The advanced encryption standard (AES) is the most encryption algorithm used around the world. This fact made it coveted by several cryptanalysis attacks. Some of them succeed to reveal certain weakness, due to its static parameters known by the public mass. The substitution box (S‐Box) is among the most sensitive parameters of this standard, which plays a crucial role in the protection against these attacks. In this study, a new version of AES is introduced, which uses a set of AES‐like S‐Boxes instead of the original one. These S‐Boxes, generated from different irreducible polynomials, are dynamically chosen, depending on the encryption key. This introduction is conducted by the design and the implementation of a new block cipher version of AES, based on a key dependent S‐Box cube. Where a cube of six interchangeable S‐Boxes key‐dependently generated is constructed. This cube determines the active S‐Box for a given round, through its random rotations guided by the round key. Furthermore, the improvement of the cryptographic robustness, provided by this method is demonstrated. This is accomplished through a comparison with the original AES, in terms of statistical and cryptographic randomness properties.

Bluetooth is an important technical standard for short-range and low-power wireless communication. The home automation and entertainment (HAE) systems often make use of Bluetooth technology to link different Bluetooth devices and form Bluetooth networks. The security concerns of the HAE systems are raised due to massive deployment of the Bluetooth devices. The Bluetooth standard mainly depends on the secure simple pairing (SSP) solution to protect the Bluetooth devices. Hence, we investigate the SSP solution according to the Bluetooth standard v5.0. The contributions are threefold. (1) A formal security model is proposed to evaluate SSP’s association models and authenticated link key. (2) We formally analyze two SSP protocols and present the security requirements for basic cryptographic modules in these SSP protocols. (3) We discuss the typical SSP applications in the HAE systems. Our results are useful to not only evaluating and designing the SSP protocols but also enhancing the security of the HAE systems in which the Bluetooth access is available.

Liu et al. proposed a grouping-proof authentication protocol (GUPA) for distributed radio frequency identification systems. At the same time, Liu et al. claimed that GUPA can resist the well-known attacks such as replay, forgery, tracking, and denial of proof. However, we report that, according to Liu et al.'s assumption of the attack ability, the attacker is able to compromise all secrets by the man-in-the-middle (MIM) attacks. Although the MIM attacks were not explicitly evaluated by GUPA, the attacker can easily launch replay, forgery, tracking, and denial of proof when he knows all secrets of GUPA. That is, the lethal security flaws exist in GUPA. We also suggest employing the cryptographic hash function to protect the secrets in GUPA. Our security analysis of GUPA will be beneficial to the design of the robust grouping-proof authentication protocols in the future.

Recently, Roy et al. proposed a physically unclonable function (PUF)-based authentication and key exchange protocol for Internet of Things (IoT) devices. The PUF protocol is efficient, because it integrates both the Node-to-Node (N2N) authentication and the Node-to-Server (N2S) authentication into a standalone protocol. In this paper, we therefore examine the security of the PUF protocol under the assumption of an insider attack. Our cryptanalysis findings are the following. (1) A legitimate but malicious IoT node can monitor the secure communication among the server and any other IoT nodes in both N2N authentication and N2S authentication. (2) A legitimate but malicious IoT node is able to impersonate a target IoT node to cheat the server and any other IoT nodes in N2N authentication and the server in N2S authentication, respectively. (3) A legitimate but malicious IoT node can masquerade as the server to cheat any other target IoT nodes in both N2N authentication and N2S authentication. To the best of our knowledge, our work gives the first non-trivial concrete security analysis for the PUF protocol. In addition, we employ the automatic verification tool of security protocols, i.e., Scyther, to confirm the weaknesses found in the PUF protocol. We finally consider how to prevent weaknesses in the PUF protocol.