MODIFICATION ADVANCED ENCRYPTION STANDARD (AES) ALGORITHM WITH PERFECT STRICT AVALANCHE CRITERION S-BOX

The Advanced Encryption Standard or better known as the AES Algorithm is a standard algorithm and has been widely used as an application of cryptography. Currently, a lot of research is developing about attacks on the AES algorithm. Therefore, there have been many studies related to modifications to the AES algorithm with the aim of increasing the security of the algorithm and to produce alternatives to encryption algorithms that can be used to secure data. In this study, modifications were made to the AES algorithm by replacing the S-box using the perfect SAC S-box in the SubBytes process. The Perfect SAC S-box has an exact SAC average value of 0.5. The S-box that will be used must have good security strength, therefore the perfect SAC S-box is tested, namely the AC, SAC, BIC, XOR Table Distribution, and LAT Distribution tests. Based on the results of the study, it was found that the perfect SAC S-box had almost the same S-box test results as the AES S-box. Furthermore, after the perfect SAC S-box is applied to the AES algorithm, it is analyzed how the effect of these modifications on the AES algorithm uses randomness testing for the block cipher algorithm, namely the strict avalanche criterion (SAC) test. The results of the AES test with perfect SAC S-box can meet the SAC test since the second round with better results than the original AES algorithm with SAC values of 0.5003 and 0.5019

CRYPTOGRAPHIC PROTOCOL SECURITY IN NATIONAL ENCRYPTION APPLICATIONS

In the era of digital transformation, information exchange, especially confidential and strategic information has become the most vital aspect for almost all organizations. Various bad precedents regarding classified and strategic information leaks in Indonesia have become a slap in the face that must be acknowledge and answered with effective solutions. In 2020, XYZ Agency developed a file encryption application (ABC Application) to address the challenge of securing confidential information, especially those transmitted on electronic channels. Until 2022, the ABC Application has been implemented in a limited scope and its implementation is planned to be expanded nationally. After 2 years of operation, the XYZ Agency has conducted a study on the security of the algorithm used in ABC Application, but unfortunately has not conducted an in-depth study regarding the security of the protocol suite used in the Application. In this research, a security analysis of ABC application protocol suites, namely the registration protocol, user verification, key generation, and key request for the encryption-decryption process protocol was conducted through formal verification approach using the Scyther Tool. The analysis focuses on aspects of guaranteeing confidentiality of information and authentication with four criteria, namely secrecy, aliveness, synchronization, and agreement. The experimental results showed that these protocols meet the security criteria for the transmitted confidential information but have general weaknesses in the authentication aspect, especially for synchronization and agreement criteria. Based on these weaknesses, technical recommendations are proposed that are able to overcome the identified weaknesses

DEVELOPMENT OF PROTECTION PROFILE FOR SECOND-LEVEL E-KTP CARD READER BASED ON ISO/IEC 15408:2022 AND ISO/IEC TS 19608:2018

The second level e-KTP reader device is an electronic data reader device stored in the e-KTP chip by applying a verification device in the form of a fingerprint/face scan. The data stored in the e-KTP chip is personal data that is general and specific, as stated in Law Number 27 of 2022. Therefore, users of e-KTP readers as controllers and processors of personal data are obliged to prevent unauthorised access lawfully by using a security system reliably, safely and responsibly. Permendagri Number 76 of 2020 requires compliance with product standards by involving relevant K/L agencies in the security sector as a form of supervision. Based on BSSN Regulation 15 of 2019, implementing the evaluation process in Indonesia's common criteria scheme requires a Protection Profile document to support the evaluation of IT device security. However, there is no Protection Profile document for e-KTP reader devices that have been certified so that it can be used as a reference in developing IT devices to support the evaluation of IT device security. Therefore, in this study, developing Protection Profiles for e-KTP readers based on ISO/IEC 15408 and ISO/IEC TS 19608: 2018 was carried out to prepare functional security requirements and security guarantees by considering the protection of personal data. While the developing method used is based on ISO/IEC TR 15446:2017. The results of this study are preparing a Protection Profile document consisting of 25 functional security requirements to fulfil 8 device security objectives with a level of security assurance at Evaluation Assurance Level (EAL) 4. Then the design results are tested based on the Assurance Protection Profile Evaluation class (APE) ISO/IEC 18045:2022 and declared to meet the criteria based on the ISO/IEC 15408 series

Analysis of Autopsy Mobile Forensic Tools against Unsent Messages on WhatsApp Messaging Application

This paper discusses the new feature that is implemented in most social media messaging applications: the unsent feature, where the sender can delete the message he sent both in the sender and the recipient devices. This new feature poses a new challenge in mobile forensic, as it could potentially delete sent messages that can be used as evidence without the means to retrieves it. This paper aims to analyze how well the Autopsy open-source mobile forensics tools in extracting and identifying the deleted messages, both that are sent or received. The device used in this paper is a Redmi Xiaomi Note 4, which has its userdata block extracted using linux command, and the application we're using is WhatsApp. Autopsy will analyze the extracted image and see what information can be extracted from the unsent messages. From the result of our experiment, Autopsy is capable of obtaining substantial information, but due to how each vendor and mobile OS store files and databases differently, only WhatsApp data can be extracted from the device. And based on the WhatsApp data analysis, Autopsy is not capable of retrieving the deleted messages. However it can detect the deleted data that is sent from the device. And using sqlite3 database browser, the author can find remnants of received deleted messages from the extracted files by Autopsy

Framework Design for the Retrieval of Instant Messaging in Social Media as Electronic Evidence

The rapid growth of social media features not only brings many advantages but also causes problems. Mainly related to digital evidence when cybercrime occurs. One of the social media features that are currently popular is the unsend message feature in instant messaging applications such as Instagram, Whatsapp, Facebook Messenger, Skype, Viber, and Telegram. In the case of cybercrime, the perpetrator can delete the messages and erase digital evidence, making it difficult to trace. Those artifact messages might be useful for law enforcement or forensic investigators to be used as digital evidence in court. Therefore, an effective and efficient framework is needed in the mobile forensic investigation process to guarantee the integrity of the data obtained. This paper will discuss the review of several international standards on mobile forensics, namely NIST SP 800-101, ISO/ IEC, and SWGDE. This paper also proposes a framework design to retrieve unsend data artifacts on social media according to official and widely used international mobile forensic standards

Performance Comparison of TCP Spoofing and End to End Approach to Enable Partial QoS on IP Based Network

Implementation has a purpose to give adequate guarantee for multimedia application to be able delivered according to the priority and the class of services. But basically, end to end QoS guarantee is very difficult to be realized, especially when it involves a lot of operators with a variety of interconnection networks such as Internet. To overcome that difficulty of implementing end-to-end QoS in IP-based networks, we propose a partial QoS approach through TCP spoofing technique. Partial QoS is implementation of QoS subset like bandwidth parameter in certain ip based network segment. TCP spoofing is a technique to intercept TCP connection between user and content server to be further manipulated. Each TCP connection will be intercepted by spoofing gateway and will be adjusted to the appropriate window size parameter that has been approved for each user. Spoofing Gateway will forward the request from the client to the content server and change the original TCP protocol to TCP Linux Highspeed. Our Simulation results, using NS-2.35, show that for some cases of Partial QoS through spoofing technique produced better performance, such as completion time and average throughput for each user class priority, compared to the end-to-end QoS approach. Even in cases where the Internet network delay product characteristics are relatively high, partial QoS spoofing technique has a much better performance than end-to-end QoS

Comparative Analysis and Design of Cybersecurity Maturity Assessment Methodology Using NIST CSF, COBIT, ISO/IEC 27002 and PCI DSS

Data or Information security in today's digital era is crucial in every organization that needs to pay attention. Management of organizational information is one of the components in realizing Good Corporate Governance. The measure of an adequate level of protection is an indicator of the cybersecurity awareness aspects of an organization's business processes in the short, medium, and long term, especially in the field that deals with information and communication technology (ICT). To make this happen, it requires a security standard that is appropriate and follows its needs to help organizations know the maturity level of cybersecurity in protecting its information security. The ABC organization is one of the Government agencies that manage the critical infrastructure and Indonesian digital economies. The organization has currently implemented several international security standards through its planning, implementation, evaluation document, and ICT activities.  However, based on the national information security readiness assessment, information security management readiness results are still not optimal. In this study, an analysis of the NIST, ISO 27002, COBIT, and PCI DSS security standards has been carried out, which are ABC organizational security standards in managing ICT by assigned tasks and functions. Furthermore, the analysis result is used as materials for drafting a cybersecurity maturity framework through the four standard approaches that have become the basis for ICT management. The proposed concept of twenty-one integrated cybersecurity categories is expected to be a capital in measure ICT management performance in ABC organizations

ANALISIS PROSES PRODUKSI FIBERCEMENT DENGAN PENDEKATAN VALUE STREAM MAPPING: STUDI PADA PT. SETIAJI MANDIRI

has to do an A company improvement continuously if they want to achieve excellence and perfection in their business. For company with manufacturing product can gain the improvement by streamlining the production process into lean manufacturing or waste are eliminated. To view or detect where is the waste or inefficiencies in the process, it can be use a tool such as Value Stream Mapping (VSM). VSM describes working elemen which have added value and have no added value. To view the existing problems we can detail it to make sheet map of the current state with VSM. It can describe where the problem is related to production process. The results of this research to get value added time and non value added time against elemen work. A company can use it to fix the problem of inefficiency in the production process so in order to gain lead time more efficient and effective in the company