This report analysis web security password authentication based on single- block hash function, written by Shi-Qi Wang, Jing-Ya Wang and Yong-Zhen Li and presented at the 2013 International Conference on Electronic Engineering and Computer Science. To analyze an algorithm means to study the specification of the Algorithm and come to a conclusion about how the implementation of that algorithm will perform in general. Here, the amount of resources necessary to execute the algorithm is determined and its equivalent running time (time complexity) or efficiency of the algorithm. A review of some of the available literature provides insights into various web security and user identity authentication mechanisms, single- block hash function algorithm, its types, design and functions. The key findings include:  The Single- Block Hash Function Algorithm has variable input length and fixed out length  The flow chart in figure 1 of the studies shows that the algorithm is Message Digest Method 5 (MD 5)  MD5 algorithm appends padding bits, appends length bits, initialize MD buffer and process each 512- bit block.  In processing each 512- bit block, a total of 64 operations are performed in 4 stages and each stage undergoes 16 iterations.  Collision Resistance Scenario: MD 5 has a very weak collision resistance and its therefore not recommended for encryption. However, MD 5 can withstand tamper with and replay.  Running Time (Time Complexity): The time complexity of MD 5 is O(n), where n represents the size of the input data. it is considered relatively fast and efficient than the traditional password but slower than modern hash functions.  Many researchers research to use Single-Block hash algorithm to realize the Web user ID authentication  MD 5 solves deficiency of the traditional username-password authentication or digital signature to realize Web user’s identity authentication The information presented in this report has been gathered from secondary sources and has been prepared for submission as Information Security Course at AAMUSTED.

1. AKENTEN APPIAH- MENKA UNIVERSITY OF SKILL TRAINING AND
ENTREPRENEURIAL DEVELOPMENT
FACULTY OF APPLIED SCIENCES AND MATHEMATICS
DEPARTMENT OF INFORMATION TECHNOLOGY
NAME PRINCE DUAH MENSAH
INDEX NUMBER 8221520010
COURSE MIT 821 INFORMATION SECURITY
Select one published algorithm/protocol from any one of the ff categories:
Category A: Access control, authorization, authentication
Category B: Homomorphic encryption, attribute-based encryption
Category C: Intrusion detection, intrusion prevention
Tasks:
1. Implement the algorithm in any programming language of your choice.
2. Do a detailed analysis of the algorithm and report your findings.
3. Propose a(n) solution/improvement (supported by literature) to one
problem/deficiency you identified with your choice of algorithm.
Explain your proposed solution/improvement in detail, and prove that
it works.
Deliverables:
1. A report on your analysis of the chosen algorithm.
2. An article on the proposed solution/improvement to the problem/deficiency with the
algorithm
Submission deadline: Monday, September, 18, 2023.

2. A REPORT ON THE ANALYSIS OF WEB SECURITY PASSWORD
AUTHENTICATION BASED ON THE SINGLE- BLOCK HASH
FUNCTION
Prepared By
Prince Duah Mensah
(8221520010)
Preparation for MPhil. Information Technology
Akenten Appiah- Menka University of Skill Training and Entrepreneurial
Development
Lecturer:
13th
September, 2023

3. Summary
This report analysis web security password authentication based on single- block hash
function, written by Shi-Qi Wang, Jing-Ya Wang and Yong-Zhen Li and presented at the 2013
International Conference on Electronic Engineering and Computer Science. To analyze an
algorithm means to study the specification of the Algorithm and come to a conclusion about
how the implementation of that algorithm will perform in general. Here, the amount of
resources necessary to execute the algorithm is determined and its equivalent running time
(time complexity) or efficiency of the algorithm.
A review of some of the available literature provides insights into various web security and
user identity authentication mechanisms, single- block hash function algorithm, its types,
design and functions.
The key findings include:
 The Single- Block Hash Function Algorithm has variable input length and fixed out length
 The flow chart in figure 1 of the studies shows that the algorithm is Message Digest Method
5 (MD 5)
 MD5 algorithm appends padding bits, appends length bits, initialize MD buffer and process
each 512- bit block.
 In processing each 512- bit block, a total of 64 operations are performed in 4 stages and
each stage undergoes 16 iterations.
 Collision Resistance Scenario: MD 5 has a very weak collision resistance and its therefore
not recommended for encryption. However, MD 5 can withstand tamper with and replay.
 Running Time (Time Complexity): The time complexity of MD 5 is O(n), where n
represents the size of the input data. it is considered relatively fast and efficient than the
traditional password but slower than modern hash functions.
 Many researchers research to use Single-Block hash algorithm to realize the Web user ID
authentication
 MD 5 solves deficiency of the traditional username-password authentication or digital
signature to realize Web user’s identity authentication
The information presented in this report has been gathered from secondary sources and has
been prepared for submission as Information Security Course at AAMUSTED.

4. TABLE OF CONTENTS
Summary 3
1 Introduction
1.1 Purpose of the report
1.2 Scope of the report
2 Literature Survey
2.1 Web- based Business
2.2 Web- based Business Security
2.3 User Identity Authentication
2.4 User Identity Authentication Methods
2.5 Message Digest Method 5
3 Methodology
3.1 Sources of Data Collection
3.2 Hash Function Algorithm Design Approach
3.3 MD 4 Algorithm Design
3.4 Research Instruments
4 Results and Discussion
4.1 Performance and Running Time of MD 5
4.2 Avalanche Effect
4.3 Collision Resistance of MD 5 in Python
5 Conclusion
5.1 Summary of Major Findings
5.2 Recommendations
5.3 Conclusion
6 Reference

5. CHAPTER ONE
INTRODUCTION
The Internet can be a very useful tool for any company, large or small, local, national or
global one, when is used in an appropriate manner (Cohut, 2005). The Internet is providing
firms with new ways to conduct business and exchange and communicate information and
ideas. In doing so, it is enabling companies to improve efficiency and develop novel ways
to co-ordinate activities. Web- based businesses encompass much more than online
purchasing transactions. Enterprises conduct online based businesses to buy parts and
supplies from other companies, collaborate on sales promotions and conduct joint research.
Corporations are continuously rethinking and reshaping their business models to adopt
stringent security protocols and tools to protect against hackers, fraud and theft.
Most of the web- based businesses use username/ password method of the static password
identification technology, which is simple and easy to realize. Nevertheless, there are also
many hidden security threats associated with static password: password easily revealed to
others, the password on the internet transmission easily gained, even the credit card
numbers, bank numbers, private keys, password and other sensitive information on the
network transmission will be stolen by attackers. According to the vulnerability of static
password, one- time password concept arises at the historic moment; its main idea is to add
password transmission process uncertain factors making each login authentication
information transmission is not same, and replay attacks and impersonation attacks can be
avoided.
Based on the static password authentication in hidden security dangers and the
insufficiency associated with web- based businesses, the researchers decided to put forward
the method based on the single-block hash function for user’s identity authentication
method. They have variable input length and fixed output length. If the same input message
is fed to the Single- Block Hash Function, it will generate the same resultant hash. It is not
possible to generate the same hash value using two different input values. Strong
encryption of hash function must be irreversible; it means that a result through the hash, it
is hard to get the original information. Ensure the user’s identity authentication process not
to be stolen, intercepted. At the same time, it guarantees the security of the password

6. authentication, the balance of efficiency, making it easier to apply for the Web in daily life.
This report therefore analysis web security password authentication based the single- block
hash function.
This report is an assessable component of Information Security as part of the Master of
Philosophy in Information Technology programme at Akenten Appiah- Menka University
of Skill Training and Entrepreneurial Development, Kumasi Campus.
1.1Purpose of the Report
This report analysis web security password authentication based on the single- block hash
function. It specifically looks at the algorithm’s:
i. Performance and running time (Time Complexity) of the Algorithm
ii. Avalanche effect: smallest changes in the input can make a big difference in the
coded text output.
iii. Attacks or Collision Resistance of MD 5 using Python
1.2Scope of the Report
The report only confined itself web security authentication. It focused on the analysis of
the authentication mechanism used, which was single- block hash function. The report
targeted Web authentication of user’s identity and the amount of computation involved
with regards to the algorithm.

7. CHAPTER TWO
LITERATURE SURVEY
The literature survey consists of systematic identification and analysis of documents
containing information related to web security authentication. The literature survey
encompasses web- based business security, user identification authentication, user
identification authentication method and single- block hash function algorithm.
2.1Web- Based Business
One of the first to use the term, “web- based business” was IBM, in October 1997, when it
launched a campaign built around online business. Today, major companies and
institutions are rethinking their businesses in terms of the internet and its new culture and
capabilities. Online business is the conduct of business on the internet, not only buying and
selling but also servicing customers and collaborating with business partners. There are
enormous benefits of web- based business which includes international marketplace, 24/7
access to shop or conduct other transactions all year round from almost any location,
customers get more choices, improves delivery processes and reduces operational cost to
businesses. Nevertheless, online business has some challenges associated with it, which
includes breakdown in human interaction, cost of access to the internet, rapidly evolving
and changing technology, problems with compatibility of older and newer technology,
under pressure to innovate and develop business models to exploit new opportunities,
increased competition from both national and international organisations.
2.2Web- Based Business Security
Web- based business security refers to the set of guidelines, steps and protocols designed
to allow secure sales and purchase of products and services online. Web security is
important in business in keeping hackers and cyber-frauds from accessing sensitive
information. Without a proactive security strategy, businesses risk the spread and
escalation of malware, attacks on other websites, networks and other IT infrastructures.

8. 2.3 User Identity Authentication
User Identity Authentication in the digital world is imperative to help protect a user’s
biggest asset which is their personal identity. User Identity Authentication refers to the
process of verifying the identity of a user attempting to gain access to a file or site. It
involves the use of a username and password, or sometimes through cards, retina cans,
voice recognition and fingerprints. User Identity Authentication does not determine what
tasks the individual can do or what files the individual can see. Rather, it merely identifies
and verifies who the person or system is.
2.4 User Identity Authentication Methods
User Identity Authentication Methods are authentication mechanisms used to validate their
identities. These mechanisms allow businesses and organisations to keep their networks
secure by permitting only authenticated users to access their protected resources. Some of
the User Identity Authentication Methods are listed is the subsequent section.
2.4.1 Password Authentication Mode
Passwords are the most common methods of authentication and can be in the form of a
string of letters, numbers or special characters. It is the least secure protocol for validating
users, due mostly to its lack of encryption. It is essentially a routine log in process that
requires a username and password combination to access a given system, which validates
the provided credentials.
2.4.2 Smart Card Authentication Method
Smart Card Authentication is a means of verifying users into business resources such as
workstations and applications using a physical card, smart card reader and software on the
workstation. In the case of Smart Card Authentication, your credentials which is your
public and private keys and certificate, are stored on a smart card and can only be used
after the smart card is inserted into the reader and a pin is provided.

9. 2.4.3 Biometric Authentication Mode
Biometric Authentication refers to the security technique that involves the use of special
biological features of individuals such as retinas, irises, voices, facial characteristics and
fingerprints in order to verify people are who they claim to be. The process is used to
control access to physical and digital resources, such as buildings, rooms and different
devices.
2.4.4 Dynamic Password Authentication
Dynamic Password Authentication refers to a technology of the user’s password which
changes in accordance with the time or the count of use constantly, each password only is
used once. The technology using one password once, effectively ensures the safety of the
user identity.
2.5 Message Digest Method 5 (MD 5)
MD 5 is a cryptographic hash function algorithm that takes the message as input any length
and changes it into a fixed resultant output message of 16 bytes (128 bits). MD 5 algorithm
stands for the message- digest algorithm. MD 5 was developed in 1991 by Ronald Riverst.
It is used for file authentication, secure password of online users and can store password in
128 bits format.

10. CHAPTER THREE
METHODOLOGY
This section discusses the sources of data collection, the algorithm design, data analysis
tools and programming language used.
3.1 Sources of Data Collection
Information for this report was sourced from various secondary sources, all listed in the
reference list. Data from publications by the 2013 International Conference on Electronic
Engineering and Computer Science also proved valuable. This report is not a
comprehensive analysis of the available literature but provides a broad overview of the
algorithm.
3.2 Hash Functions Algorithm Design Approach
The methodology or design approach for single- block hash function (MD5 or SHA- 1) is
iterated halving structure. The concept leading to the definition of Iterative Halving (IH) is
done by recalling tight relations between the feed forward mode of iterated hash functions
based on block ciphers, stream ciphers formed by the output feedback (OFB) mode of a
block cipher, cipher block chanting (CBC) mode of message encryption and the key
feedback mode of the key stream generation. Figure 3.1 is an Iterative Halving Technique
Figure 3.1: Iterative Halving Technique
The Iterative Halving process can be seen as a multi- stage compression process. The
number of halving stages required depends on the size of the initial message with padding
and the desired size of the message digest.

11. 3.3 Message Digest 4 Algorithm Design
Single- Block Hash Function, MD5 is a cryptographic hash function algorithm that takes
the message as input any length and changes it into a fixed resultant output message of 16
bytes (128 bits). MD 5 algorithm stands for the message- digest algorithm. MD 5 was
developed in 1991 by Ronald Riverst. It is used for file authentication, secure password of
online users and can store password in 128 bits format.
MD5 algorithm follows the following steps: append padding bits, append length bits,
initialize MD buffer and process each 512- bit block.
3.4 Research Instruments
Research instruments are tools used for data collection and analysis of the study. The
following tools were used in analyzing Message Digest Method 5: flow chart, pseudocode
and python (programming language).
3.4.1 Flow Chart
A flowchart is a generic tool that is used to separate steps of a process in sequential order.
It has been adapted for a wide variety of purposes and can be used to describe various
processes.
3.4.2 Pseudocode
Pseudocode is meant only as a tool to help expedite the development process and defining
all inputs, outputs and interactions needed to effectively solve a problem. It should not add
another layer of complexity to the process.
3.4.3 Python
Python is the most efficient cross- platform tool, specifically programming language used
for artificial intelligence and machine learning solutions.
3.4.4 American Standard Code for Information Interchange (ASCII)
ASCII abbreviated from American Standard Code for Information Interchange, is
a character encoding standard for electronic communication. ASCII codes represent text in
computers, telecommunications equipment, and other devices. Because of technical
limitations of computer systems at the time it was invented, ASCII has just 128 code points,
of which only 95 are printable characters, which severely limited its scope.

12. CHAPTER FOUR
RESULTS AND DISCUSSION
This section of the report presents the findings of the study whose purpose is to analyse
web security password authentication which is based on single- block hash function,
published in the 2013 International Conference on Electronic Engineering and Computer
Science. The presentation of findings aligns with the objectives of the research report.
Analysis of the Figure 1 of the study as published by the authors shows that the algorithm
is Message Digest 5 (MD 5), and therefore, flowchart, ASCII (American Standard Code
for Information Interchange), pseudocode and python would be used in its evaluation.
4.1Performance and Running Time of MD 5
Figure 4.1: A Flow Chart of MD 5
The flow chart above is Message Digest Method 5. In the first place, append padding bits
in such a way that the total length of the message is 64 bits less than the exact multiple of
512 (64 bits less than an exact multiple of 512; 512*3 = 1536).
Secondly, add length bit in the output of the first step in such a way that the total number
of bits is the perfect multiple of 512. Subsequently, you initialize MD buffer and the size
of each buffer is 32 bits. Furthermore, process each 512- bit block.

13. A total of 64 operations will be performed in 4 stages and each stage will undergo 16
iterations. We perform OR, AND, XOR, and NOT (basically these are logic gates) for
calculating functions. After performing all 64 operations we will get our Message Digest
with the output starting with the lower bit and ending with higher bits.
The above addresses our first objective, and thus, in terms of performance and time
complexity of MD 5 Algorithm, it is considered relatively fast and efficient than the
traditional password but slower than modern hash functions. It performs a series of bitwise
operations, logical functions and modular additions to process the input data. The time
complexity of MD 5 is O(n), where n represents the size of the input data.
4.2 Avalanche Effect: Smallest Changes in the Input makes a big difference in the
Coded Text Output in ASCII
In cryptography, the avalanche effect is a term associated with specific behaviour of
mathematical functions used for encryption and it indicates that a slight change in either
the key or the plain- text should result in a significant change in the cipher- text. The
following demonstrates a 43-byte ASCII input and the corresponding MD5 hash:
Figure 4.2: Character Set of ASCII

14. First scenario, the statement "The quick brown fox jumps over the lazy dog" in ASCII input
gives us an MD 5 hash of 9e107d9d372bb6826bd81d3542a419d6.
Another similar statement, “The quick brown fox jumps over the lazy dog.” In ASCII input
gives us an MD 5 hash of e4d909c290d0fb1ca068ffaddf22cbd0
The above statements are almost the same except that the second one had a full stop. And
this slight changes made a big difference in the result coded text output. This addresses the
second objective which talks about avalanche effect in MD 5; even a small change in the
message will result in a mostly different hash.
4.3 Attacks or Collision Resistance of MD 5 in Python
The shortest collision used at least two MD5 blocks worth of 128 bytes of input
(approximately 1024 bits). A prefix in the first block can be chosen arbitrarily by the
attacker, the rest would be computed and appear as gibberish. A typical scenerio of two
different colliding inputs using Python:
>>> from array import array
>>> from hashlib import md5
>>> input1 = array('I', [0x6165300e,0x87a79a55,0xf7c60bd0,0x34febd0b,0x6503cf04,
0x854f709e,0xfb0fc034,0x874c9c65,0x2f94cc40,0x15a12deb,0x5c15f4a3,0x490786bb,
0x6d658673,0xa4341f7d,0x8fd75920,0xefd18d5a])
>>> input2 = array ('I', [x^y for x,y in zip(input1,
[0, 0, 0, 0, 0, 1<<10, 0, 0, 0, 0, 1<<31, 0, 0, 0, 0, 0])])
>>> input1 == input2
False
>>> md5(input1).hexdigest()
'cee9a457e790cf20d4bdaa6d69f01e41'
>>> md5(input2).hexdigest()
'cee9a457e790cf20d4bdaa6d69f01e41'
The above indicates that MD 5 has a weak collision resistance as the result out for the
two different inputs are the same. MD 5 is therefore not recommended for encryption.
Nevertheless, it can withstand tamper with and replay in online businesses.

15. CHAPTER FIVE
SUMMARY OF FINDINGS, CONCLUSION AND RECOMMENDATIONS
The purpose of this report was to analyze web security password authentication based on
single- block hash function which was presented at the 2013 International Conference on
Electronic Engineering and Computer Science. This section presents the summary of the
major findings from the analyses of data, and then, make recommendations and conclusion.
5.1 Summary of Major Findings
In the first place, the flow chart in figure 1 of the studies revealed that the algorithm is
Message Digest Method 5 (MD 5). The MD 5 is a cryptographic hash function algorithm
that takes a variable message as input and changes it into a fixed resultant output message
of 128 bits. The MD 5 appends padding bits, appends length bits, initialize MD buffer and
process each 512- bit block.
Secondly, the study revealed that Single- Block Hash Function, specifically MD 5 could
resist replay attacks, eavesdropping, modification of messages and common attacks, and
low cost, high efficiency, satisfying security and efficient needs of structural features for
identifiable authentication in the network service as compared to the traditional password
authentication or digital signature in the Web user’s identity authentication. However,
single- block hash function, MD 5 has a weak collision resistance to modern attacks and
it’s therefore not recommended for encryption.
Moreover, the study revealed that the time complexity of Single- Block Hash Function,
specifically MD 5 is O(n), where n represents the size of the input data. The running time
is therefore considered relatively fast and efficient than the traditional password but slower
than the modern hash functions.
Furthermore, in single- block hash function, specifically MD 5, slight changes made in the
plain text or variable text input makes a big difference in the coded text output. This is
called Avalanche Effect.

16. 5.2 Recommendations
Based on the various findings, the following recommendations have been made to the
study:
i. The Single- Block Hash Function should be used to solve deficiencies in the
traditional username- password and not applied to modern user identity
authentication.
ii. I propose an authentication protocol with higher security and ideal for high-
performance systems like routers in the modern user identity authentication called
High- based Message Authentication Code and Secure Hash Algorithm 256
(HMAC SHA 256)
5.3 Conclusion
In conclusion, the Single- Block Hash Function Algorithm is relatively faster and resist
replay attacks than the traditional username- password, but weaker and slower collision
resistance to modern attacks and modern hash functions respectively. It is therefore not
recommended for encryption.

17. REFERENCE
Bukstein, Ed. (1964). "Binary Computer Codes and ASCII". Electronics
World. 72 (1): 28–29. Archived from the original on 2016-03-03. Retrieved 2016-05-22.
Chang C. and Wu L. (1990). A New Password Authentication Scheme. Journal of
Information Science and Engineering,6(2):139-147
Cheng T. (2005). The identity authentication technology and application of gossip.
Computer Security.
Cohut I.P., (2005), „AplicaĠiile Internetului în comerĠ – aspecte ale comerĠului
electronic în România”, articol publicat în cadrul conferinĠei internaĠionale „ComerĠ úi
competitivitate” organizată de ASE Bucureúti
https://www.techtarget.com/searchsecurity/definition/authentication
https://www.techtarget.com/whatis/definition/logic-gate-AND-OR-XOR-NOT-
NAND-NOR-and-XNOR
Li-bo D. (2008). Research and Design in Password Authentication and Protection
base on Web-servers. Huazhong University of Science & Technology Master’s.8-24
Wan-dong C. (2004) Network and Information Security. Version 1. XiAn: The
Northwest Industry University Press, 170-195.
www.ibm.com/e-business (accessed September 2000)
Zheng Hu (2006). Network and Information Security. Beijing: Tsinghua University
Press. 200- 212