Guidelines for Ethical Nudging in Password Authentication

Abstract

This research investigates the Electromagnetic (EM) side channel leakage of a Raspberry Pi 2 B+. An evaluation is performed on the EM leakage as the device executes the AES-128 cryptographic algorithm contained in the libcrypto++ library in a threaded environment. Four multi-threaded implementations are evaluated. These implementations are Portable Operating System Interface Threads, C++11 threads, Threading Building Blocks, and OpenMP threads. It is demonstrated that the various thread techniques have distinct variations in frequency and shape as EM emanations are leaked from the Raspberry Pi. It is demonstrated that the AES-128 cryptographic implementation within the libcrypto++ library on a Raspberry Pi is vulnerable to Side Channel Analysis (SCA) attacks. The cryptographic process was seen visibly within the EM spectrum and the data for this process was extracted where digital filtering techniques was applied to the signal. The resultant data was utilised in the Differential Electromagnetic Analysis (DEMA) attack and the results revealed 16 sub-keys that are required to recover the full AES-128 secret key. Based on this discovery, this research introduced a multi-threading approach with the utilisation of Secure Hash Algorithm (SHA) to serve as a software based countermeasure to mitigate SCA attacks. The proposed countermeasure known as the FRIES noise generator executed as a Daemon and generated EM noise that was able to hide the cryptographic implementations and prevent the DEMA attack and other statistical analysis.

Current topics of interdisciplinary cooperation between engineering and human sciences

“…In another online study following a 2 × 2 × 4-within and between subject design, Zimmermann and Renaud ( 2021 ) found that hybrid nudges, i.e., nudges that provide additional information, lead to better security decisions, including password choice, compared to providing mere information. Renaud and Zimmermann ( 2018 a) further provided guidelines for conducting nudge experiments, particularly in the password authentication context. Other studies explored innovative authentication methods, e.g., relying on 3D-printed items for two-factor authentication (Marky et al.…”

Impact of digital nudging on information security behavior: an experimental study on framing and priming in cybersecurity

“…Researchers in the security and privacy area have been exploring ways to nudge users to better their security decisions (Renaud and Zimmermann, 2018;Cooper et al, 2020). For instance, Peer et al (2020) developed a personalized approach that analyzed individual differences in decision-making to encourage users to choose stronger and safer passwords.…”