in ADT	Dynamic ADT	Dynamic ADT

4. Performance and security analysis

The proposed system is implemented on Ubuntu 16.04 LTS OS using Python 3.6.3 in a PC having an Intel Core i5-4570, 3.20 GHz × 4, 16 GB RAM, and MySQL 5.5 as a back end.

Algorithms 1 and 2 show the time complexity of password-to-image conversion as $\mathit{O}\mathrm{(}{\mathit{w}}^2\mathrm{)}$ . For image password encryption, the time complexity is $\mathit{O}\mathrm{(}\mathit{mn}\mathrm{)}$ where m is the number of confusion phase rounds, and n is the number of diffusion phase rounds.

4.1. NIST (national institute of standards and technology) randomness test

The NIST [23] created a statistical test suite with 15 distinct sub-tests to assess the randomness of the binary sequence. For the randomness test, NIST employs the $\mathit{alpha}=0.01$ threshold level. For each binary sequence, the $\mathcal{P}$ -value is calculated separately for each sub-test. If the $\mathcal{P}$ -value obtained is $⩾\mathit{\alpha }$ , then the randomness sub-test is passed.

NIST gives two methods for interpreting test results [23]:

(i) Calculation of the pass rate $\mathrm{(}{\mathcal{P}}_{\mathit{r}}\mathrm{)}$ of passing sequences in the sub-test. $$\begin{array}{}\text{(5)}& \hfill \bar{\mathcal{P}}\pm 3\sqrt{{\displaystyle \frac{\bar{\mathcal{P}}\mathrm{(}1-\bar{\mathcal{P}}\mathrm{)}}{\hat{\mathit{m}}}}}& \end{array}$$ where $\bar{\mathcal{P}}=1-\mathit{\alpha }$ , If $\mathrm{(}{\mathcal{P}}_{\mathit{r}}\mathrm{)}$ comes down outside the appropriate proportion, then it shows that the test sequence is not sufficiently random.

(ii) To calculate the $\mathcal{P}$ -value distribution and to check $\mathcal{P}$ -values are within the range [0, 1] and to verify whether it is uniform or not.

Table 7

NIST randomness test

S. No	Test	$\mathcal{P}\text{-}\mathit{value}$	Outcome
1	Runs	0.489825	passed
2	Frequency	0.776582	passed
3	Block frequency ( $\hat{\mathcal{M}}=20\mathrm{,}000$ )	0.667610	passed
4	Longest runs of ones	0.101325	passed
5	Overlapping templates ( $\hat{\mathcal{M}}=9$ )	0.109511	passed
6	Non-overlapping templates ( $\hat{\mathcal{M}}=9$ )	0.801607	passed
7	Rank	0.531891	passed
8	Approximate entropy ( $\hat{\mathcal{M}}=10$ )	0.790215	passed
9	Serial ( $\hat{\mathcal{M}}=16$ )	0.465287	passed
10	Spectral DFT	0.706582	passed
11	Linear complexity ( $\hat{\mathcal{M}}=500$ )	0.898556	passed
12	Maurers universal	0.624482	passed
13	Cumulative sums	0.599451	passed
14	Random excursions	0.169565	passed
15	Random excursions variant	0.525478	passed

The range [0, 1] is partitioned into 10 equal sub-ranges and ${\mathcal{F}}_{\mathit{kq}}$ denotes the frequency of $\mathcal{P}$ -values falling within the ${\mathit{k}}^{\mathit{th}}$ sub-range. Let $\hat{\mathcal{M}}$ be the sample size and the $\mathcal{P}\text{-}\mathit{value}$ is calculated using, $$\begin{array}{}\text{(6)}& \hfill {\mathit{\chi }}^2={\displaystyle \sum }_{\mathit{kq}=1}^{10}{\displaystyle \frac{{\mathrm{(}{\mathcal{F}}_{\mathit{kq}}-\hat{\mathcal{M}}\mathrm{/}10\mathrm{)}}^2}{\hat{\mathcal{M}}\mathrm{/}10}}& \end{array}$$ and $$\begin{array}{}\text{(7)}& \hfill \mathcal{P}\text{-}{\mathit{value}}_{\mathit{u}}=\mathit{igamc}\mathrm{(}{\displaystyle \frac{9}{2}}\mathrm{,}{\displaystyle \frac{{\mathit{\chi }}^2}{2}}\mathrm{)}& \end{array}$$

If $\mathcal{P}$ -value ${}_{\mathit{u}}⩾0.0001$ , a sequence could be regarded as a uniform distribution.

For the experiment, the random number sequence of length $256\times 256$ is generated using (1). Table 7 shows the results obtained from the randomness test. As seen from Table 7, the proposed keystream generation passes all tests. So, it can be utilized for image encryption.

4.2. Correlation analysis

The correlation among connected pixels of the encrypted images is calculated through a random selection of 6000 samples of connected pixels from the encrypted $\mathit{imagePasswords}$ . If correlation along vertically, horizontally, and diagonally is around zero, then the level of security of the cryptosystem is considered as good. Table 8 shows the correlation values of the proposed methodology for input and corresponding cipher images.

Table 8

Correlation analysis

		Correlation of encryptedImagePassword
S. No.	Password	Horizontal	Vertical	Diagonal
1	Password123	0.004422	−0.017514	0.007780
2	Raj@123	0.005954	−0.025438	−0.038372
3	google@1999	−0.007635	0.005434	0.008452
4	s0ftwa6e	−0.003732	−0.045612	0.001231

4.3. Differential analysis

A number of Pixels Change Rate (NPCR) and Unified Average Changing Intensity (UACI) are the testing methods to check the sensitivity of a little modification in the plain image as given by (8) and (10). Assume, ${\mathit{PI}}_1$ is an input $\mathit{imagePassword}$ and ${\mathit{EP}}_1$ is the obtained $\mathit{encryptedImagePassword}$ . ${\mathit{PI}}_2$ is input $\mathit{imagePassword}$ with a little modification and ${\mathit{EP}}_2$ is the obtained $\mathit{encryptedImagePassword}$ . $$\begin{array}{}\text{(8)}& \hfill & \mathit{NPCR}={\displaystyle \frac{{\sum }_{\mathit{\alpha }\mathit{\beta }}\mathit{\psi }\mathrm{(}\mathit{\alpha }\mathrm{,}\mathit{\beta }\mathrm{)}}{\mathit{width}\times \mathit{height}}}\text{(9)}& \hfill & \mathit{\psi }\mathrm{(}\mathit{\alpha }\mathrm{,}\mathit{\beta }\mathrm{)}=\left\{\begin{array}{cc}0\hfill & \text{if }{\mathit{EP}}_1\mathrm{(}\mathit{\alpha }\mathrm{,}\mathit{\beta }\mathrm{)}={\mathit{EP}}_2\mathrm{(}\mathit{\alpha }\mathrm{,}\mathit{\beta }\mathrm{)}\hfill \\ 1\hfill & \text{if }{\mathit{EP}}_1\mathrm{(}\mathit{\alpha }\mathrm{,}\mathit{\beta }\mathrm{)}\ne {\mathit{EP}}_2\mathrm{(}\mathit{\alpha }\mathrm{,}\mathit{\beta }\mathrm{)}\hfill \end{array}\right.\text{(10)}& \hfill & \mathit{UACI}={\displaystyle \frac{1}{\mathit{width}\times \mathit{height}}}{\displaystyle \sum }_{\mathit{\alpha }=1}^{\mathit{width}}{\displaystyle \sum }_{\mathit{\beta }=1}^{\mathit{height}}{\displaystyle \frac{|{\mathit{EP}}_1\mathrm{(}\mathit{\alpha }\mathrm{,}\mathit{\beta }\mathrm{)}-{\mathit{EP}}_2\mathrm{(}\mathit{\alpha }\mathrm{,}\mathit{\beta }\mathrm{)}|}{255}}\end{array}$$ The obtained results are shown in Table 9. From the results, it is concluded that a random one-bit change in the input $\mathit{imagePassword}$ produces a major change in the encrypted $\mathit{imagePassword}$ .

Table 9

Differential analysis

Sr. No.	Password	NPCR	UACI
1	Password123	99.5437	33.3851
2	Raj2123	99.6112	33.0264
3	google@1999	99.2284	34.0142
4	s0ftwa6e	99.5921	33.5487

4.4. Analysis of information entropy

Information entropy measures randomness. For gray images, if the pixel spread is uniform, then the highest entropy is eight. Assume $\mathcal{J}$ is the number of gray levels and $\mathcal{P}\mathit{r}\mathrm{(}{\mathcal{J}}_{\mathit{i}}\mathrm{)}$ is the probability of ${\mathit{i}}^{\mathit{th}}$ gray level then entropy is calculated using (11). Table 10 shows the entropy of encrypted image passwords and it is noticed that the values are nearer to standard entropy value. $$\begin{array}{}\text{(11)}& \hfill \mathcal{E}={\displaystyle \sum }_{\mathit{i}}\mathcal{P}\mathit{r}\mathrm{(}{\mathcal{J}}_{\mathit{i}}\mathrm{)}{log}_2\mathrm{\left(}{\displaystyle \frac{1}{\mathcal{P}\mathit{r}\mathrm{(}{\mathcal{J}}_{\mathit{i}}\mathrm{)}}}\mathrm{\right)}& \end{array}$$

Table 10

Information entropy analysis

Sr. No.	Password	encryptedImagePassword Entropy
1	Password1232	7.9989
2	Raj123	7.9974
3	google@1999	7.9977
4	s0ftware	7.9981

4.5. Analysis of computation time

To analyze computational time, the notations used are described in Table 11. All the operations are executed on the same machine as specified at the beginning of this section. The comparison of computation time analysis of the proposed system (D-ADT) and other systems is shown in Table 12. From the comparison, it is noticed that the proposed D-ADT is almost faster than other systems. The major highlight of the scheme is the passwords are updated during each login without changing the original password. Ultimately, the level of security is very high.

Table 11

Notations

S. No.	Notation	Operation	Approximate time to compute(Sec)
1	${\mathit{T}}_{\mathit{CHash}}$	Cryptographic Hash	2.384185791015625e-06
2	${\mathit{T}}_{\mathit{PED}}$	Paillier Encryption-Decryption	0.08961009979248047
3	${\mathit{T}}_{\mathit{SED}}$	Symmetric Encryption-Decryption	0.0007462501525878906
4	${\mathit{T}}_{\mathit{hKey}}$	hKey generation	3.457069396972656e-05
5	${\mathit{T}}_{\mathit{rKey}}$	rKey generation	2.2411346435546875e-05
6	${\mathit{T}}_{\mathit{NegPass}}$	Negative Password	2.2411346435546875e-05
7	${\mathit{T}}_{\mathit{PKED}}$	Public key encryption/decryption	0.00399077665
8	${\mathit{T}}_{\mathit{ME}}$	Modular exponetiation	0.00408687945829821
9	${\mathit{T}}_{\mathit{PA}}$	Point addition	2.9853078e-05
10	${\mathit{T}}_{\mathit{HMAC}}$	HMAC	4.7682e-06
11	${\mathit{T}}_{\mathit{BP}}$	Bilinear Pairing	0.006023480472375280
12	${\mathit{T}}_{\mathit{PM}}$	Point Multiplication	0.0023077391302367215

Table 12

Analysis of computation time during authentication

S. No.	Scheme	Computation Time(Sec)	Cryptographic primitive	ADT	Multifactor
1	Ref. [17]	${\mathit{T}}_{\mathit{CHash}}+{\mathit{T}}_{\mathit{NP}}+{\mathit{T}}_{\mathit{ENP}}\approx 0.01743054389953613$	Cryptographic Hash, Negative Password	Static	No
2	Ref. [9]	$2{\mathit{T}}_{\mathit{CHash}}+2{\mathit{T}}_{\mathit{PED}}\approx 0.17922496795654297$	Paillier Cryptosystem	Static	No
3	Ref. [13]	$4{\mathit{T}}_{\mathit{SED}}+8{\mathit{T}}_{\mathit{PM}}+19{\mathit{T}}_{\mathit{CHash}}\approx 0.0214922$	Symmtric Encryption	Static	No
4	Ref. [1]	$4{\mathit{T}}_{\mathit{ME}}+4{\mathit{T}}_{\mathit{PKED}}+2{\mathit{T}}_{\mathit{CHash}}\approx 0.039309763$	Public Key Encryption	Static	No
5	Ref. [30]	$10{\mathit{T}}_{\mathit{PM}}+2{\mathit{T}}_{\mathit{SED}}+5{\mathit{T}}_{\mathit{CHash}}\approx 0.0245818125$	Symmetric Encryption	Static	No
6	Ref. [25]	$4{\mathit{T}}_{\mathit{ME}}+4{\mathit{T}}_{\mathit{PKED}}+2{\mathit{T}}_{\mathit{HMAC}}\approx 0.0320172763$	Public Key Encryption	Static	No
7	Ref. [19]	$6{\mathit{T}}_{\mathit{ME}}+4{\mathit{T}}_{\mathit{SED}}+2{\mathit{T}}_{\mathit{HMAC}}+2{\mathit{T}}_{\mathit{CHash}}\approx 0.02707341$	Symmetric Encryption	Static	No
8	Ref. [18]	$10{\mathit{T}}_{\mathit{PM}}+4{\mathit{T}}_{\mathit{PA}}+2{\mathit{T}}_{\mathit{HMAC}}+8{\mathit{T}}_{\mathit{CHash}}\approx 0.0245818125$	Elliptic Curve Point arithmetic	Static	No
9	Proposed system	$2{\mathit{T}}_{\mathit{CHash}}+1{\mathit{T}}_{\mathit{hKey}}+1{\mathit{T}}_{\mathit{rKey}}+4{\mathit{T}}_{\mathit{SED}}\approx 0.0030579566955566406$	Symmetric Encryption	Dynamic	No

4.6. The privacy of ADT

ADT contains user credentials. Suppose, the hacker has pre-obtained the ADT. To reveal the hashed/ciphered passwords, the off-line attacks which could be made available are given below:

• Bruteforce attack

  Here, the attacker has to check all possible combinations of symbols to reveal the password. But, to make such an attack is very hard.

• Dictionary attack

  The attacker creates a dictionary consisting of familiar words or words of daily routine. Next, the matching of words from the dictionary to ADT is done.

• Advanced Dictionary attack

  In this attack, an attacker has to create a dictionary containing words that are predicted by the users’ nature of designing passwords.

• Lookup table attack

  In this attack, initially, an attacker prepares a list of passwords. The list normally consists of regularly used passwords. Next, he constructs the lookup table containing tuples of hashed passwords and its password in the plain form of the prepared list. An attacker applies a search operation between the lookup table and ADT entries.

• Rainbow table attack

  Rainbow tables consist of hash chains. Through alterations of the hash and reduction function, a series of alternating passwords and hash values are produced. Only the initial and the endmost plain value produced is entered in the rainbow table.

The common thing in the above off-line attacks is that the hacker has to compare the hash value of the password from ADT with the precomputed hash value of the password except for brute-force attacks. To illustrate how these attacks are executed, consider the attacker has prepared a table as in Table 13 containing the password and corresponding pre-computed password digest. The password digest may be obtained by applying cryptographic hashing techniques such that MD5, SHA256, Whirlpool, etc. The attacker simply searches the table for the target cipher password. If the target cipher password is matched with the password digest in the prepared table, then the password is cracked. The attacker may perform a binary search to find the password digest from the look-up table. However, in proposed schemes, such attacks are very hard because the ADT contains encrypted passwords. For the attacker, the proposed schemes are very hard to obtain encrypted password as depicted in Fig. 5. The attacker has to obtain a corresponding encrypted password. The used encryption logic and key generation logic in proposed schemes are secure enough to protect against these attacks.

Fig. 5.

Illustration of attacks.

Table 13

Sample password digest table

Password	Password digest
Password123	008C70392E3ABFBD0FA47BBC2ED96AA99BD49
Raj@123	23F6A0937AB55F3517A9ECA1A73BA5A2A252037
google@1999	F9C85E55E95308284A34FE17F20CEE46CD02652
s0ftwa6e	380B42CCEE50C91C969331FC2AA4064D08A7A11

4.7. Key space analysis

In the proposed EIP and EEIP schemes, Arnold’s cat map and the logistic map take a total of six control values $\mathrm{(}\mathit{\mu }\mathrm{,}{\mathit{t}}_{\mathit{n}}\mathrm{,}{\mathit{x}}_0\mathrm{,}{\mathit{y}}_0\mathrm{,}\mathit{a}\mathrm{,}\mathit{b}\mathrm{)}$ . The control values depend on $\mathit{hKey}$ or $\mathit{rKey}$ . The $\mathit{imagePasswordEncrypt}$ takes m rounds for confusion and n rounds for diffusion. So a total of nine parameters are used for password encryption. As IEEE’s floating-point standard, the 64-bit double precision number’s computational precision is nearby ${10}^{-15}$ . Ultimately, the key space of the proposed encryption is ${\mathrm{(}{10}^{15}\mathrm{)}}^9={10}^{135}$ . This key space is enough to withstand the above-mentioned attacks.

4.8. Analysis and comparison of attack complexity

In this section, the time complexities concerning lookup table attack and dictionary attack of the proposed schemes are discussed and compared with the Encrypted Negative Password approach (ENP1, ENP2) [17] and shown in Table 14. Here, the complexity generated by key space is ignored for simplicity. The comparison shows that the proposed schemes are very hard to perform lookup table attacks and dictionary attacks.

4.8.1. Notations

• ${\mathit{N}}_{\mathit{tp}}$ Total number of passwords in the password list

• ${\mathit{N}}_{\mathit{cp}}$ Number of passwords to be cracked

• w Length of the hashed password

• ${\mathit{T}}_{\mathit{hash}}$ Time taken to get hashedPassword from plain password

• ${\mathit{T}}_{\mathit{SI}}$ Time taken to construct Shuffling Index

• ${\mathit{T}}_{\mathit{EncHashedPass}}$ Time taken to encrypt hashedPassword

• ${\mathit{T}}_{\mathit{Match}}$ Time taken to match encrypted image passwords $\mathit{O}\mathrm{(}{\mathit{w}}^2\mathrm{)}$

• ${\mathit{T}}_{\mathit{matchNP}}$ : Time taken to determine whether a hashed password matches a negative password

Table 14

Comparison of time complexity with attacks

Scheme	Lookup table attack	Dictionary attack
ENP1	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast \mathit{w}!\ast {\mathit{T}}_{\mathit{matchNP}}\mathrm{)}$	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast \mathit{N}\mathit{cp}\ast \mathrm{(}{\mathit{T}}_{\mathit{hash}}+{\mathit{T}}_{\mathit{d}}+{\mathit{T}}_{\mathit{matchNP}}\mathrm{)}$
ENP2	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast \frac{{[\mathrm{(}\mathit{w}-2\mathrm{)}\mathit{w}!]}^3}{2^{\mathrm{(}\mathit{w}-2\mathrm{)}{\mathit{w}}^2}}\ast {\mathit{N}}_{\mathit{cp}}\ast {\mathit{T}}_{\mathit{matchNP}}\mathrm{)}$	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast \mathit{N}\mathit{cp}\ast \mathrm{(}{\mathit{T}}_{\mathit{hash}}+{\mathit{T}}_{\mathit{d}}+{\mathit{T}}_{\mathit{matchNP}}\mathrm{)}$
EIP	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast \mathrm{(}\mathit{w}!\ast \mathrm{(}{\mathit{w}}^2!\mathrm{)}\ast \mathit{mn}+{\mathit{T}}_{\mathit{match}}\mathrm{)}\mathrm{)}$	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast {\mathit{N}}_{\mathit{cp}}\ast \mathrm{(}{\mathit{T}}_{\mathit{hash}}+{\mathit{T}}_{\mathit{SI}}+{\mathit{w}}^2+\mathit{w}+\mathit{mn}+{\mathit{w}}^2\mathrm{)}\mathrm{)}$
EEIP	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{pc}}\mathrm{(}{2}^{\mathit{w}}\mathrm{(}\mathit{w}!\ast \mathrm{(}{\mathit{w}}^2!\mathrm{)}\ast \mathit{mn}\mathrm{)}+{\mathit{T}}_{\mathit{match}}\mathrm{)}\mathrm{)}$	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast {\mathit{N}}_{\mathit{cp}}\ast \mathrm{(}{\mathit{T}}_{\mathit{hash}}+{\mathit{T}}_{\mathit{SI}}+{\mathit{w}}^2+\mathit{w}+\mathit{mn}+{\mathit{w}}^2\mathrm{)}\mathrm{)}$
D-ADT	$\mathit{O}\mathrm{(}\mathit{w}!\ast {\mathit{T}}_{\mathit{hash}}\ast 2^{\mathit{w}}\mathrm{)}$	$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast {\mathit{N}}_{\mathit{cp}}\ast \mathrm{(}{\mathit{T}}_{\mathit{hash}}+\mathit{O}\mathrm{(}1\mathrm{)}+{\mathit{T}}_{\mathit{EncHashedPass}}+\mathit{O}\mathrm{(}\mathit{w}\mathrm{)}$

4.8.2. Look table attack analysis

In the proposed system, if an attacker wants to crack EIPs using a lookup table attack, the attacker must first compute all possible EIPs for each password from the list. To find EIP for a single password from the list, the following steps are taken by the attacker. First, to find shuffled passwords totally $\mathit{w}!$ shuffled passwords are possible. The next step is to find a binary image of size $\mathit{w}\times \mathit{w}$ . For a single shuffled password, totally $\mathrm{(}\mathit{w}\times \mathit{w}\mathrm{)}!$ binary images are possible. Till now, the complexity is $\mathit{O}\mathrm{(}\mathit{w}!\mathrm{(}{\mathit{w}}^2!\mathrm{)}\mathrm{)}$ . Further, the challenge is to find the corresponding encrypted image. The image encryption is done by applying confusion(m rounds) and diffusion(n rounds) of bits/pixels based on chaotic functions, and the complexity is $\mathit{O}\mathrm{(}\mathit{mn}\mathrm{)}$ , and finally, a comparison of encrypted images is made. From the above procedure, it is concluded that the time complexity of cracking passwords for EIP is $\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{pc}}\mathrm{(}\mathit{w}!\ast \mathrm{(}{\mathit{w}}^2!\mathrm{)}\ast \mathit{mn}+{\mathit{T}}_{\mathit{match}}\mathrm{)}\mathrm{)}$ . Additionally, for Extended EIP (EEIP), if $\mathit{rKey}$ is of the length w then total $2^{\mathit{w}}\mathit{rKeys}$ are possible. So, the time complexity of EEIP for cracking passwords is given by- $\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{pc}}\mathrm{(}{2}^{\mathit{w}}\mathrm{(}\mathit{w}!\ast \mathrm{(}{\mathit{w}}^2!\mathrm{)}\ast \mathit{mn}\mathrm{)}+{\mathit{T}}_{\mathit{match}}\mathrm{)}\mathrm{)}$ . In the case of D-ADT, first, find all shuffled passwords, then obtain the hash of shuffled passwords i.e. $\mathit{w}!\ast {\mathit{T}}_{\mathit{hash}}$ . Next, find the encryption key, which is generated by applying the $\mathit{w}-\mathit{bit}$ cryptographic hash function on the random number. So totally $2^{\mathit{w}}$ keys are possible. Finally the time complexity is $\mathit{O}\mathrm{(}\mathit{w}!\ast {\mathit{T}}_{\mathit{hash}}\ast 2^{\mathit{w}}\mathrm{)}$ .

4.8.3. Dictionary table attack analysis

To verify the password from the password list in the case of EIP and EEIP, the following steps are done:

Obtaining $\mathit{hashedPassword}$ of size w from plain password ( ${\mathit{T}}_{\mathit{hash}}$ )

Obtaining Shuffling Index ( ${\mathit{T}}_{\mathit{SI}}$ )

Obtaining $\mathit{w}\times \mathit{w}$ binary image ( $\mathit{O}\mathrm{(}{\mathit{w}}^2\mathrm{)}$ )

Embedding hashedPassword into binary image to get $\mathit{imagePassword}$ ( $\mathit{O}\mathrm{(}\mathit{w}\mathrm{)}$ )

Encrypt $\mathit{imagePassword}$ as EIP1 ( $\mathit{O}\mathrm{(}\mathit{mn}\mathrm{)}$ )

Match EIP1 with EIP2. EIP2 is taken from ADT. If EIP1 and EIP2 are matched then solution found ( $\mathit{O}\mathrm{(}{\mathit{w}}^2\mathrm{)}$ )

Hence, the complexity to crack passwords is given by

$\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast {\mathit{N}}_{\mathit{cp}}\ast \mathrm{(}{\mathit{T}}_{\mathit{hash}}+{\mathit{T}}_{\mathit{SI}}+\mathit{O}\mathrm{(}{\mathit{w}}^2\mathrm{)}+\mathit{O}\mathrm{(}\mathit{w}\mathrm{)}+\mathit{O}\mathrm{(}\mathit{mn}\mathrm{)}+\mathit{O}\mathrm{(}{\mathit{w}}^2\mathrm{)}$ .

In the case of D-ADT, the following steps are taken

Obtaining $\mathit{hashedPassword}$ of size w from plain password ( ${\mathit{T}}_{\mathit{hash}}$ )

Obtaining rKey( $\mathit{O}\mathrm{(}1\mathrm{)}$ )

Encrypt $\mathit{hashedPassword}$ as EHP1 ( ${\mathit{T}}_{\mathit{EncHashedPass}}$ )

Match EHP1 with EHP2. EHP2 is taken from ADT. If EHP1 and EHP2 are matched then solution found ( $\mathit{O}\mathrm{(}\mathit{w}\mathrm{)}$ )

Hence, the complexity to crack passwords is given by $$\begin{array}{c}\mathit{O}\mathrm{(}{\mathit{N}}_{\mathit{tp}}\ast {\mathit{N}}_{\mathit{cp}}\ast \mathrm{(}{\mathit{T}}_{\mathit{hash}}+\mathit{O}\mathrm{(}1\mathrm{)}+{\mathit{T}}_{\mathit{EncHashedPass}}+\mathit{O}\mathrm{(}\mathit{w}\mathrm{)}.\end{array}$$

4.9. Analysis of known/chosen plain text attack

In the chaotic cryptosystem, an attacker is mainly interested in getting the intermediate results [21]. The required intermediate results to be computed from the proposed cryptosystem can be found by dividing the $\mathit{imagePasswordEncrypt}$ into four segments. If $\mathit{imagePassword}$ is the input image and Arnold cat map (1) produced keystreams are $\mathit{xkeyStream}\mathrm{,}\mathit{yKeyStream}$ then first segment of confusion function is represented as $$\begin{array}{}\text{(12)}& \hfill \mathit{cImg}=\mathit{confusion}\mathrm{(}{\mathit{keyImg}}_1\mathrm{,}\mathit{imagePassword}\mathrm{)}& \end{array}$$ where ${\mathit{keyImg}}_1$ is obtained from $\mathit{xkeyStream}$ , $\mathit{yKeyStream}$ . For the second segment,during diffusion, the $\mathit{cImg}$ and ${\mathit{keyImg}}_2$ are XORed. ${\mathit{keyImg}}_2$ is generated from Logistic map (2). Diffusion is represented as follows: $$\begin{array}{}\text{(13)}& \hfill \mathit{dImg}=\mathit{cImg}\oplus {\mathit{keyImg}}_2& \end{array}$$ In the third segment, $\mathit{dImg}$ is again diffused for n times as follows: $$\begin{array}{}\text{(14)}& \hfill {\mathit{dImg}}^{\prime }={\mathrm{(}\mathit{dImg}\oplus {\mathit{keyImg}}_2\mathrm{)}}^{\mathit{n}}& \end{array}$$ In the last segment, ${\mathit{dImg}}^{\prime }$ is again confused for m times as- $$\begin{array}{}\text{(15)}& \hfill {\mathit{cImg}}^{\prime }=\mathit{confusion}\mathrm{(}{\mathit{keyImg}}_1\mathrm{,}{\mathit{dImg}}^{\prime }\mathrm{)}& \end{array}$$ Finally, to get a cipher image $$\begin{array}{}\text{(16)}& \hfill & \mathit{EIP}=\mathit{confusion}{\mathrm{(}{\mathit{keyImg}}_1\mathrm{,}{\mathit{V}}^{\mathit{n}}\mathrm{)}}^{\mathit{m}}\text{(17)}& \hfill & \mathit{V}=\mathrm{(}\mathit{dImg}\oplus {\mathit{keyImg}}_2\mathrm{)}\end{array}$$ The keystreams ${\mathit{keyImg}}_1$ and ${\mathit{keyImg}}_2$ are created by executing Arnold’s cat map (1) and logistic map (2) respectively. Arnold’s cat map takes 4 control arguments in key i.e. { ${\mathit{x}}_0\mathrm{,}{\mathit{y}}_0\mathrm{,}\mathit{a}\mathrm{,}\mathit{b}$ } whereas the Logistic map takes two control arguments { $\mathit{\mu }\mathrm{,}{\mathit{t}}_0$ }. These parameters depend on $\mathit{hKey}$ or $\mathit{rKey}$ (in the case of EEIP) value. $\mathit{hKey}$ value is generated from $\mathit{hashedPassword}$ and $\mathit{rKey}$ value is generated by taking SHA256 of random number generated using RANDOM() function. Therefore, it is very challenging for an attacker to get ${\mathit{keyImg}}_1$ and ${\mathit{keyImg}}_2$ values without getting the value of $\mathit{hKey}$ or $\mathit{rKey}$ .

4.10. Comparative analysis

Table 15 shows the comparative analysis of ENP and EEIP concerning standard parameters. From the comparison table, it is observed that EEIP is more advantageous as compared to ENP. The highlighted key point in EEIP is dynamic ADT. Because of this, it can be useful in highly secure applications like the military, finance, etc.

Table 15

Comparative analysis

Parameter	ENP	EEIP
Logic	Complex	Simple
Attack Complexity	Less	More
Key Space	Less	More
ADT	Static	Dynamic
Computation	Not in encrypted domain	In Encrypted domain
Methodology	Negative Database	Image Encryption

5. Conclusion

In this paper, three protection schemes are proposed for secure authentication. In scheme-1 EIP, the plain password is converted to an encrypted image password. In scheme-2 D-ADT, the plain password is hashed and encrypted using the different random keys at every login. So, ADT contains a new encrypted password for an original plain password during each login of a particular user. By taking advantage of this beautiful logic, scheme-3 EEIP is proposed that combines described two schemes so that ADT contains a new EIP for each login. For the encryption of image passwords, novel image encryption is designed and implemented. The encryption keys depend on the input plain password. In the end, the analysis and comparison of ENPI, ENPII, and proposed schemes (EIP, D-ADT, EEIP) are made. Additionally, the key-space analysis and chosen/plain text analysis are also performed. The performance shows that EIP is sufficiently secure to protect against attacks like brute force, lookup table, dictionary, and rainbow table. The advantage of the proposed schemes is that there is no need for the decryption of encrypted image passwords during authentication.