Multi-ciphersuite security of the Secure Shell (SSH) protocol

The Secure Shell (SSH) protocol is widely used to provide secure remote access to servers, making it among the most important security protocols on the Internet. We show that the signed-Diffie--Hellman SSH ciphersuites of the SSH protocol are secure: each is a secure authenticated and confidential channel establishment (ACCE) protocol, the same security definition now used to describe the security of Transport Layer Security (TLS) ciphersuites. While the ACCE definition suffices to describe the security of individual ciphersuites, it does not cover the case where parties use the same long-term key with many different ciphersuites: it is common in practice for the server to use the same signing key with both finite field and elliptic curve Diffie--Hellman, for example. While TLS is vulnerable to attack in this case, we show that SSH is secure even when the same signing key is used across multiple ciphersuites. We introduce a new generic multi-ciphersuite composition framework to achieve this result in a black-box way.

On the Security of Two RFID Mutual Authentication Protocols

In this paper, the security of two recent RFID mutual authentication protocols are investigated. The first protocol is a scheme proposed by Huang et al. [7] and the second one by Huang, Lin and Li [6]. We show that these two protocols have several weaknesses. In Huang et al.’s scheme, an adversary can determine the 32-bit secret password with a probability of 2−2 , and in Huang-Lin-Li scheme, a passive adversary can recognize a target tag with a success probability of 1−2−4 and an active adversary can determine all 32 bits of Access password with success probability of 2−4 . The computational complexity of these attacks is negligible.

On Randomizing Hash Functions to Strengthen the Security of Digital Signatures

Halevi and Krawczyk proposed a message randomization algorithm called RMX as a front-end tool to the hash-then-sign digital signature schemes such as DSS and RSA in order to free their reliance on the collision resistance property of the hash functions. They have shown that to forge a RMX-hash-then-sign signature scheme, one has to solve a cryptanalytical task which is related to finding second preimages for the hash function. In this article, we will show how to use Dean’s method of finding expandable messages for finding a second preimage in the Merkle-Damgård hash function to existentially forge a signature scheme based on a t-bit RMX-hash function which uses the Davies-Meyer compression functions (e.g., MD4, MD5, SHA family) in 2 t/2 chosen messages plus 2 t/2 + 1 off-line operations of the compression function and similar amount of memory. This forgery attack also works on the signature schemes that use Davies-Meyer schemes and a variant of RMX published by NIST in its Draft Special Publication (SP) 800-106. We discuss some important applications of our attack.

A decade of supply chain collaboration and directions for future research

Purpose This paper aims to conduct a systematic review of the literature on supply chain collaboration published over a 10-year period from 2005 to 2014. It explores the nature and extent of research undertaken to identify key themes emerging in the field and gaps that need to be addressed. Design/methodology/approach The authors review a sample of 207 articles from 69 journals, after using an iterative cycle of defining appropriate search keywords, searching the literature and conducting the analysis. Findings Key themes include the meaning of collaboration; considerations for supply chain collaboration theory; emerging areas in collaboration for sustainability, technology-enabled supply chains and humanitarian supply chains; and the need for a more holistic approach, multi-tier perspectives and research into B2C collaborations. Research limitations/implications The paper provides discussion and scope for future research into the area which would contribute to the field tremendously. Originality/value There have been very few reviews in the past on supply chain collaboration, and this is one of the first extensive reviews conducted to address how well the body of knowledge on supply chain collaboration corresponds with our contemporary society.

The reliability of supply of feed grains in the northern region

Reliability of supply of feed grain has become a high priority issue for industry in the northern region. Expansion by major intensive livestock and industrial users of grain, combined with high inter-annual variability in seasonal conditions, has generated concern in the industry about reliability of supply. This paper reports on a modelling study undertaken to analyse the reliability of supply of feed grain in the northern region. Feed grain demand was calculated for major industries (cattle feedlots, pigs, poultry, dairy) based on their current size and rate of grain usage. Current demand was estimated to be 2.8Mt. With the development of new industrial users (ethanol) and by projecting the current growth rate of the various intensive livestock industries, it was estimated that demand would grow to 3.6Mt in three years time. Feed grain supply was estimated using shire scale yield prediction models for wheat and sorghum that had been calibrated against recent ABS production data. Other crops that contribute to a lesser extent to the total feed grain pool (barley, maize) were included by considering their production relative to the major winter and summer grains, with estimates based on available production records. This modelling approach allowed simulation of a 101-year time series of yield that showed the extent of the impact of inter-annual climate variability on yield levels. Production estimates were developed from this yield time series by including planted crop area. Area planted data were obtained from ABS and ABARE records. Total production amounts were adjusted to allow for any export and end uses that were not feed grain (flour, malt etc). The median feed grain supply for an average area planted was about 3.1Mt, but this varied greatly from year to year depending on seasonal conditions and area planted. These estimates indicated that supply would not meet current demand in about 30% of years if a median area crop were planted. Two thirds of the years with a supply shortfall were El Nino years. This proportion of years was halved (i.e. 15%) if the area planted increased to that associated with the best 10% of years. Should demand grow as projected in this study, there would be few years where it could be met if a median crop area was planted. With area planted similar to the best 10% of years, there would still be a shortfall in nearly 50% of all years (and 80% of El Nino years). The implications of these results on supply/demand and risk management and investment in research and development are briefly discussed.

Valuing Expansions of the Electricity Transmission Network under Uncertainty: The Binodal Case

Transmission investments are currently needed to meet an increasing electricity demand, to address security of supply concerns, and to reach carbon-emissions targets. A key issue when assessing the benefits from an expanded grid concerns the valuation of the uncertain cash flows that result from the expansion. We propose a valuation model that accommodates both physical and economic uncertainties following the Real Options approach. It combines optimization techniques with Monte Carlo simulation. We illustrate the use of our model in a simplified, two-node grid and assess the decision whether to invest or not in a particular upgrade. The generation mix includes coal-and natural gas-fired stations that operate under carbon constraints. The underlying parameters are estimated from observed market data.

Project neptune: Improved operation of water distribution networks

Water service providers (WSPs) in the UK have statutory obligations to supply drinking water to all customers that complies with increasingly stringent water quality regulations and minimum flow and pressure criteria. At the same time, the industry is required by regulators and investors to demonstrate increasing operational efficiency and to meet a wide range of performance criteria that are expected to improve year-on-year. Most WSPs have an ideal for improving the operation of their water supply systems based on increased knowledge and understanding of their assets and a shift to proactive management followed by steadily increasing degrees of system monitoring, automation and optimisation. The fundamental mission is, however, to ensure security of supply, with no interruptions and water quality of the highest standard at the tap. Unfortunately, advanced technologies required to fully understand, manage and automate water supply system operation either do not yet exist, are only partially evolved, or have not yet been reliably proven for live water distribution systems. It is this deficiency that the project NEPTUNE seeks to address by carrying out research into 3 main areas; these are: data and knowledge management; pressure management (including energy management); and the associated complex decision support systems on which to base interventions. The 3-year project started in April of 2007 and has already resulted in a number of research findings under the three main research priority areas (RPA). The paper summarises in greater detail the overall project objectives, the RPA activities and the areas of research innovation that are being undertaken in this major, UK collaborative study. Copyright 2009 ASCE.