HMAC SHA 256- PROPOSED AUTHENTICATION ALGORITHM-PRINCE DUAH MENSAH-MPhil IT (2).pdf

PRINCE DUAH MENSAH-MPHIL. I. T 1
AKENTEN APPIAH- MENKA UNIVERISTY OF SKILL TRAINING
AND ENTREPRENEURIAL DEVELOPMENT
HASH- BASED MESSAGE AUTHENTICATION CODE AND
SECURE HASH FUNCTION 256
(A PROPOSED NOVEL AUTHENTICATION CODE)
BY
PRINCE DUAH MENSAH
(8221520010)
MIT 821 INFORMATION SECURITY

TABLE OF CONTENTS
Abstract 3
1 Introduction 4
1.2 Purpose of the article 5
2 Literature Survey 6
2.1 Wide Area Networks 6
2.2 Message Authentication 6
2.3 Message Authentication Code 6
2.4 HMAC SHA 256 Algorithm 7
3 Methodology 8
3.1 Sources of Data Collection 8
3.2 HMAC SHA 256 Design Architecture 9
3.4 Research Instruments 10
4 Results and Discussion 12
4.1 Application of HMAC SHA 256 12
4.2 Collision Resistance of HMAC SHA 256 14
4.3 Time Complexity of HMAC SHA 256 16
5 Summary, Conclusion and Recommendation 20
5.1 Summary of Major Findings 20
5.2 Recommendation 21
5.3 Conclusion 21
6 Reference 22

ABSTRACT
Conventional authentication methods, like simple text- based passwords, have shown
vulnerabilities to different types of security attacks. Most of all the breaches involve
credentials, whether stolen via social engineering or hacked using brute force. Therefore,
a robust user authentication mechanism is crucial to have secure systems. Combining the
use of a hash function, SHA 256 and a secret key. HMAC approach can be effective
strategy for data origin authentication and integrity verification mechanisms. This article
proposes a Hash- based Message Authentication Code and Secure Hash Algorithm 256,
with the acronym HMAC SHA 256 to solve the deficiencies in Message Digest Method 5
including the traditional username- password authentication. HMAC SHA 256 can be
applied to verification of email, authenticate data form, Internet of Things (IoT) and reset
password. The novelty of the proposed mechanism lies in a Trust Based System which
identifies the malicious nodes in the network and differentiates them from trusted nodes.
The trust value of the participating nodes is increased only for every successful
transmission and decreased for those nodes that do not send the data towards the desired
destination. Using Java programming language, HTML, CSS and Python, the proposed
authentication protocol was analysed to determine its efficiency and effectiveness. The
study found that HMAC SHA 256 is ideal for higher performance systems and provides
higher security as compared to MD 5. The study also revealed that HMAC SHA 265 has a
strong collision resistance to attacks and its therefore recommended for encryption and
solving the deficiencies in MD 5.

CHAPTER ONE
INTRODUCTION
Today, information is fundamental for basic operations in every home, institution,
organization and the society at large. Information involves computers, networks and
communication media which are used to transmit the data from one point to another. The
power of attacks to guess or harvest passwords to gain illicit access to a system or data are
becoming greater as the sophistication of password cracking techniques increases and high-
power computing becomes more affordable. Routing in a distributed network has become
a big challenge to network security and there has been various studies and many researches
in this field attempting to propose more secure approach to it. Hence, there is an important
need to have more robust and secure access mechanisms to protect data and systems.
The most popular, yet the most basic, mechanism for user authentication is the use of
Message Digest Method 5, mainly because the concept of using passwords is an efficient
and cost effective solution for traditional user authentication. Nevertheless, this is the
weakest level of authentication and it has been realized that Message Digest Method 5 is
not reliable to provide adequate protection, due to several security threats. Verifying the
integrity and authenticity of information is a prime necessity in computer networks as
sensitive information are resident on computers and their networks.
Hash- based Message Authentication Code and Secure Hash Algorithm 256 (HMAC SHA
256) was proposed to provide higher levels of safety and to add strong protection against
account theft by greatly increasing the difficulty for attackers to gain access to information
systems and data. MFA mechanisms are mostly based on a hash function, SHA 256 and a
secret key HMAC. This article therefore proposes HMAC SHA 256 with a designed Trust Based
System to make authentication mechanism more robust and secure and resolve the deficiencies in
MD 5.

1.2 Purpose of the Article
The main purpose of this article is to propose HMAC SHA 256 to make authentication
mechanism more robust and secure and resolve the deficiencies in MD 5. The article
specifically looks at:
i. Application of the HMAC SHA 256
ii. Attack or collision resistance of HMAC SHA 256 compared with MD 5
iii. The performance and time complexity of the HMAC SHA 256

CHAPTER TWO
LITERATURE SURVEY
The literature survey entails the systematic identification and analysis of documents
containing information related to the article. The literature survey section encompasses
wide area networks, message authentication, message authentication code and HMAC
SHA 256 Algorithm and its advantages and disadvantages.
2.1 Wide Area Networks
A WAN is a data communications network that operates beyond the geographic scope of
a Local Area Network. Wide Area Network use facilities provided by a service provider or
carrier such as a telephone or cable company, to connect the locations of an organization
to each other including to external services and remote users. Generally, Wide Area
Networks carry a variety of traffic types such as voice, data and video.
2.2 Message Authentication
Message Authentication is data authentication that shows that a message has not been
modified while in transit and that the receiving party can verify the source of the message.
Message authentication does not necessarily include the property of non- repudiation. It is
typically achieved by using message authentication codes (MACs), authenticated
encryption or digital signatures.
2.3 Message Authentication Code
Message Authentication Code (MAC) is a string of code or a symmetric key cryptographic
technique used to authenticate the origin and nature of a message. MACs use authentication
cryptography to verify the legitimacy of data sent through a network or transferred from
one person to another. Some of the Message Authentication Codes includes one- time
message authentication code, carter- wegman message authentication code and hash- based
authentication code.

2.4 HMAC SHA 256 ALGORITHM
As encryption ensures only the confidentiality of the data being sent, a digital signature
which is another security technique ensures other security goals like data authentication,
non-repudiation and data integrity (Dilli & Chandra, 2014). HMACSHA256 is a type of
keyed hash algorithm that is constructed from the SHA-256 hash function and used as a
Hash-based Message Authentication Code (HMAC)
Hashing can be used in place of the digital process in long data or messages. In this, the
data or message is passed through an algorithm called cryptographic hash function or one
way-hash function (SHA256) before signing. Hashing creates a compressed image of the
data in the form of a hash value or message digest which is usually unique and much
smaller than the message. Any change made to the message produces a different hash result
even if the same hash function is used.
Definition of HMAC-SHA256
HMAC-SHA256 defined as:
𝐻𝑀𝐴𝐶 (𝐾,𝑚) =𝐻((𝐾 ⊕ 𝑜𝑝𝑎𝑑) ║ 𝐻((𝐾 ⊕ 𝑖𝑝𝑎𝑑) ║ 𝑚))
which uses the following parameters:
H = cryptographic hash function = SHA256
K = secret key
m = message
║ = concatenation
⊕ = exclusive OR
opad = outer padding
ipad = inner padding

2.4.1 Advantages of HMAC SHA 256 Algorithm
i. HMAC SHA 256 provides a high level of security due to its strength
ii. It is practically impossible to reverse- engineer the original message from its hash
value
iii. It is resistant to various cryptographic attacks including collision and pre- image
attacks.
2.4.2 Disadvantages of HMAC SHA 256 Algorithm
i. HMACs uses shared key which may lead to non-repudiation. If either sender or
receiver’s key is compromised then it will be easy for attackers to create
unauthorized messages.

CHAPTER THREE
METHODOLOGY
This section of the article discusses the various methods that makes the Hash Message
Authentication Code and Secure Hash Algorithm 256 an efficient choice over the other
algorithms, including the sources of data collection, HMAC SHA 256 Design Architecture
and research instruments.
3.1 Sources of Data Collection
Information for this report was sourced from various secondary sources, all listed in the
reference list. Data from publications by the 2013 International Conference on Electronic
Engineering and Computer Science also proved valuable. This report is not a
comprehensive analysis of the available literature but provides a broad overview of the
algorithm.
3.2 HMAC SHA 256 Design Architecture
HMAC utilizes two hash functions and its output is the same as that of the underlying hash
function, (i.e. 256 bits concerning SHA-256). The HMAC architecture once powers up has
to be initialized through activation of the input signal init. The initialization procedure
corresponds to computing the hash values of two certain 512-bit blocks, which are the
corresponding keys, and it is performed independently in the two SHA-256 cores at the
same time. The 512-bit Xorskey component contains simple XOR gates to compute the
values “k0 xor ipad” and “k0 xor ipad”, which are needed in HMAC’s initialization. This
initialization process is completed after 33 clock cycles.
When the above initialization finishes, the hash values from the outputs of the two SHA-
256 cores are stored and then are used as the new initial values (H1 – H1) by the two SHA-
256 cores. Since these two values and the corresponding keys must be protected and treated
as secret, they are stored in registers. This is the first time that a 512-bit message block may

be supplied for process to the HMAC core and the sendmes handshake signal is activated
indicating that the system can accept a new message so as to compute its HMAC value.
Figure 3.1: HMAC-SHA-256 Architecture
3.3 Research Instruments
Research instruments are tools used for data collection and analysis of the study. The
following tools were used in analyzing HMAC-SHA-256 Algorithm: Java and Python
Programming Languages, OpenSSL version 1.1.1 and Trust Based System.
3.3.1 Trusted Based System
The Trust Based System identifies malicious nodes in the network and differentiates them
from the trusted nodes by providing a trust value to the participating nodes. For every
successful data transmission, the trust value increases but decreases for nodes that do not
send data to their destination or whose data has been altered or tampered with. This system
in addition to the HMAC-SHA256 algorithm provides additional security to transmitted
data. The trust based system gives a trust value of every node on the network. The trust

value of a node or nodes increase if there is no attack on the sent data, this means the nodes
are not malicious but decreases if malicious nodes exist.
3.3.2 Python
Python is the most efficient cross- platform tool, specifically programming language used
for artificial intelligence and machine learning solutions.
3.3.3 OpenSSL
OpenSSL is an all-around cryptography library tool that offers an open-source application
of the TLS protocol. It allows users to perform various SSL-related tasks, including CSR
(Certificate Signing Request) and private keys generation, and SSL certificate installation.
3.3.4 Java
Java is a multi-platform, object-oriented, and network-centric language that can be used as
a platform in itself. It is a fast, secure, reliable programming language for coding everything
from mobile apps and enterprise software to big data applications and server-side
technologies.

CHAPTER FOUR
EXPERIMENTAL RESULTS AND DISCUSSION
This section of the article presents the findings of the study whose main purpose is to
propose a novel authentication protocol to resolve the deficiencies in the Message Digest
Method 5 Algorithm. The presentation of findings aligns with the objectives of the article
of the proposed novel HMAC SHA 256 Algorithm.
Analyzing Algorithm means to study the specification of the Algorithm and come to a
conclusion about how the implementation of that algorithm will perform in general. Here,
the amount of resources necessary to execute the algorithm is determined and its equivalent
running time (time complexity) or efficiency of the algorithm.
4.1 Application of the HMAC SHA 256
Figure 4.1 HMAC SHA 256 Computation Flow
The above figure 4.1 indicates the HMAC SHA 256 Computation Flow. In Chapter 3, the
figure 3.1 indicates the architecture of the proposed novel HMAC SHA 256 Algorithm,
and this subsection is to analyse how it works. From figure 4.1 Once a message is sent to
the HMAC architecture, the handshake signals new_mes is activated (for one clock cycle)
indicating the arrival of a new input message with input rate of 64 (or more) bits per clock

cycle depending on the employed bus width. At the same time sendmes signal is
deactivated (and stays deactivated) and the system starts formulating the 512-bit input
message block which is over after 8 (or less) clock cycles (depending on the selected bus
width). During these cycles, (and while another message may be in process on any stage
of the two SHA-256 hashing cores) the first 128 bits of the 512-bit input message block
are used to perform the necessary initializations in the Initialization Unit of the first SHA-
256 hashing core. This initialization ends in one clock cycle.
After these 8 clock cycles have pass the processing on the first transformation round of the
first SHA-256 hash core begins and the sendmes signal is activated again indicating that a
new input message can be supplied to the HMAC design. The message that entered in the
first SHA-256 core is processed, and finally after 32 clock cycles its 256-bit hash value
exits the first SHA-256 core. It is then stored in the intermediate register REG_b, along
with padding bits and length information about the input message block in the second SHA-
256 hashing core (message length is always the 256 bits that are produced from the first
SHA-256 hashing core). The 256-bit hash value beyond the register REG_b, also feeds
the initialization unit of the second SHA-256 core. So in the clock cycle that is needed for
formulating the 512-bit input message for the second SHA-256 core (from the 256-bit
output hash value from the first SHA-256 core), also the initialization for processing this
message at the second SHA-256 core has been performed (at corresponding unit of the
second SHA-256). Moreover, in the same clock cycle the necessary signals are generated
so as to enable process at the second SHA-256 hashing core at the very next clock cycle.
Then the rest process for the HMAC value computation begins in the second SHA256
hashing core which is also finalized after 32 clock cycles. Finally, after 65 clock cycles in
total (32 for each one of the two SHA-256 cores and one clock cycle for the intermediate
REG_b padding-register), the final HMAC value is computed. One clock earlier the
handshake signal Hmac_ready is activated so as to notify the host system that at the next
clock cycle the HMAC value can be retrieved.

4.2 Collision Resistance of HMAC SHA 256
The study was conducted using Trust Based System with one hundred nodes and the results
are shown below:
19,10,32,33,40,41,43,45,47,49,82,83,84,85,94,95,97,98,86,87,88,89,90,91,92,93,96,99
and 100 act maliciously while nodes: 17, 18, 5, 11, 4, 12, 3, 20, 2, 9, 15, 1, 8, 16, 7, 13, 6,
14, 30, 31, 34, 35, 36, 37, 38, 39, 42, 44, 46, 48, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61,
62, 63, 64, 65, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79 and 80 transferred data
successfully and securely. Two nodes- node 19 and node 10, are considered malicious
while others are trusted nodes. The study of the second set of 10 nodes gives: Keyed-Hash
Message Authentication Code with Secure Hash Algorithm 256, HMAC-SHA256, was
successfully implemented in a distributed network with the Trust Based System
differentiating the malicious and non-malicious nodes in the network by reducing the trust
value of any tampered node on the network. With this, more secure data can be transmitted
in the network thereby accomplishing the aim of data authentication and data integrity
Figure 4.2. The second set of 10 nodes studied

As shown in Figure 4.2, Start Dispatch button, Stop Dispatcher button, Reset Dispatcher
button, Add node button and Make Malicious button are used to give room for interactivity.
Start Dispatch button is used to initiate sending of data packets from one node to the other.
Reset Dispatcher button on the other hand terminates sending of the data packets in client’s
nodes. Reset Dispatcher button refreshes both the client and the server nodes while Add
node button allows addition of desired number of nodes for the setup. Finally, Make
Malicious button is used to make a node or more nodes to be malicious.
Figure 4.5 Graphical representation of nodes ranging from 81 to 100
Figure 4.3: Graphical representation of users
ranging from 51 to 60
Figure 4.4: Graphical representation of
nodes ranging from 61 to 81

From the above study, specifically looking at the various figures, it can revealed that nodes
19, 10, 32, 33, 40, 41, 43, 45, 47, 49, 82, 83, 84, 85, 94, 95, 97, 98, 86, 87, 88, 89, 90, 91,
92, 93, 96, 99 and 100 acts maliciously based on various characteristics exhibited at the
implementation stage while nodes 17, 18, 5, 11, 4, 12, 3, 20, 2, 9, 15, 1, 8, 16, 7, 13 ,6, 14,
30, 31, 34, 35, 36, 37, 38, 39, 42, 44, 46, 48, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62,
63, 64, 65, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79 and 80 are the trusted nodes.
This implies that the proposed novel HMAC-SHA256 Algorithm with Trust Based System
has a strong collision resistance or attack by detecting the untrusted nodes and separating
them completely from the trusted ones. Additionally, HMAC-SHA256 is resistant to
various cryptographic attacks, including collision and pre-image attacks. HMAC-SHA256
has the longest generated hash of 32 bytes and that makes it stronger to attacks or collision
resistance than MD 5.
4.3 Performance and Time Complexity HMAC SHA 256
In this subsection, we are going to determine the performance or speed or time complexity
of the algorithm, HMAC SHA 256 using Java. In order to test the speed sample code is
used:
import java.util.UUID;
import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.lang.time.StopWatch;
public class Test {
private static final int TIMES = 1_000_000;
private static final String UUID_STRING =
UUID.randomUUID().toString();
public static void main(String[] args) {
System.out.println(generateStringToHash());
System.out.println("MD5: " + md5());

System.out.println("SHA-1: " + sha1());
}
public static long md5() {
StopWatch watch = new StopWatch();
watch.start();
for (int i = 0; i < TIMES; i++) {
DigestUtils.md5Hex(generateStringToHash());
}
watch.stop();
System.out.println(DigestUtils.md5Hex(generateStringToHash()));
return watch.getTime();
}
public static long sha1() {
...
System.out.println(DigestUtils.sha1Hex(generateStringToHash()));
}
...
}
...
}
public static String generateStringToHash() {
return UUID.randomUUID().toString() +
System.currentTimeMillis();
}
}

Aggregate Results
Results from all iterations are aggregated and compared in the table below. There are 6
main cases. They are listed below and referenced in the table:
 Case 1 – 36 characters length string, UUID is cached
 Case 2 – 49 characters length string, UUID is cached and system time stamp is
calculated each iteration
 Case 3 – 49 characters length string, new UUID is generated on each iteration and
system time stamp is calculated each iteration
 Case 4 – 72 characters length string, UUID is cached
 Case 5 – 85 characters length string, UUID is cached and system time stamp is
calculated each iteration
 Case 6 – 85 characters length string, new UUID is generated on each iteration and
system time stamp is calculated each iteration
All times below are per 1 000 000 calculations:
Figure 4.7: Average Results

From the figure 4.7, HMAC SHA-256 is faster with 31% than SHA-512 only when hashing
small strings. When the string is longer SHA-512 is faster with 2.9%. Time to get system
time stamp is ~121.6 ms per 1M iterations. Time to generate UUID is ~670.4 ms per 1M
iterations. It also competes favourably with MD 5.

CHAPTER FIVE
SUMMARY OF FINDINGS, CONCLUSION AND RECOMMENDATIONS
The purpose of this article was to propose a novel authentication protocol to resolve the
deficiencies in the Message Digest Method 5 Algorithm. This section presents the summary
of the major findings from the analyses of data, and then, make recommendations and
conclusion.
5.1 Summary of Major Findings
In the first place, it was revealed HMAC SHA 256 computational flow that the HMAC
process mixes a secret key with the message data, hashes the result with the hash function,
mixes that hash value with the secret key again, and then applies the hash function a second
time. The output hash is 256 bits in length.
Secondly, the study shown that the proposed novel HMAC-SHA256 Algorithm with Trust
Based System has a strong collision resistance or attack by detecting the untrusted nodes
and separating them completely from the trusted ones. The HMAC-SHA256 algorithm
is resistant to various cryptographic attacks, including collision and pre-image attacks.
HMAC-SHA256 has the longest generated hash of 32 bytes and that makes it stronger to
attacks or collision resistance than MD 5.
Furthermore, the study revealed that the HMAC SHA-256 is faster with 31% than SHA-
512 only when hashing small strings. When the string is longer SHA-512 is faster with
2.9%. Time to get system time stamp is ~121.6 ms per 1M iterations. Time to generate
UUID is ~670.4 ms per 1M iterations and this makes it competes favourably with MD 5.

5.2 Recommendation
Based on the various findings, I will recommend the proposed novel HMAC SHA 256
Algorithm as an authentication encryption for web- based or online business rather than
single- block hash function.
5.3 Conclusion
The International Journal of Engineering Research and Technology (IJERT) on March
2014 in a paper titled, “Design of an HMAC CO- Processor Unit Based on SHA- 2 Family
of Hash Functions” volume 3, issue3, conclude that “SHA- 2 with HMAC is completely
feasible to efficiently replace MD 5 with SHA- 2 in hardware implementations of HMAC”.
In conclusion, this article seeks to confirm the submission from IJERT that the proposed
novel HMAC SHA 256 is the ideal authentication algorithm to solve the deficiencies in
MD 5 as it a has higher performance and a higher security or stronger collision resistance
to attacks and its therefore recommended for encryption.

REFERENCE
Bonneau, J.; Herley, C.; Van Oorschot, P.C.; Stajano, F (2015). Passwords and
the evolution of imperfect authentication. Commun., 58, 78–87.
Furnell, S & Warren, M. (1999), ‘Computer Hacking and Cyber Terrorism:
The Real Threats in the New Millennium?’ Computers and Security, vol. 18, no. 12, pp.
28-34.
Frank, H & Katz, (2010), ‘WPA vs. WPA2: Is WPA2 Really an Improvement
on WPA?’, 4th Annual Computer Security Conference, Coastal Carolina University,
Myrtle Beach, SC. vol. 4, no. 5, pp 9-15
Joan, D & Vincent, R (2002), ‘The Design of Rijndael: AES -The Advanced
Encryption Standard (Information Security and Cryptography)’, 2nd edn, Springer, USA,
pp 76-38.
Joon, S. P & Derrick, D (2003), ‘WLAN Security: Current and Future’, IEEE
Computer Society, Syracuse University, NY, USA. Pp 12-14. Labib, K 2004, ‘Computer
Security and Intrusion Detection’, Crossroads, vol. 11, no. 1 pp. 2-4.
Mohammed, F & Shawkat, A (2015), ‘Recurrent security gaps in 802.11ac
routers’, International journal of scientific & technology research vol. 4, no. 9, pp 12-14.
Newman, R (2006), ‘Cybercrime, Identity Theft and Fraud: Practicing Safe
Internet – Network Security Threats and Vulnerabilities’, Proceedings of the 3rd Annual
Conference on Information Security Curriculum Development. New York, USA, vol. 6,
no. 3, pp. 68-78.
Park, JS. & Dicoi, D. (2003), ‘WLAN security: current and future’, IEEE
Internet Computing, vol. 7, no. 5, pp. 60–65.

HMAC SHA 256- PROPOSED AUTHENTICATION ALGORITHM-PRINCE DUAH MENSAH-MPhil IT (2).pdf

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to HMAC SHA 256- PROPOSED AUTHENTICATION ALGORITHM-PRINCE DUAH MENSAH-MPhil IT (2).pdf

Similar to HMAC SHA 256- PROPOSED AUTHENTICATION ALGORITHM-PRINCE DUAH MENSAH-MPhil IT (2).pdf (20)

More from SIR SUCCESS PRINCE DUAH DUAH

More from SIR SUCCESS PRINCE DUAH DUAH (20)

Recently uploaded

Recently uploaded (20)

HMAC SHA 256- PROPOSED AUTHENTICATION ALGORITHM-PRINCE DUAH MENSAH-MPhil IT (2).pdf