# Utilizing Trusted Lightweight Ciphers To Support Electronic-Commerce Transaction Cryptography
## 5 Security and Performance of Proposed E-Commerce Applications
### Attacks Analysis on Our Protocol  
The security analysis of a range of e-commerce attacks is summarized as follows (Table 3 provides a comparison of cryptographic protocols in terms of blocking attacks within the scope of this research):  
* **DDoS** An attacker tries to stop all the services provided by the servers and makes them unavailable to the customers/buyers/sellers, and the goal is to prevent user requests from being fulfilled by servers in e-commerce applications, whether buying or selling or e-commerce payment operations. DDoS attacks are more perilous than DoS attacks, and the reason is that DDoS uses several different systems to attack from multiple locations, which makes the impact of stopping the network bigger and faster. In addition, it is difficult to track. Moreover, e-commerce applications deal with sensitive information, and any delay or blocking of user requests can cause economic disasters. Preventing these attacks completely is very difficult. However, limiting its impact and mitigating its severity are crucial. Our protocol uses a small token inside \(Salt_{e}\) that proves the legitimacy of the connected device. This process is inexpensive to perform \((Salt_{i}\oplus Pu_{k})\). Thus, our protocol is able to mitigate the risk of DDoS attacks. * **Phishing** An attacker tries to penetrate the personal information (usernames, passwords and credit card) of the buyers or sellers or to penetrate the information of requests or the information of a company or institution that is sensitive and important in e-commerce applications. Phishing attacks rely on mined links or malicious malware to steal confidential information. Our protocol does not allow e-commerce applications to transmit or send links between users (buyers and sellers). Even if a user downloads malware without knowing it or accidentally clicks on a link in other programs, the malware or the attacker will not receive clear and useful information about that user. In addition, _PW_ is not stored on users' machines. Therefore, our protocol repels phishing attacks. * **Wiretapping** An unauthorized intruder or attacker tries to access the company's or user's data by eavesdropping on purchase and sale requests between the buyer/seller and the servers by revealing and analyzing the transmitted request. This attack is resisted using a request information encryption (\(Enc_{R_{i}}(R_{i}||Salt_{i})\) process) based on the AES 256 algorithm. These requests can be decrypted with only their private and public key. Process breaking the encryption is impossible because the buying/selling request data are hidden. * **Brute force** In this attack, the attacker tries to access confidential information such as _PW_, \(Pr_{k}\) and \(Pu_{k}\) in e-commerce applications. This attack relies on trial and error to gain access to the _PW_ or login credentials. Our protocol does not transmit any confidential information in the encryption and decryption procedures. For example, \(Enc_{R_{i}}||Salt_{e}\) does not contain any explicit secret parameters (see Algorithms 2 and 3). No matter how hard the attacker tries to hack/crack _PW_, \(Pr_{k}\) and \(Pu_{k}\), it is not possible because it is not transmitted through the unsecured channel. Additionally, _PW_ is not stored on network devices. Moreover, _PW_ is selected according to strict security criteria (such as uppercase and lowercase letters, symbols, etc.). As a result, our protocol is able to completely prevent brute force attacks. * **Distributed guessing for electronic payment** The guesser's probability of succeeding on a randomly chosen key depends on the probability of guessing _PW_. The guesser attempts to capture the packet passing from the sender to the receiver in order to decrypt it using a single guess or distributed multiple guesses. An attacker can use distributed guesses to reveal secret parameters if they are sent explicitly, use _PW_ as an encryption key, or use weak security measures. In addition, the guesser uses a large number of guesses to make this attack more effective.