The Advanced of Fuzzy Vault Using Password - Advances in Computational Science and Engineering - page 38

Q' u = (Q u + T u ) mod (2 Bu )
Q' v = (Q v + T v ) mod (2 Bv ) -------------------------------------- (1)
Q' θ = (Q θ + T θ ) mod (2 Bθ )
3 Vulnerability Analysis of Hardening Fuzzy Vault Using
Password
3.1 Adversarial Model
This section explains attacks which are considered for analysis of security for fuzzy
vault using password. Figure 9 shows that attack point in fuzzy vault using password.
Fig. 9. Attack point in fuzzy vault using password
1. Brute Force Attack [5][6][7]
A brute force attack is that invalidates a cryptographic scheme by attempt to try on all
occasions. Here the occasion means all possible keys for decrypt a message. In a
general way, the theoretical possibility of a brute force attack is acknowledged.
2. Dictionary Attack[6][7][8]
A dictionary attack for searching password is that words on dictionary input one after
the other. The attack is executed that not only words input to the letter but also a capi-
tal letter mixed a small letter or the word adds a number, and so on. A dictionary
storing hundreds of thousands of word is treated by computer automatically.
3. Hybrid Attack[6][8]
If an attacker is fails a dictionary attack, and then he try a hybrid attack where the
dictionary file is used again, but with common character substitutions or appending a
character to either end of the word. By way of example, dictionary word “password”
is varied as “p@ssword”, “passw0rd”, “pass1word”, “5passw0rd”. All these variations
would be broken with a good cracking tool such as l0phtcrack(LC5).
4. Attacks via Record Multiplicity(ARM)[9]
We consider attacks against database in biometric security systems. In biometric secu-
rity systems, database is a common target of attack. A traditional biometric system
stores original template in a database, and original template used in authentication/
identification. If an attacker can access to the database, all template data (T) can be
compromised. In fact, an illegal access to databases is commonplace. Even if template