- 學位論文
通訊協定的安全性分析之研究
A research on security analysis of communication protocols
摘要
由於網際網路技術的快速發展，越來越多的使用者藉由網際網路交換資訊、進行多媒體會議、參與線上遊戲、使用醫療服務或是進行商業行為。然而網際網路是個公開但不安全的通訊頻道。當通訊內容因為某些特定的安全議題而敏感時，被傳輸的資料便需被加密以防止洩漏。 資訊安全的目的是為了要防止資訊受到威脅，必須具備一些特性，其中完整性和身份認證是很重要的，常見的使用者鑑別技術有通行密碼驗證和智慧卡的使用。Guo和Chang學者在2012年提出了一個以混沌映射為基礎並利用智慧卡的通行密碼驗證方法，他們宣稱他們的方法非常適合智慧卡，並且具有較高的安全性。 另一方面，由於電子商務的需求、醫療服務或是財務應用程式，群組金鑰協議逐漸被重視。Zhao等人提出了一個以RSA加密系統為基礎的群體金鑰協議方法，並且宣稱他們所提出的方法是比較有效率、具有容錯的特性且可以抵禦共同模數的攻擊。 然而，在研讀他們的論文以後，發現他們的方法是不安全或無法正常運作。在本篇研究中，將回顧Guo和Chang學者的通行密碼驗證方法與Zhao等人的群體金鑰協議方法，以例子明確地指出他們的方法為何不安全或無法正常的運作，並提出一些建議。
並列摘要
With the rapid development of network technologies, more and more people use the Internet for the exchange of information, multimedia conferencing, online gaming, medical services and commercial behavior and so on. However, the Internet is a public but insecure channel. If the communication content is sensitive for some security issues, the transmitted data needs to be encrypted to prevent leakage. Information security prevents systems and users from being threatened by potential or existing security threats, where integrity and authentication are important. Password authentication and using smart cards are common approaches in user authentication. In 2012, Guo and Chang proposed a chaotic maps-based password-authenticated key agreement scheme using smart cards. They claimed that their scheme was suitable for smart cards and provided a higher level of security. On the other hand, because of further e-commerce demands, medical services, or financial applications, group key agreement becomes a hot research topic. Zhao et al. proposed a group key agreement protocol based on the RSA cryptosystem. They claimed that their proposed scheme was efficient, fault-tolerant and able to defend against common modulus attacks. However, after thorough review, we find that their schemes are insecure or cannot work. In this thesis, we first review Guo and Chang’s scheme and Zhao et al.’s scheme. Then examples are given to show why their schemes are insecure or cannot work, and some suggestions are provided.