PGP Implementation Using IRIS Recognition Technique

kitlunchroomΤεχνίτη Νοημοσύνη και Ρομποτική

21 Νοε 2013 (πριν από 3 χρόνια και 4 μήνες)

76 εμφανίσεις

PGP Implementation Using IRIS Recognition Technique




Swati Garg









Dr. Prema K.V




CSE Dept.
MITS



Professor, CSE Dept
.
,
MITS



Lakshmangarh,
India





Lakshmangarh,India




g
arg.swati0106
@gmail.com




drprema.mits@gmail.com






ABSTRACT

Pretty Good Privacy (PGP), is a protocol used
for the purpose of secure e
-
mail message
communication over an open network. The main
idea behind introducing PGP is to increase the
degree of
security and efficiency of e
-
mail
message communication.

The conventional method used in PGP protocol
for
user authentication is
by the use of various
encryption algorithms like IDED, DES, 3DES
etc. that uses key of different length. The security
of these
algorithms depends on the complexity of
the key and its uniqueness. The key used in these
algorithms are although complex but they can be
compromised and hence

not so secu
re.

So, it is
necessary to develop a better security sy
stem.
Hence, to improve the Em
ail authentication the
key used by the various algorithms are generated

with

the help of

biometric identification of the
user.

Here, we proposed a system that uses
IrisCode as the part of key generation in various
cryptographic algorithms used in PGP Proto
col
like DES, 3DES, IDEA etc.
This is because the

iris as a

biometrics is unique for every indivi
dual
& is complex
.


KEYWORDS
:

Authentication,

Biometrics,
Cryptography, Iris
, IrisCode, Iris Signature,

Network Security, PGP



1. INTRODUCTION

One of the key aspects of Cryptography &
Information Security is authentication.



Authentication is the process of determining
whether someone or something, is in fact, who
or what it is declared to be. It helps establishing
trust by identifying the user

or the system.
Authentication and security become much
popular because of the arrival of new upcoming
technologies like electronic banking,
ecommerce, and smartcards. Security is needed
everywhere in each and every field.

Biometric authentication systems

have gained
importance because of the key role of the
information security and privacy. Biometric
recognition is one of the most important techniques
for the security privacy due to its distinctive nature
of biometric traits such as fingerprints, iris, fa
ces,
palm, etc. Biometrics is the study of identification
based on physical or behavioral characteristics and
is widely adopted in providing better
authentication. Biometric characteristics play a key
role in personal authentication applications because
th
ey possess the physiological properties like
universality, uniqueness, permanence,
collectability, performance and acceptability

[1]
. In
virtually all distributed environments electronic
mail is the most heavily used network
-
based
application. Increasingly
, people are using
electronic mail to send all kinds of messages,
including legal correspondence, business
information and even transactions. It is relatively
easy to eavesdrop on these messages, and even to
impersonate another user and send false messages
.
With the explosively growing reliance on
electronic mail for every conceivable purpose,
there grows a demand for authentication and
confidentiality services. It is the only application
that is widely used across all architecture and
vendor platforms. Use
rs expect to be able to and
do, send mail to others who are connected directly
or indirectly to the internet. The advent of E
-
Mail
and the internet has enhanced communication
throughout the world


at home and at work. The
majority of internet users around

the world use e
-
Mail to communicate. Hence, due to its increasing
popularity and need it is required to increase its
security to a great extent so that an intruder can
never see the contents of the email message. This
can be achieved by increasing the com
plexity of
the key used in PGP protocol for encrypting the
message. The various algorithms used in PGP
protocol are DES, 3DES, IDEA, etc.



2. CRYPTOGRAPHY:

Cryptography
is the science of using
mathematics to encrypt and decrypt data.
Cryptography enables you to store sensitive
information or transmit it across insecure
networks (like the Internet) so that it cannot be
read by anyone except the intended recipient.
While cr
yptography is the science of securing
data,
cryptanalysis
is the science of analyzing
and breaking secure communication. Classical
cryptanalysis involves an interesting
combination of analytical reasoning, application
of mathematical tools, pattern finding
, patience,
determination, and luck

[2]
. Cryptanalysts are
also called
attackers.
Cryptographic strength is
measured in the time and resources it would
require to recover the plaintext. However, the
strong cryptography employed by PGP is the
best available

today.
During this time when the
Internet provides essential communication
between tens of millions of people and is being
increasingly used as a tool for commerce,
security becomes a tremendously important
issue to deal with.



2.1
HOW CRYPTOGRAPHY WORKS


A
cryptographic algorithm,
or cipher, is a
mathematical function used in the encryption
and decryption process. A cryptographic
algorithm works in combination with a
key


a
word, number, or phrase


to encrypt the
plaintext. The same plaintext encrypts to
different cipher text with different keys. The
security of encrypted data is entirely dependent
on two things: the strength of the cryptographic
algorithm and the secrecy
of the key. A
cryptographic algorithm, plus all possible keys
and all the protocols that make it work comprise
a
cryptosystem.
PGP is a cryptosystem.



2.2 THE PURPOSE OF CRYPTOGRAPHY

Cryptography is the science of writing in secret
code and is an ancient

art. In data and
telecommunications, cryptography is necessary
when communicating over any entrusted
medium, which includes just about any network,
particularly the Internet

[3]
.

1 Authentication: The process of proving one's
identity.

2
Privacy/confidentiality: Ensuring that no one
can read the message except the intended
receiver.

3 Integrity: Assuring the receiver that the
received message has not been altered in any
way from the original.

4 Non
-
repudiation: A mechanism to prove that
th
e sender really sent this message.

Cryptography,

not only protects data from theft
or alteration, but can also be used for user
authentication. There are, in general, three types
of cryptographic schemes typically used to
accomplish these goals: secret key

(or
symmetric) cryptography, public
-
key (or
asymmetric) cryptography, and hash functions.
In all cases, the initial unencrypted data is
referred to as plaintext. It is encrypted into
cipher text, which will in turn (usually) be
decrypted into usable plain
text.



3. BIOMETRIC TECHNOLOGY

A

bio
m
etric

system

provides

auto
m
atic

re
c
ognition

of

an

individual

based

on

so
m
e
sort

of

unique

feature

or

characteristic

p
o
ssessed

by

the

individual.

Biometric

syste
m
s
have

been

developed

based
on

fingerprints
,

facial

features,

voice,

hand

geo
m
etry,
handwriting, the retina [4], and the iris.

Biometric

s
ystems

work

by

first

ca
p
turing

a

sam
p
le

of

the

feature,

s
u
ch

as

recor
d
ing

a
digital

sound signal

for

voice

recognition,

or

taking

a

dig
i
tal

color

image

for

face
recognition.

The

sample

is

then

transfo
r
med

using

some

sort

of

math
e
matical

function into

a

b
i
ometric

templat
e
.

The

biometric

template

will

pro
v
i
d
e

a

normali
z
ed,

e
ff
i
cient and

highly

discrim
i
nating

representation

of

t
h
e

feature,

which

can

then

be

objectively compared

with

oth
e
r

t
e
mplates

in

o
rder

to

dete
r
mine

identity. A

good

biometric

is

characterized

by

use

of

a

f
eature

that

is;

highly

unique



so

that the

chance

o
f

any

two

people

having

the

same

chara
c
te
r
i
stic

will

be

m
i
nimal,

stable



so

that

the

feature

does

not

change

over

time,

a
nd

be

easily

captured



in

order

to provide
convenience to the user, and pre
v
ent
m
i
sreprese
n
t
ati
o
n of the feature. The biometric
characteristics fall into two categories:

• Physiological
:
-

These
are rela
ted to the
shape
of the body
. Exa
mples are fac
ial recog
nit
ion
-

2D,

3D,

Thermo graphic;

Retinal
scanning;

Iris
scanning;

Finger Scanning
-

fingertip, thumb,

length;

Palm Scanning
-

print,
topography;

Hand
Geometry;

Wrist/Hand
Vein; Ear

Shape
etc.

• Behavioral
:
-
are
relate
d to the behavior of a
person. Examp
les are Voic
e Prints; Dynamic

Signature Verification; Keystroke Dynamics etc

[5]
.


3.1
. THE HUMAN IRIS

The iris is a thin circular diaphragm, which lies
between the cornea and the lens of the human
eye. Iris is perf
orated close to its centre by a
circular aperture known as the pupil. The
average diameter of the iris is 12 mm, and the
pupil size can vary from 10
% to 80% of the iris
diameter [6
].

The iris consists of a number of layers
.
The
externally visible surface
of the multi
-
layered
iris contains two zones
, which often differ in
color [7
]. An outer ciliary zone and an inner
pupillary zone, and these two zones are divided
by the collarette


which appears as a zigzag
pattern. A typical iris image i
s shown below in
figure
1(the image is take from the

CASIA iris
database

[8]
).

D
ue

to

the

e
p
igenetic

n
a
t
u
re

of

i
r
is

p
a
tterns,

the

two

eyes

of

an individual

contain

co
m
p
letely

in
d
e
p
endent

iris

patt
e
rns,

a
n
d

identic
a
l

twins

posse
s
s uncorr
e
lated

i
r
is

p
a
tt
e
rn
s
.








Eyelashes Pupil
Upper Eyelid





Sclera

Lower Eyelid




Figure1
. Eye Image



4. INTODUCTION TO PGP
(PRETTY
GOOD PRIVACY)

Pretty Good Privacy was developed by Phillip
Zimmerman to provide a means of secure
communication in an insecure electronic
environment

[9]
. PGP is an email security
program that implements the concepts and
algorithms of single key encryption, public key
cryptology and digital signature to deliver a
complete email security product. PGP uses
public
-
key encryption to protect email and data
file
s. However, it does not use the Public Key
Infrastructure (PKI). PGP automatically
provides data confidentiality, data integrity, and
origin authentication with the option of non
-
repudiation.

IRIS

PGP uses
data encryption and decryption to
provide privacy. Dat
a encryption involves
converting digital information from a readable
state to an unreadable state. To read the
encrypted data, we need a key or password. It
provides authentication through the use of
digital signature, confidentiality through the use
of sy
mmetric block encryption, compression
using the ZIP algorithm

(LZ77 [10])
, E
-
Mail
compatibility using the radix
-
64 encoding
scheme and segmentation and reassembly to
accommodate long e
-
mails

[11]
.

In order to understand how PGP works, some
basic knowledge
about how encryption works is
required. Basically, there are two form of
encryption. There is Conventional encryption
and Public Key encryption. PGP use a public
key encryption. Public key encryption works by
using your public key, the key that everyone ha
s
access to, to encrypt the email. Anyone who
gets into your system can send these public
-
key
encrypted emails to anyone they choose. The
trick is on the receiving end. The only way to
open the email is to use the recipient’s private
key. So while a person

can send anything to
anyone using your public key, only those with
the correct private key can read the email. PGP
usually makes use of a 512, 1024, or 2048
-
bit
RSA key pair for authentication purposes and a
128
-
bit IDEA key for encryption.



4.1. HOW PGP

WORKS

PGP combines some of the best features of both
conventional and public key cryptography. PGP
is a hybrid cryptosystem. When a user encrypts
plaintext with PGP, PGP first compresses the
plaintext. Data compression saves modem
transmission time and di
sk space and, more
importantly, strengthens cryptographic security.
Most cryptanalysis techniques exploit patterns
found in the plaintext to crack the cipher.
Compression reduces these patterns in the
plaintext, thereby greatly enhancing resistance
to cryp
tanalysis. Files that are too short to
compress or which don't compress well aren't
compressed.

PGP then creates a session key, whic
h is a one
-
time
-
only secret key
. This session key works
with a very secure, fast conventional encryption
algorithm to encryp
t the plaintext; the result is
cipher text

[12]
. Once the data is encrypted, the
session key is then encrypted to the recipient's
public key. This public key
-
encrypted session
key is transmitted along with the cipher text to
the recipient.

Decryption works

in the reverse. The recipient's
copy of PGP uses his or her private key to
recover the temporary session key, which PGP
then uses to decrypt the conventionally
-
encrypted cipher text.



5. WORKING & BLOCK DIAGRAM OF
THE PROPOSED SYSTEM

The iris is an
externally visible, yet protected
organ whose unique epigenetic pattern remains
stable throughout adult life. These
characteristics make it very attractive for use as
a biometric for identifying individuals. Image
processing techniques can be employed to
e
xtract the unique iris pattern from a digitized
image of the eye, and encode it into a biometric
template, which can be stored in a database.
This biometric template contains an objective
mathematical representation of the unique
information stored in the
iris
.

The whole process of Biometric key
authentication can be illustrated with the help of
the following figure. The generated Iris Code
can be used as the key in various cryptosystem.
PGP usually makes use of IDEA, DES, 3 DES
algorithms using variable ke
y length for
encryption. Now, according to the proposed
system, we can use Iris Code to generate key.
This key generated with Iris Code called as Iris
Signature has a unique property and is complex
in nature. It can be used by PGP protocol for
encrypting t
he email messages.




Output





Generate








Figure2.

Block Diagram of the Proposed PGP
Protocol using Iris

Iris Signature generated from Iris Code is
always different for different individuals.
Whenever encryption is to be performed we can
use the Iris Signature as a key in various
cryptographic algorithms like CAST
-
128,
IDEA, DES, 3DES etc (used in PGP protoco
l)
for encrypting messages. It will help increase in
security to a great extent as it is difficult to
identify the key due to its complexity and
unique nature. Moreover, it provides
confidentiality by ensuring that no two
individuals have same IrisCode. It

is different
for everyone. Hence, a particular key generated
from a particular IrisCode corresponds to a
particular individual and is unique.

6. RESULTS

The basic reason for such an approach is to
attain a system that would ensure security
thereby check for the authentication of the user.
Since, Iris for every individual is unique
therefore using this concept in the making of Iris
Recognition System where
your iris and its
binary code would act as your password to
allow the access. This system constitutes to be
the most promising and efficient in addition to
its accuracy among all the facilities of
Biometrics. This technique will help in
increasing the secu
rity of email messages to a
great extent.



7
. CONCLUSION

PGP provides individuals a simple, easy to use
encryption solution to automatically protect
confidential communication and digitally stored
information with an integrated solution based on
strong, b
roadly accepted secured technology.
PGP secures private e
-
mail, selected files for
mail application.

The proposed System using Iris Signature as a
key in PGP protocol would definitely overcome
the brute force attack & chosen cipher text
attack. As the Iris
Code generated for different
persons is always different it can be used as a
key for cryptographic algorithms. It generates
large possible combinations of keys which are
very difficult to crack down. Hence, iris’s
complex texture and its apparent stabil
it
y

hold
tremendous pr
omis
e for ir
is
recognition to be
used in diverse appli
cat
ion scenar
io
s, such as
bor
der con
tro
l,
for
ens
ic inv
est
igatio
ns, and
cry
ptosystems. We have utilized this unique
property of Iris for encrypting email messages
and hence increasing
the security of the PGP
Protocol.


8.
REFERENCES

[1] R. Wildes. Iris recognition: an emerging
biometric technology. Proceedings of the IEEE,
Vol. 85, No. 9, 1997.

[2] Fundamentals of Computer Security,
Springer publications “Basic Cryptographic
Algorithms”
, an article available at
www.itsc.state.md.us/oldsite/info/InternetSecuri
ty/Crypto/CryptoI ntro.htm#Algorithms

[3] Computer and Network security by ATUL
KAHATE


IRIS
Recognition

System

IRIS Code

Use this IRIS S
ignature
as a key
for encrypting
PGP

Message

IRIS Signature
(101011111000011
....)


[4] S. Sanderson, J. Erbetta. Authentication for
secure environments based on iris scanning

technology. IEE Colloquium on Visual
Biometrics, 2000.

[5] J. Daugman. How iris recognition works.
Proceedings of 2002 International Conference
on Image Processing, Vol. 1, 2002.

[6] J. Daugman. Biometric personal
identification system based on iris ana
lysis.
United States Patent, Patent Number: 5,291,560,
1994.

[7] J. Daugman. High confidence visual
recognition of persons by a test of statistical
independence. IEEE Transactions on Pattern
Analysis and Machine Intelligence, Vol. 15, No.
11, 1993.

[8] Chi
nese Academy of Sciences


Institute of
Automation. Database of 756 Greyscale Eye
Images. http://www.sinobiometrics.com Version
1.0, 2003.

[9] Simson Garfinkel S, PGP: Pretty Good
Privacy, O'Reilly & Associates, Inc, 1994.

[10] Ziv

J and Lempel A, "A Universal
Algorithm for Sequential Data Compression",
IEEE Transactions on Information Theory, Vol.
23, No. 3, pp. 337
-
343.

[11] S. William, Cryptography and Network
Security: Principles and Practice, 2nd edition,
Prentice
-
Hall, Inc., 1
999 pp 23
-
50

[12] Cui Jian, double, Li Grams, PGP secure
encryption works [J]. Computer Engineering &
Science, 2003, 1(6):25
-
28

[13] Dai Kuobin, “PGP email protocol security
analysis and improvement program”,
International Conference on Intelligence
Scien
ce & Information Engineering, 2011,
pp.45
-
48.



















.