A note on the security of code memo

Reviewer: Amos O Olagunju

Secure electronic transactions via the Web, automated teller machines, and mobile phones require protected personal identification numbers (PINs) and passwords. Secure electronic transaction systems use stored PINs and passwords to authenticate users. PINs and passwords are also used as the encryption keys in classical cryptosystems such as the Vigenere cipher. Unfortunately, the security of any encryption system that employs a key depends on the secrecy of a PIN or password and its length. Algorithms for locating the encryption keys of known ciphers exist in the literature [1]. However, it is complicated to perform a black box study of an unfamiliar encryption algorithm to discover the feedback information channels for recognizing counterfeit decryption keys. Code Memo is software equipped with a hush-hush cryptographic algorithm for saving passwords on Sony Ericsson mobile phones (SEMPs). Wolf and Schneider analytically show how the weaknesses inherent in Code Memo's encryption algorithm could be used to obtain a master password for subsequently retrieving PINs and passwords on SEMPs. The authors exploited the digits and special characters used as input and output in Code Memo's encryption algorithm to create and store PINs. Based on Bernoulli trials, they presented the expected value and variance for the number of times Code Memo would return at least one element of the difference between the input and output character sets when all incorrect master password candidates were keyed in. They illustrated the ease of an attack on Code Memo using a personal computer to enter candidate master passwords into Code Memo on a mobile phone, and to process the decryption results captured by a webcam. A four-digit PIN master password was successfully used to illuminate the ease of obtaining a sample of specially constructed passwords stored with Code Memo. Unfortunately, the authors were unable to recommend a patch for the flaws in Code Memo's cryptographic algorithm. Nevertheless, the paper chronicled the potential loopholes in cryptographic algorithms for storing PINs and passwords in mobile phones. Consequently, the cryptographic algorithms for mobile phones and secure electronic transactions ought to explore trap-door functions and product ciphers for the encryption and decryption of PINs and passwords. Online Computing Reviews Service