A Security Analysis On Password-Based Authentication In Android Backup Files And Its Enhancement

The security of cryptographic scheme can be evaluated under two models: unconditional security and computational security. The most practical security is computational, which can be analyzed by provable security theory and exhaustive search experiment. Password-based Message Authentication Code (PBMAC) is a mechanism that guarantee the security of file transmission and storage. Key derivation function (KDF) provides uniform distribution key in PBMAC which generated from user’s password, and its randomness determines the overall security. In this thesis, we take Android mobile phone backup file as an example to elaborate the security of PBKDF2,We propose a feedback mode KDF denoted XKDF based on the output structure of PBKDF2and present its computational security. The main achievements are as follow:(1) The provable metrics comes to imply that both the space of user’s password and adversary’s computing powerresult in the security of KDF.We implement the Key derivation function PBKDF2of Android backup file under the latest GPU-accelerated key recovery attack capability and analyze the impact on the security of Android under different user’s password space.(2) We propose a new algorithm named XKDF based on feedback mode that is proved computationally secure by using random oracle model with Game-Playing technique. Compared with PBKDF2, the adversary’s advantage gained h-1(denoted block number) times, which enhanced the relation of the structure. We implement the algorithm in Android backup files, and the query to password space has reduced h-1time under the same attack ability and recovery time.