Search

Attribute-based encryption (ABE) cryptographically implements fine-grained access control on data. As such, data can be stored by an entity that is not necessarily trusted to enforce access control, or an entity that is not even trusted to have access to the plaintext data at all. Instead, access control can be externally enforced by a trusted entity. Additionally, some multi-authority variants of ABE—which do not have a central authority—can effectively and securely implement access control in multiple-domain settings. Furthermore, ABE is the only cryptographic approach to fine-grained access control that does not require an online trusted third party during access requests, and thus provides better availability properties. The actual realization of these theoretical advantages in practice depends on whether current state-of-the-art ABE schemes support the necessary core properties. Much progress has been made in the last two decades in pairing-based ABE schemes, owing to their versatility and efficiency. In fact, it is possible to support most core properties under strong security guarantees, while incurring acceptable storage and computational costs. It is therefore a good time to ask ourselves whether pairing-based ABE has reached its full practical potential. To answer this question, we provide a comprehensive systematized overview of various existing pairing-based ABE schemes and their core properties. We also investigate the relationship between these core properties and real-world access control requirements. We show that a few challenges remain, that must be overcome for ABE to reach its full potential as a mechanism to implement efficient and secure access control in practice.

The Internet of Things (IoT) has experienced significant growth and is now a fundamental part of the next-generation Internet. Alongside improving daily life, IoT devices generate and collect vast amounts of data that can be leveraged by AI-enabled big data analytics for diverse applications. However, due to the machine-to-machine communication inherent in IoT, ensuring data security and privacy is crucial to mitigate various malicious cyber attacks, including man-in-the-middle, impersonation, and data poisoning attacks. Nevertheless, designing an efficient and adaptable IoT security framework poses challenges due to the limited computational and communication power of IoT devices, as well as their wide-ranging variety. To address these challenges, this paper proposes an Access Key Agreement (AKA) scheme called the “Reliable Device-Access Framework for the Industrial IoT (RDAF-IIoT)”. RDAF-IIoT verifies the user’s authenticity before granting access to real-time information from IIoT devices deployed in an industrial plant. Once authenticated at the gateway node, the user and IIoT device establish a session key for future encrypted communication. The security of the proposed RDAF-IIoT is validated using a random oracle model, while the Scyther tool is employed to assess its resilience against various security attacks. Performance evaluations demonstrate that the proposed scheme requires lower computational and communication costs compared to related security frameworks while providing enhanced security features.

The Industrial Internet of Things (IIoT) provides internet connectivity for instruments, digital machines, and any other manufactured object to enable intelligent industrial operations to achieve high productivity. Securing communications between IIoT devices remains a critical and challenging issue due to the resource-constrained and processing capabilities of sensing devices. Moreover, the traditional group shared key might implement complex mathematical operations that are not suitable for the limited recourse capability of the IIoT device. Furthermore, the standard Diffie–Hellman (DH) and elliptic curve Diffie–Hellman (ECDH), which are the most suited for tiny devices, only work between a pair of IIoT devices, while they are not designed to work among a group of IIoT devices. This paper proposes an authenticated group shared key (AGSK) mechanism that allows a set of industrial objects to establish a common session key over the IIoT. The proposed AGSK utilizes the combiner for the hash function and digital signature, which is implemented in IIoT devices. Additionally, the random oracle model has been used to prove the security of AGSK, while the IIoT adversary model has been used to analyze the AGSK countermeasures against cyberattacks. The results of the performance evaluation showed that the efficiency of the AGSK was reduced by 41.3% for CPU computation time, 45.7% for storage cost, and 40% less power consumption compared to the baseline group key management algorithms.

The subset cover problem for k ≥ 1 hash functions, which can be seen as an extension of the collision problem, was introduced in 2002 by Reyzin and Reyzin to analyse the security of their hash-function based signature scheme HORS. The security of many hash-based signature schemes relies on this problem or a variant of this problem (e.g. HORS, SPHINCS, SPHINCS+, ...). Recently, Yuan, Tibouchi and Abe (2022) introduced a variant to the subset cover problem, called restricted subset cover, and proposed a quantum algorithm for this problem. In this work, we prove that any quantum algorithm needs to make Ω((k+1)^{-(2^k)/(2^{k+1}-1})⋅ N^{(2^{k}-1})/(2^{k+1}-1)}) queries to the underlying hash functions with codomain size N to solve the restricted subset cover problem, which essentially matches the query complexity of the algorithm proposed by Yuan, Tibouchi and Abe. We also analyze the security of the general (r,k)-subset cover problem, which is the underlying problem that implies the unforgeability of HORS under a r-chosen message attack (for r ≥ 1). We prove that a generic quantum algorithm needs to make Ω(N^{k/5}) queries to the underlying hash functions to find a (1,k)-subset cover. We also propose a quantum algorithm that finds a (r,k)-subset cover making O (N^{k/(2+2r)}) queries to the k hash functions., LIPIcs, Vol. 267, 4th Conference on Information-Theoretic Cryptography (ITC 2023), pages 9:1-9:17

Cybersecurity protocols enable several levels of protection against cyberattacks (digital attacks) that spread across network devices, platform programs, and network applications. On the Internet of Things (IoT), cyberattacks are generally intended to access and change/destroy sensitive information, which may reduce IoT benefits. Moreover, recent IoT systems are experiencing a critical challenge in designing a lightweight and robust cybersecurity mechanism on resource-constrained IoT devices. The cybersecurity challenges facing the IoT that should be taken into consideration are identifying compromised devices, data/service protection, and identifying impacted IoT users. This paper proposes an unforgeable digital signature integrated into an effective lightweight encryption (ELCD) mechanism that utilizes the secure key distribution in an elliptic curve Diffie–Hellman (ECDH) and resolves the weak bit problem in the shared secret key due to the Diffie–Hellman exchange. The ELCD mechanism proposes a secure combination between the digital signature and encryption, and it uses fast hash functions to confidentially transfer a shared secret key among IoT devices over an insecure communication channel. Furthermore, the ELCD mechanism checks the true identity of the sender with certainty through the proposed digital signature, which works based on a hash function and three steps of curve-point inspection. Furthermore, the security of ELCD was mathematically proven using the random oracle and IoT adversary models. The findings of the emulation results show the effectiveness of ELCD in terms of CPU execution time, storage cost, and power consumption that are less by 53.8%, 33–17%, and 68.7%, respectively, compared to the baseline cryptographic algorithms.

Internet of Health Things (IoHT) is a hot topic of research presently, which provides a reliable and intelligent healthcare system for monitoring the physical conditions of the patients over the Internet from anywhere and anytime. The ease of time-independent interaction from geographically remote areas is a core advantage of the IoHT system, which offers preventive or proactive healthcare facilities at a lower cost. IoHT communication, on the other hand, is usually carried out with a range of low-power biomedical sensors, rendering them vulnerable to cyber-attacks and incompatible with traditional cryptographic techniques. The most critical security concern in IoHT is ensuring the authenticity of patients’ health-related messages sent over the internet. Other key concerns include receiver anonymity and forward security, which means that only the sender knows the identities of the recipients. As a result, even if the private key of senders compromised, the adversary will be unable to decrypt the ciphertext. Existing signcryption schemes that employ certificateless cryptography for the healthcare system failed to guarantee both receiver anonymity and forward security simultaneously. Therefore, in this article, we propose an anonymous certificateless signcryption scheme for IoHT applications, which is based on the notion of the Hyperelliptic Curve (HEC) cryptosystem to satisfy these security requirements. The proposed scheme guarantees formal security analysis for confidentiality, unforgeability, and receiver anonymity using the Random Oracle Model (ROM). The results authenticate that the proposed scheme improves security while lowering computation and communication costs.

Vehicular ad hoc networks (VANETs) have become increasingly common in the past decades and provides essential and efficient communication for vehicles within intelligent transportation systems. Securing the VANETs wireless communication channel is one of the principal challenges in VANETs since existing security schemes are still vulnerable to security and privacy issues and have substantial computational and communicational overheads. To overcome these issues, this paper focuses on enhancing an authentication scheme based on conditional privacy-preserving and improving its performance efficiency. This paper reviews the security vulnerabilities of the existing schemes. It also proposes enhancements to the identity-based conditional privacy-preserving authentication scheme to secure and improve the efficiency of VANETs communications. The proposed scheme not only satisfies the security and privacy requirements but also has been proven secure under the random oracle model. Finally, the performance evaluation shows that the proposed scheme is more efficient computationally and communicational than the existing schemes in signing and verifying VANETs messages.

Nowadays, it becomes a major issue that has become increasingly prominent to ensure the privacy and security of information. With the wide application of SM9 algorithm in various fields, it is particularly important to improve the security of SM9 algorithm. Therefore, many researchers use the SM9 algorithm for supporting the underlying cryptography. And group signature, ring signature and two-party signature are introduced in succession to design the related scheme with significant effecting. In order to further improve the signature security and promote the promotion of SM9 algorithm. First, the SM9 identification and cipher algorithm is improved by using multi-KGC(Key Generation Center) to generate system parameters to achieve the purpose of improving the security of the key in this paper. Second, a threshold ring signature scheme based on SM9 is proposed by combining SM9 with threshold ring signature. The analysis shows that, compared with the existing schemes, the proposed scheme has more advantages in security, such as higher anonymity, unforgeability and non-repudiation, while resisting malicious user attacks and malicious KGC attacks. This scheme extends SM9 from single user signature to multi-users signature, and increases the application scenarios of SM9, which plays a positive role in the promotion of SM9.

Digital signatures are unsuitable for specific applications that are sensitive on a personal or commercial level because they are universally verifiable. Jakobsson et al. proposed the Designated Verifier Signature (DVS) system, which only allows the intended verifier to validate a message’s signature. It prohibits the disclosure of a conviction to a third party. This functionality is useful in applications that require both authenticity and signer privacy, such as electronic voting and tender calls. The vast majority of current DVS schemes are based on difficult number theory problems such as integer factorization or discrete log problems over various groups. The development of a large-scale quantum computer would render these schemes unsafe. As a result, it is critical to develop quantum-resistant DVS methods. In both quantum and classical computers, signatures based on one-way functions are more efficient and secure. They have several advantages over digital signatures based on trapdoor functions. As a result, hash-based signatures are now considered viable alternatives to number-theoretic signatures. Existing hash-based signatures, on the other hand, are easily verifiable by anyone. As a result, they do not protect the signer’s identity. In addition, they are one-time signatures. This paper presents a hash-based multi-time designated verifier signature scheme that ensures signer anonymity. The unforgeability of the signature scheme is also tested in the random oracle model under chosen message attack. The properties such as non-transferability and non-delegatability are investigated.

In the real world, documents are signed or stamped to prove that they have been approved at the time of contract. In order to play a similar role in electronic documents such as e-mails, there is a digital signature in which a signature is digitized. Electronic documents are easy to impersonate and falsify, and digital signatures are used to prevent them.Schnorr proposed an electronic signature scheme called Schnorr signature. It is considered secure based on the discrete logarithm problem, and its security has been proven by Pointcheval et al. In recent years, due to the simplicity of the system and the robustness of the security, attention has been paid to the proposal of a system applied to the security of virtual currency such as bitcoin.The Schnorr signature generates a random number when the signature is generated. This is secret information that only the signer knows, but if it leaks, the secret key can be easily calculated. In this paper, we propose a Schnorr signature scheme that is secure even if the random numbers are leaked. We also prove that the signature scheme is secure based on the CDH problem.

Related-key attack (RKA) is a kind of side-channel attack considered for kinds of cryptographic primitives, such as public key encryption, digital signature, pseudorandom functions etc. However, we note that the RKA-security seems to be not considered for identity-based signature (IBS), which is an important primitive for identity-based cryptography and proposed by Shamir in 1984. In this paper, for the first time, we introduce the RKA security into IBS schemes and try to define the security model for it. More specifically, we consider the RKA occurs in the users' signing key or the master key of the key-generation center (KGC), which derives two kinds of RKA securities for IBS. Meanwhile, we illustrate that the most efficient Schnorr-like IBS scheme proposed by Galindo and Garcia is RKA-insecure by launching a simple RKA. However, a slight modification of it yields a RKA-secure IBS scheme, for which we give the detailed security proof in the random oracle. Finally, the performance analysis shows that the modified scheme is still extremely efficient but has higher security.

Recently, Vehicle Ad Hoc Networks (VANETs) have been increasingly developed in Intelligent Transportation Systems (ITSs). However, VANETs are vulnerable to security issues because of the open-medium nature of Vehicle-To-Vehicle (V2V) and Vehicle-To-Infrastructure (V2I) communication. Recently, many studies have proposed security schemes to address these issues. However, many of these schemes have massive computational overheads, especially in the process of batch verification method, which verifies multiple messages simultaneously. In this article, a Lightweight Security Without Using Batch Verification Method (LSWBVM) scheme is proposed based on Elliptic Curve Cryptography (ECC). The proposed LSWBVM scheme uses the XOR operation and general hash function during mutual authentication. Meanwhile, to verify a large number of messages, the proposed scheme uses an efficient single verification instead of batch verification in a high traffic density-area. BAN logic proves that the LSWBVM achieves the security goals to mutually authenticate between the nodes. The security analysis indicates that the LSWBVM satisfies the security requirements, such as: identity privacy preserving, tractability and revocability; and secure non-forgery under the random oracle model in an adaptively chosen message attack. The preference evaluation shows that the single verification of proposed LSWBVM is more efficient when compared with batch verification of the related works.

Over the past years, vehicular ad hoc networks (VANETs) have been commonly used in intelligent traffic systems. VANET's design encompasses critical features that include autonomy, distributed networking, and rapidly changing topology. The characteristics of VANET and its implementations for road safety have attracted considerable industry and academia interest, particularly in research involving transport systems enhancement that could potentially save lives. Message broadcasting in an open access system, such as VANET, is the main and utmost challenging problem with regard to security and privacy in VANETs. Various studies on VANET security and privacy have been proposed. Nevertheless, none has considered overall privacy requirements such as unobservability. In order to address these shortcomings, we propose a VANET based privacy-preserving communication scheme (VPPCS), which meets the requirements for content and contextual privacy. It leverages elliptic curve cryptography (ECC) and an identity-based encryption scheme. We have carried out a detailed security analysis (burrows-abadi-needham (BAN) logic, random oracle model, security of proof, and security attributes) to validate and verify the proposed scheme. The analysis has shown that our scheme is secure and also shown to be effective in a performance evaluation. The proposed scheme does not only meet the previously mentioned security and privacy requirements, but also impervious to various types of attacks such as replay, impersonation, modification, and man-in-the-middle attacks.

Wireless medical sensor networks (WMSNs) are playing an increasingly important role in smart healthcare applications. Since the data transmitted in WMSNs is closely related to patient’s life and health, and considering the resource-constrain feature of the sensor node, constructing an authentication scheme for WMSNs is a formidable task. Recently, Soni et al. presented an elliptic curve cryptosystem based three-factor authentication scheme for WMSNs. However, we discover that their scheme suffers from serious vulnerabilities, such as sensor node capture attack, no forward secrecy, and the violation of three-factor security. To enhance the security and efficiency, we present a novel scheme using Rabin cryptosystem and chaotic maps. We use several widely-accepted security analysis methods to verify the correctness and security of our scheme. The Burrows–Abadi–Needham logic proof confirms the completeness of our scheme. The heuristic analysis indicates that our scheme is resistant to potential attacks and provides various security attributes like forward secrecy and three-factor security. Furthermore, we demonstrate that our scheme is provably secure in the random oracle model. Finally, the performance comparisons indicate that our scheme is superior to the related schemes both in security and efficiency and is more applicable to WMSNs owing to low overhead of the sensor node.

Fully homomorphic encryption (FHE) is a form of public-key encryption that allows the computation of arbitrary functions on encrypted data without decrypting the data. As a result, it is a useful tool with numerous applications. Certificateless encryption (CLE) is a type of public-key encryption that combines the advantages of PKI-based public-key encryption with those of identity-based encryption (IBE). Thus, certificateless fully homomorphic encryption (CLFHE) has aroused considerable research interest. Recently, Chen, Hu, and Lian proposed a leveled certificateless homomorphic encryption (CLHE) scheme and proved its semantic security based on the learning with errors ( ${\mathsf {LWE}}$ ) problem in the random oracle model. However, their scheme supports only homomorphic addition, but not homomorphic multiplication. In this work, we construct two leveled CLFHE schemes using the approximate eigenvector method presented by Gentry, Sahai, and Waters. Based on the hardness of the ${\mathsf {LWE}}$ problem, we prove that one scheme satisfies adaptive semantic security and anonymity in the random oracle model, whereas the other satisfies selective semantic security and anonymity in the standard model.

Vehicle Ad hoc Networks (VANETs) are an emergent wireless communication technology that has the potential to reduce the risk of accidents caused by drivers and provide a wide range of entertainment facilities. Because of the nature of VANETs' open-access environment, security attacks can affect the messages broadcast by a vehicle. VANET is therefore vulnerable to security and privacy issues. Recently, many schemes for addressing these problems of VANET have been proposed. However, most of them are affected by massive computation overhead and security issues. In this paper, we propose a scheme named efficient conditional privacy preservation with mutual authentication to address the problems mentioned above in VANET. This scheme depends on the division of geographical areas into a number domains and their distribution, where each domain stores the Certificate Revocation List (CRL) in all Road-side Units (RSUs) located inside the domain. During the mutual authentication phase, the vehicle should authenticate with the TA. After the vehicle obtains a pool of pseudo-identities and the corresponding secret keys from RSU, it is allowed to transmit a message to the other components in the VANET. Because our scheme does not use the bilinear pairing, the performance evaluation shows that our scheme has a lower system cost in terms of computation and communication than other existing methods. Meanwhile, the proposed scheme reduces the computation costs of signing the message and verifying the message by 99.85% and 99.93%, respectively. While the proposed scheme reduces the communication costs of the message size by 13.3%.

The Internet of Things (IoT) is a future trend that uses the Internet to connect a variety of physical things with the cyber world. IoT technology is rapidly evolving, and it will soon have a significant impact on our daily lives. While the growing number of linked IoT devices makes our daily lives easier, it also puts our personal data at risk. In IoT applications, Radio Frequency Identification (RFID) helps in the automatic identification of linked devices, and the dataflow of the system forms a symmetry in communication between the tags and the readers. However, the security and privacy of RFID-tag-connected devices are the key concerns. The communication link is thought to be wireless or insecure, making the RFID system open to several known threats. In order to address these security issues, we propose a robust authentication framework for IoT-based RFID infrastructure. We use formal security analysis in the random oracle model, as well as information analysis to support the claim of secure communication. Regarding the desirable performance characteristics, we describe and analyze the proposed framework’s performance and compare it to similar systems. According to our findings, the proposed framework satisfies all security requirements while also improving the communication.

Existing identity-based schemes utilized in Vehicular Ad hoc Networks (VANETs) rely on roadside units to offer conditional privacy-preservation authentication and are vulnerable to insider attacks. Achieving rapid message signing and verification for authentication is challenging due to complex operations, such as bilinear pairs. This paper proposes a secure pseudonym-based conditional privacy-persevering authentication scheme for communication security in VANETs. The Elliptic Curve Cryptography (ECC) and secure hash cryptographic function were used in the proposed scheme for signing and verifying messages. After a vehicle receives a significant amount of pseudo-IDs and the corresponding signature key from the Trusted Authority (TA), it uses them to sign a message during the broadcasting process. Thus, the proposed scheme requires each vehicle to check all the broadcasting messages received. Besides, in the proposed scheme, the TA can revoke misbehaving vehicles from continuously broadcasting signed messages, thus preventing insider attacks. The security analysis proved that the proposed scheme fulfilled the security requirements, including identity privacy-preservation, message integrity and authenticity, unlinkability, and traceability. The proposed scheme also withstood common security attacks such as man-in-the-middle, impersonation, modification, and replay attacks. Besides, our scheme was resistant against an adaptive chosen-message attack under the random oracle model. Furthermore, our scheme did not employ bilinear pairing operations; therefore, the performance analysis and comparison showed a lower resulting overhead than other identity-based schemes. The computation costs of the message signing, individual signature authentication, and batch signature authentication were reduced by 49%, 33.3%, and 90.2%, respectively.

As a standard digital signature may be verified by anybody, it is unsuitable for personal or economically sensitive applications. The chameleon signature system was presented by Krawczyk and Rabin as a solution to this problem. It is based on a hash then sign model. The chameleon hash function enables the trapdoor information holder to compute a message digest collision. The holder of a chameleon signature is the recipient of a chameleon signature. He could compute collision on the hash value using the trapdoor information. This keeps the recipient from disclosing his conviction to a third party and ensures the privacy of the signature. The majority of the extant chameleon signature methods are built on the computationally infeasible number theory problems, like integer factorization and discrete log. Unfortunately, the construction of quantum computers would be rendered insecure to those schemes. This creates a solid requirement for construct chameleon signatures for the quantum world. Hence, this paper proposes a novel quantum secure chameleon signature scheme based on hash functions. As a hash-based cryptosystem is an essential candidate of a post-quantum cryptosystem, the proposed hash-based chameleon signature scheme would be a promising alternative to the number of theoretic-based methods. Furthermore, the proposed method is key exposure-free and satisfies the security requirements such as semantic security, non-transferability, and unforgeability.

Compact multisignature is vital for shrinking the signature size of decentralized blockchain. All practical compact multisignature schemes have been constructed from the discrete logarithm problem which is potentially vulnerable to quantum computing attacks. Lattice-based multisignature schemes are potential candidates for resisting quantum attacks. However, the existing lattice-based multisignature schemes suffer either loose signatures or large public key and signature sizes after compressing, which makes them unsuitable for blockchains. In this paper, we first present a practical lattice-based multisignature scheme with much smaller signature sizes than previous lattice-based multisignature schemes. Then, we extend our scheme to support public key aggregation with almost the same performance. Both of our multisignature schemes are provably secure in the random oracle model under the ring version of the short integer solution (Ring-SIS) assumption. They outperform the recent lattice-based multisignature scheme proposed by Bansarkhani and Sturm (BS) in terms of both signature size and communication overhead.

A conventional divisible E-cash (DEC) system allows each user to withdraw a coin of value 2n, then spend it in several times by dividing it into small ones of value 2l, for some l ∈ {0, 1, ⋯, n}. Observing that the price of many commodities is not just 2l, it requires to pay more than one coin in a transaction. In order to improve the efficiency of spend protocol, we propose a new construction called arbitrarily DEC (ADEC) which can divide a large coin into several small ones with arbitrarily integer values. We propose a new construction of ADEC based on a public linked list. Using bilinear pairings, we instantiate two ADEC systems: one holds its useful properties in the standard model and the other one in the random oracle model. These two systems allow users to pay for transactions in constant time. Moreover, our construction can be applied to secure the E-commerce of merchant with high volumes of transactions, a merchant can get a result in constant time for depositing a coin and can complete the deposit procedure in a reasonable time, even if he/she deposits massive coins. Our schemes are quite practical for users/merchants using resource-constrained mobile devices.

Deniable authenticated encryption (DAE) is a cryptographic primitive that supports data confidentiality with deniable authentication in an efficient manner. The DAE plays a significant role in location-based service systems for privacy protection. In this paper, we construct a certificateless DAE (CLDAE) scheme. The CLDAE is based on certificateless cryptosystems (CLCs), which avoids the need to manage public key certificates in public key infrastructure (PKI)-based cryptosystems and key escrow problems in identity-based cryptosystems (IBCs). Our design utilizes hybrid methods: tag-key encapsulation mechanism (TKEM) and data encapsulation mechanism (DEM). This technique is more suitable for location-based applications. We show how to construct a CLDAE scheme utilizing a certificateless deniable authenticated tag-KEM (CLDATK) and a DEM. We also design a CLDATK scheme and provide formal security proof using the random oracle model (ROM). We conduct a comprehensive performance analysis, which shows that CLDAE is highly efficient in terms of communication overhead. We also provide an application of the CLDAE for a location-based service (LBS) system.

A ring signature is an anonymous signature that implements both the authentication of the message and the anonymity of the signer. In a “normal” ring signature scheme, the same signer can generate multiple ring signatures, but the verifier cannot find this fact. Linkable ring signature (LRS) solves the problem. In the setting, the identity of the signer is still anonymous, and if the same signer generates multiple ring signatures, the verifier can confirm the fact. Linkable ring signatures are applied to some actual scenarios, such as e-cash, e-voting and ad-hoc network authentication. In this paper, we presented a new identity-based linkable ring signature scheme that avoids certificate management. We then gave the security proofs in the random oracle model (ROM) and compared the efficiency of it with the previous schemes. The new scheme requires only 7 pairing operations in signing and verifying. It is the most efficient linkable ring signature in the identity-based setting.

Multi-Party Non-Interactive Key Exchange (MP-NIKE) is a fundamental cryptographic primitive in which users register into a key generation centre and receive a public/private key pair each. After that, any subset of these users can compute a shared key without any interaction. Nowadays, IoT devices suffer from a high number and large size of messages exchanged in the Key Management Protocol (KMP). To overcome this, an MP-NIKE scheme can eliminate the airtime and latency of messages transferred between IoT devices. MP-NIKE schemes can be realized by using multilinear maps. There are several attempts for constructing multilinear maps based on indistinguishable obfuscation, lattices and the Chinese Remainder Theorem (CRT). Nevertheless, these schemes are inefficient in terms of computation cost and memory overhead. Besides, several attacks have been recently reported against CRT-based and lattice-based multilinear maps. There is only one modular exponentiation-based MP-NIKE scheme in the literature which has been claimed to be both secure and efficient. In this article, we present an attack on this scheme based on the Euclidean algorithm, in which two colluding users can obtain the shared key of any arbitrary subgroup of users. We also propose an efficient and secure MP-NIKE scheme. We show how our proposal is secure in the random oracle model assuming the hardness of the root extraction modulo a composite number., 14 pages, 3 figures

Dynamic group signature (DGS) allows a user to generate a signature on behalf of a group, while preserving anonymity. Although many existing DGS schemes have been proposed in the random oracle model for achieving efficiency, their security proofs require knowledge extractors that cause loose security reductions. In this paper, we first propose a new practical DGS scheme whose security can be proven without knowledge extractors in the random oracle model. Moreover, our scheme can also be proven in the strong security model where an adversary is allowed to generate group managers' keys maliciously. The efficiency of our scheme is comparable to existing secure DGS schemes in the random oracle model using knowledge extractors. The security of our scheme is based on a new complexity assumption that is obtained by generalizing the Pointcheval-Sanders (PS) assumption. Although our generalized PS (GPS) assumption is interactive, we prove that, under the symmetric discrete logarithm (SDL) assumption, the new GPS assumption holds in the algebraic group model.

The security and privacy issues in vehicular ad hoc networks (VANETs) are often addressed with schemes based on either public key infrastructure, group signature, or identity. However, none of these schemes appropriately address the efficient verification of multiple VANET messages in high-density traffic areas. Attackers could obtain sensitive information kept in a tamper-proof device (TPD) by using a side-channel attack. In this paper, we propose an identity-based conditional privacy-preserving authentication scheme that supports a batch verification process for the simultaneous verification of multiple messages by each node. Furthermore, to thwart side-channel attacks, vehicle information in the TPD is periodically and frequently updated. Finally, since the proposed scheme does not utilize the bilinear pairing operation or the Map-To-Point hash function, its performance outperforms other schemes, making it viable for large-scale VANETs deployment.

Document Information Language: English Accession Number: WOS:000527272900046, The on demand availability of resources in Cyber physical system (CPS) has emerged as a viable service providing platform to improve the resource usability and reducing the infrastructure costs. Nevertheless, the development recompenses can only be realized after avoiding security and privacy issues. A secure and reliable CPS can offer improved efficiency, usability and reliability along with autonomy. To secure such systems, in 2018 Challa a al. (2018) proposed a security system to extend an authenticated key agreement between a user and a cloud server via trusted authority; as an application, they also customized their system to work with autonomous smart meter and cloud server. Challa a al. then claimed the security of their proposed scheme through formal, informal and automated validations. However, this paper unveils the weaknesses of their scheme and shows that their scheme cannot facilitate in forming a session key between the user/smart meter and the cloud server. Precisely, in the presence of more than one registered users/smart meters, the latter in their scheme may never receive a response message because of a critical design error. Moreover, their scheme lacks the untraceable anonymity and the lack of request verification on cloud server side may also lead to replay and/or denial of services attack. The article then introduces an improved and secure authentication system free of correctness issues, to facilitate a key agreement between user and cloud server via trusted authority. As an application, the proposed system also works for smart meter and cloud server to reach a key agreement. Based on the hardness assumption of Elliptic Curve Decisional Diffi-Hellman Problem (ECDDHP), the formal Random oracle model proves the security of the proposed scheme. Moreover, the robustness of the scheme is explained through informal analysis. The proposed system while providing all known security features has slightly increased the computation and communication costs as compared with the scheme of Challa a al. The proposed scheme completes a cycle of authentication by exchanging 2080 bits in just 13.4066 ms.

Boneh, Bonneau, Bünz, and Fisch (CRYPTO 2018) recently introduced the notion of a verifiable delay function (VDF). VDFs are functions that take a long sequential time T to compute, but whose outputs y := Eval(x) can be efficiently verified (possibly given a proof π) in time t ≪ T (e.g., t = poly(λ, log T) where λ is the security parameter). The first security requirement on a VDF, called uniqueness, is that no polynomial-time algorithm can find a convincing proof π' that verifies for an input x and a different output y' ≠ y. The second security requirement, called sequentiality, is that no polynomial-time algorithm running in time σ < T for some parameter σ (e.g., σ = T^{1/10}) can compute y, even with poly(T,λ) many parallel processors. Starting from the work of Boneh et al., there are now multiple constructions of VDFs from various algebraic assumptions. In this work, we study whether VDFs can be constructed from ideal hash functions in a black-box way, as modeled in the random oracle model (ROM). In the ROM, we measure the running time by the number of oracle queries and the sequentiality by the number of rounds of oracle queries. We rule out two classes of constructions of VDFs in the ROM: - We show that VDFs satisfying perfect uniqueness (i.e., VDFs where no different convincing solution y' ≠ y exists) cannot be constructed in the ROM. More formally, we give an attacker that finds the solution y in ≈ t rounds of queries, asking only poly(T) queries in total. - We also rule out tight verifiable delay functions in the ROM. Tight verifiable delay functions, recently studied by Döttling, Garg, Malavolta, and Vasudevan (ePrint Report 2019), require sequentiality for σ ≈ T-T^ρ for some constant 0 < ρ < 1. More generally, our lower bound also applies to proofs of sequential work (i.e., VDFs without the uniqueness property), even in the private verification setting, and sequentiality σ > T-(T)/(2t) for a concrete verification time t.

Internet of Vehicles (IoV) is a specialized breed of Vehicular Ad-hoc Networks (VANETs) in which each entity of the system can be connected to the internet. In the provision of potentially vital services, IoV transmits a large amount of confidential data through networks, posing various security and privacy concerns. Moreover, the possibility of cyber-attacks is comparatively higher when data transmission takes place more frequently through various nodes of IoV systems. It is a serious concern for vehicle users, which can sometimes lead to life-threatening situations. The primary security issue in the provision of secure communication services for vehicles is to ensure the credibility of the transmitted message on an open wireless channel. Then, receiver anonymity is another important issue, i.e., only the sender knows the identities of the receivers. To guarantee these security requirements, in this research work, we propose an anonymous certificateless signcryption scheme for IoV on the basis of the Hyperelliptic Curve (HEC). The proposed scheme guarantees formal security analysis under the Random Oracle Model (ROM) for confidentiality, unforgeability, and receiver anonymity. The findings show that the proposed scheme promises better security and reduces the costs of computation and communication.

With the rapid development of the Internet of Things (IoT), it becomes challenging to ensure its security. Identity authentication and integrity verification can be achieved by secure hash functions and digital signature algorithms for IoT applications. In order to solve the issues of bandwidth limitation and computational efficiency of secure communication in IoT applications, an aggregate signature scheme based on multi- trapdoor hash function is proposed in this paper. Firstly, to prevent key exposition, based on the elliptic curve discrete logarithm problem (ECDLP), we constructed a double trapdoor hash function (DTH) and proved its reliability. Secondly, the multi-trapdoor hash function (MTH) based on DTH is presented. Finally, an MTH-based aggregate signature scheme (MTH-AS) with constant signature length is proposed. Based on the assumption of ECDLP, the proposed scheme is proven unforgeable against adaptive chosen message attacks with the Forking Lemma. Different from the most signature schemes with bilinear mapping, the proposed scheme has higher computational efficiency and shorter aggregate signature length. Moreover, it is independent of the number of signers. Security analysis and performance evaluation has revealed that the proposed scheme is an ideal solution for secure IoT applications with limited computing power, storage capacity, or limited bandwidth, such as wireless sensor networks, vehicular ad hoc networks, or healthcare sensor networks.

International audience; In this study, we propose a new method for conversion from a one-way (OW)-secure key encapsulation mechanism (KEM) into a chosen-ciphertext (CCA) secure KEM in the random oracle model. Our conversion method is based on the non-interactive zero-knowledge (NIZK) proof system for proving the relationships (e.g., equality or linearity) of discrete logarithms, where the security analysis of our conversion method depends on the NIZK properties of soundness and zero-knowledge. Our conversion method achieves tight security reduction and it is semi-generic in the sense that other than OW-security, a KEM should be NIZK-compatible. From a theoretical viewpoint, our conversion method can be considered as the corresponding approach for obtaining an efficient signature by applying the Fiat–Shamir transform to the NIZK system. We applied our conversion method to several OW-secure (identity-based) KEMs and compared the results with those obtained by previous methods for achieving CCA security.

With the growth of the urban population, the rapid development of smart cities has become the focus of urban regional development. Smart medical care is an indispensable part of smart city construction, which promotes the development of the medical industry. However, the security of data and timely service are the current problems faced by intelligent medical systems. Based on the public key encryption with filtered equality test and identity-based cryptography, an identity-based encryption with the filtered equality test (IBE-FET) is proposed for smart healthcare, in which a data receiver can use the private key and the message set to generate a warrant and send it to the cloud server. A cloud server can verify the equality between ciphertexts without decryption and check whether the encrypted message belongs to the same message set. Furthermore, the security analysis shows that the proposed scheme satisfies one-way security against the chosen identity and ciphertext attack in the random oracle model under the computational bilinear Diffie-Hellman assumption. The performance comparison shows that the scheme is feasible and practical in real life.

The Fiat-Shamir (FS) transform is a well known and widely used technique to convert any constant-round public-coin honest-verifier zero-knowledge (HVZK) proof or argument system \(\mathsf {HVZK}=(\mathcal {P},\mathcal {V})\) in a non-interactive zero-knowledge (NIZK) argument system

At EUROCRYPT 2016, Meaux et al. introduced a new design strategy for symmetric ciphers for fully homomorphic encryption (FHE), which they dubbed filter permutators. Although less efficient than classical stream ciphers, when used in conjunction with an adequate FHE scheme, they allow constant and small noise growth when homomorphically evaluating decryption circuit. In this article, we present a security proof up to the birthday bound (with respect to the size of the IV and the size of the key space) for this new structure in the random oracle model and in the multi-user setting. In particular, this result justifies the theoretical soundness of filter permutators. We also provide a related-key attack against all instances of FLIP, a stream cipher based on this design.

Non-interactive zero-knowledge (NIZK) proofs for chosen-ciphertext security are generally considered to give an impractical construction. An interesting recent work by Seo, Abdalla, Lee, and Park (Information Sciences, July 2019) proposed an efficient semi-generic conversion method for achieving chosen-ciphertext security based on NIZK proofs in the random oracle model. The recent work by Seo et al. demonstrated that the semi-generic conversion method transforms a one-way (OW)-secure key encapsulation mechanism (KEM) into a chosen-ciphertext secure KEM while preserving tight security reduction. This paper shows that the security analysis of the semi-generic conversion method has a flaw, which comes from the OW security condition of the underlying KEM. Without changing the conversion method, this paper presents a revised security proof under the changed conditions that (1) the underlying KEM must be chosen-plaintext secure in terms of indistinguishability and (2) an NIZK proof derived from the underlying KEM via the Fiat–Shamir transform must have the properties of zero-knowledge and simulation soundness. This work extended the security proof strategy to the case of identity-based KEM (IBKEM) and also revise the security proof for IBKEM of previous method by Seo et al. Finally, this work gives a corrected security proof by applying the new proofs to several existing (IB)KEMs.

Blockchain is a public open ledger that provides data integrity in a distributed manner. It is the underlying technology of cryptocurrencies and an increasing number of related applications, such as smart contracts. The open nature of blockchain together with strong integrity guarantees on the stored data makes it a compelling platform for covert communication. In this paper, we suggest a method of securely embedding covert messages into a blockchain. We formulate a simplified ideal blockchain model based on existing implementations and devise a protocol that enables two parties to covertly communicate through the blockchain following that model. We also formulate a rigorous definition for the security and covertness of such a protocol based on computational indistinguishability. Finally, we show that our method satisfies this definition in the random oracle model for the underlying cryptographic hash function.

The concept of aggregate signcryption was first introduced in 2009 by Selvi et al. [Identity based aggregate signcryption schemes, Lecture Notes in Computer Science 5922 LNCS, 2009, pp. 378–397]. The aggregation process of these schemes reduces the amount of exchanged information and is particularly useful in low-bandwidth communication networks and computationally-restricted environments such as wireless sensor networks. Selvi et al.’s scheme is in the identity-based setting and suffers from the key escrow problem. The goal of this paper is to overcome this problem and propose a suitable security model for aggregate signcryption in the certificateless setting. We further propose a concrete certificateless aggregate signcryption scheme which is based on Barbosa and Farshim’s certificateless signcryption scheme [Certificateless signcryption. In: M. Abe, V. Gligor (Eds.), Proceedings of the 2008 ACM Symposium on Information, Computer and Communications Security (ASIACCS-08), ACM, New York. pp. 369–372]. We then prove the security of the proposed scheme in the random oracle model under the gap Bilinear Diffie–Hellman and computational Diffie–Hellman intractability assumptions.

Recently, the certificateless public key cryptography (CLPKC) has been studied widely since it could solve both of the certificate management problem in traditional public key cryptography (TPKC) and the key escrow problem in the identity-based public key cryptography (ID-based PKC). To satisfy requirements of different applications, many certificateless blind signature (CLBS) schemes using bilinear pairing for the CLPKC setting have been proposed. However, the bilinear pairing operation is very complicated. Therefore, the performance of those CLBS schemes is not very satisfactory. To solve the problem, we propose an efficient CLBS scheme without bilinear pairing. Performance analysis shows that the proposed scheme could reduce costs of computation and storage. Security analysis shows the proposed scheme is provably secure against both of two types of adversaries. Recentemente, a criptografia de chave pública sem certificado (CLPKC) tem sido amplamente estudada, uma vez que poderia resolver o problema de gerenciamento de certificados na criptografia de chave pública tradicional (TPKC) e o problema chave de escrow da criptografia de chave pública baseada em identidade (ID-based PKC). Para atender aos requisitos de diferentes aplicações, têm sido propostos muitos sistemas de assinatura cega sem certificado (CLBs), sistemas que utilizam o emparelhamento bilinear para a configuração de CLPKC. No entanto, a operação de emparelhamento bilinear é muito complicada. Portanto, o desempenho desses regimes CLBs não é muito satisfatório. Para resolver o problema, propomos um esquema de CLBS eficiente sem emparelhamento bilinear. Uma análise de desempenho mostra que o esquema proposto poderia reduzir os custos de computação e armazenamento. Uma análise de segurança mostra que o esquema proposto é comprovadamente seguro contra dois tipos de adversários.

In this paper, we divide large-scale resource-constrained WSN nodes into several domains, split cryptographic operations into heavy operations and the fast lightweight operations, and present an efficient multi-PKG online/offline identity-based encryption scheme for multi-domain WSN. Most heavy computations such as pairing or exponentiation are done in the offline phase for pre-computation without the receiver's identity or the knowledge of the plaintext. Most fast lightweight operations are done in the online phase, together with the plaintext and the receiver's identity. The online encryption is extremely efficient and easy to be implemented on sensor node. We prove the security of our new scheme in the random oracle model. Compared with the existing schemes, our new scheme is more secure and efficient, which is suitable for multi-domain WSN.

Ring Signcryption is used to provide a graceful way to leak trustworthy secrets in an anonymous, authenticated and confidential way. To the best of our knowledge, seven identity based ring signcryption schemes were reported in the literature. In this paper, we show that five of them are insecure in one or the other way. We then propose a new scheme and formally prove its security properties. A comparison of our scheme with the only existing secure scheme by Huang et al. shows that our scheme is more efficient than the scheme by Huang et al.

Password-based group key agreement protocols are fundamental component of the communications systems. In 2009, Zheng et al. proposed an efficient and provably secure password-based agreement protocol and declared their protocol is secure in the ideal-cipher and random oracle models under the DDH problem. In this paper, we propose an online dictionary attack against Zheng et al.’ protocol, which an adversary can test more than one password in a session. If the number of users is few, this attack can not lead to security problem. However, if many users participate in this protocol, the security problem can not be ignored.

Distributed Computing and Networking, The state-of-the-art telecommunication technologies have widely been adapted for sensing the traffic related information and collection of it. Vehicular Ad-Hoc Networks (VANETs) have emerged as a novel technology for revolutionizing the driving experiences of human. The most effective and widely recognized way for mutual authentication among entities in VANETs is digital signature scheme. The new and attractive paradigm which eliminates the use of certificates in public key cryptography and solves the key escrow problem in identity based cryptography is certificateless cryptography. A new certificateless aggregate signature scheme is proposed in the paper for VANETs with constant pairing computations. Assuming the hardness of computational Diffie-Hellman Problem, the scheme is proved to be existentially unforgeable in the random oracle model against adaptive chosen-message attacks.

One of the main lines of research in functional encryption FE has consisted in studying the security notions for FE and their achievability. This study was initiated by [Boneh et al. --- TCC'11, O'Neilli¾?--- ePrint'10] where it was first shown that for FE the indistinguishability-based IND security notion is not sufficient in the sense that there are FE schemes that are provably IND-Secure but concretely insecure. For this reason, researchers investigated the achievability of Simulation-based SIM security, a stronger notion of security. Unfortunately, the above-mentioned works and others [e.g., Agrawal et al. --- CRYPTO'13] have shown strong impossibility results for SIM-Security. One way to overcome these impossibility results was first suggested in the work of Boneh et al. where it was shown how to construct, in the Random Oracle RO model, SIM-Secure FE for restricted functionalities and was asked the generalization to more complex functionalities as a challenging problem in the area. Subsequently, [De Caro et al. --- CRYPTO'13] proposed a candidate construction of SIM-Secure FE for all circuits in the RO model assuming the existence of an IND-Secure FE scheme for circuits with RO gates. To our knowledge there are no proposed candidate IND-Secure FE schemes for circuits with RO gates and they seem unlikely to exist. We propose the first constructions of SIM-Secure FE schemes in the RO model that overcome the current impossibility results in different settings. We can do that because we resort to the two following models:In the public-key setting we assume a bound on the number of queries but this bound only affects the running-times of our encryption and decryption procedures. We stress that our FE schemes in this model are SIM-Secure and have ciphertexts and tokens of constant-size, whereas in the standard model, the current SIM-Secure FE schemes for general functionalities [De Caro et al., Gorbunov et al. --- CRYPTO'12] have ciphertexts and tokens of size growing as the number of queries.In the symmetric-key setting we assume a timestamp on both ciphertexts and tokens. In this model, we provide FE schemes with short ciphertexts and tokens that are SIM-Secure against adversaries asking an unbounded number of queries. Both results also assume the RO model, but not functionalities with RO gates and rely on extractability obfuscation [Boyle et al. --- TCC'14] and other standard primitives secure only in the standard model.

Part 9: Various Aspects of Computer Security; International audience; Certificate-based encryption (CBE) combines traditional public-key encryption and certificateless encryption. However, it does suffer to the Denial of Decryption (DoD) attack called by Liu and Au. To capture this attack, they introduced a new paradigm called self-generated-certificate public key cryptography. In this paper we show that the problem of DoD attack can be solved with a new implicit and explicit certificates-based public key cryptography paradigm. More importantly, we propose a concrete implicit and explicit certificate-based encryption (IE-CBE) scheme that defends against DoD attack. This new scheme is enhanced version of CBE scheme and preserves all its advantages, i.e., every user is given by the trusted authority an implicit certificate as a part of a private key and generates his own secret key and corresponding public key. In addition, in the IE-CBE scheme trusted authority has to generate an explicit certificate for a user with some identity and a public key. We prove that our scheme is IND-CCA2− and DoD-Free secure in the random oracle model as hard is to solve p-BDHI and k-CCA problems.

In 1993, Zheng and Seberry proposed three methods for strengthening public key cryptosystems. These methods aimed to obtain schemes that are secure against adaptively chosen ciphertext attacks. One method was improving security by using digital signatures. Zheng and Seberry gave an example scheme that employs this method. However, they were not able to prove 1ND-CCA security of their cryptosystem. In this paper, we modify this cryptosystem by employing a Schnorr signature scheme and prove this new scheme to be IND-CCA secure in the random oracle model. (C) 2013 Elsevier B.V. All rights reserved.

Proofs of computational effort were devised to control denial of service attacks. Dwork and Naor (CRYPTO ’92), for example, proposed to use such proofs to discourage spam. The idea is to couple each email message with a proof of work that demonstrates the sender performed some computational task. A proof of work can be either CPU-bound or memory-bound. In a CPU-bound proof, the prover must compute a CPU-intensive function that is easy to check by the verifier. A memory-bound proof, instead, forces the prover to access the main memory several times, effectively replacing CPU cycles with memory accesses.

Side-channel attacks are a major issue for implementation of secure cryptographic schemes. Among these, key-leakage attacks describe a scenario in which an adversary is allowed to learn arbitrary information about the private key, the only constraint being the number of bits learned. In this work, we study key-leakage resilience according to the model presented by Akavia, Goldwasser and Vaikuntanathan at TCC ’09. As our main contribution, we present a code-based hash proof system; we obtain our construction by relaxing some of the requirements from the original definition of Cramer and Shoup. We then propose a leakage-resilient public-key encryption scheme that makes use of this hash proof system. To do so, we adapt a framework featured in a previous work by Alwen et al. regarding identity-based encryption (EUROCRYPT ’10). Our construction features error-correcting codes as a technical tool, and, as opposed to previous work, does not require the use of a randomness extractor.

In this thesis we consider different problems related to provable security and indifferentiability framework. Ideal primitives such as random oracles, ideal ciphers are theoretical abstractions of cryptographic hash functions and block ciphers respectively. These idealized models help us to argue security guarantee for various cryptographic schemes, for which standard model security proofs are not known. In the first part of this thesis we consider the problems related to ideal primitive construction starting from a different ideal primitive. We adopt the indifferentiability framework proposed by Maurer et. al. in TCC’04 for this purpose. The indifferentiability framework helps us to preserve the security guarantee of cryptographic schemes when the ideal primitives are replaced by indifferentiable constructions, even when the ideal primitives are used in a public manner. At first, we consider the problem of ideal cipher domain extension. We show the 3-round Feistel construction, built using n-bit ideal ciphers are actually indifferentiable from a 2n-bit ideal cipher. We also consider other related issues such as, why 2-round Feistel is not sufficient, security analysis in standard indistinguishability model for both 2 and 3 round constructions, etc. Afterwards, we consider the open problem: whether 6-round Feistel construction using random round functions is indifferentiable from a random invertible permutation or not. We give a partial positive answer to this question. We show the construction is actually publicly-indifferentiable (which is a restricted version of full indifferentiability) from an in- vertible random permutation. In the later part of the thesis, we concentrate on some issues related to the security of Probabilistic Signature Scheme (PSS). PSS with RSA trapdoor is a widely deployed randomized signature scheme. It is known to be secure in Random Oracle model. However, recently randomized signature scheme such as iso/iec 9796-2 is shown to be susceptible to hardware fault attacks. In this work we show, PSS is actually secure against random fault attacks in random oracle model. Afterwards, we consider the openproblem related to standard model security of PSS. We give a general negative result in this direction. We rule out existence of any black box proof technique showing security of PSS in standard model.