Search

Global Mobility Networks(GLOMONETs) in wireless communication permits the global roaming services that enable a user to leverage the mobile services in any foreign country. Technological growth in wireless communication is also accompanied by new security threats and challenges. A threat-proof authentication protocol in wireless communication may overcome the security flaws by allowing only legitimate users to access a particular service. Recently, Lee et al. found Mun et al. scheme vulnerable to different attacks and proposed an advanced secure scheme to overcome the security flaws. However, this article points out that Lee et al. scheme lacks user anonymity, inefficient user authentication, vulnerable to replay and DoS attacks and Lack of local password verification. Furthermore, this article presents a more robust anonymous authentication scheme to handle the threats and challenges found in Lee et al.’s protocol. The proposed protocol is formally verified with an automated tool(ProVerif). The proposed protocol has superior efficiency in comparison to the existing protocols. [ABSTRACT FROM AUTHOR]

In a multi-server authentication environment, a user only needs to register once at a central registration place before accessing the different services on the different registered servers. Both, from a user point of view as for the management and maintenance of the infrastructure, these types of environments become more and more popular. Smartcard- or smartphone-based approaches lead to more secure systems because they offer two- or three-factor authentication, based on the strict combination of the user’s password, the user’s biometrics and the possession of the device. In this paper, we propose an efficient anonymous authentication protocol in multiple server communication networks, called the EAAM protocol, which is able to establish user anonymity, mutual authentication, and resistance against known security attacks. The novelty of the proposed scheme is that it does not require a secure channel during the registration between the user and the registration center and is resistant to a curious but honest registration system. These features are established in a highly efficient way with the minimum amount of communication flows between user and server during the establishment of the secret shared key and by using light-weight cryptographic techniques such as Chebyshev chaotic map techniques and symmetric key cryptography. The performance and security of the protocol are analyzed and compared with the latest new proposals in this field. [ABSTRACT FROM AUTHOR]

Authenticated key exchange protocols represent an important cryptographic mechanism that enables several parties to communicate securely over an open network. Elashry, Mu, and Susilo proposed an identity-based authenticated key exchange (IBAKE) protocol where different parties establish secure communication by means of their public identities.The authors also introduced a new security notion for IBAKE protocols called resiliency, that is, if the secret shared key is compromised, the entities can generate another shared secret key without establishing a new session between them. They then claimed that their IBAKE protocol satisfies this security notion. We analyze the security of their protocol and prove that it has a major security flaw, which renders it insecure against an impersonation attack. We also disprove the resiliency property of their scheme by proposing an attack where an adversary can compute any shared secret key if just one secret bit is leaked. [ABSTRACT FROM AUTHOR]

Card-based cryptographic protocols can perform secure computation of Boolean functions. In 2013, Cheung et al. presented a protocol that securely produces a hidden AND value using five cards; however, it fails with a probability of 1/2. The protocol uses an unconventional shuffle operation called an unequal division shuffle; after a sequence of five cards is divided into a two-card portion and a three-card portion, these two portions are randomly switched so that nobody knows which is which. In this paper, we first show that the protocol proposed by Cheung et al. securely produces not only a hidden AND value but also a hidden OR value (with a probability of 1/2). We then modify their protocol such that, even when it fails, we can still evaluate the AND value in the clear. Furthermore, we present two five-card copy protocols (which can duplicate a hidden value) using unequal division shuffle. Because the most efficient copy protocol currently known requires six cards, our new protocols improve upon the existing results. We also design a general copy protocol that produces multiple copies using an unequal division shuffle. Furthermore, we show feasible implementations of unequal division shuffles by the use of card cases. [ABSTRACT FROM AUTHOR]

Recently group-oriented applications over unsecure open networks such as Internet or wireless networks have become very popular. Thus, group communication security over unsecure open networks has become a vital concern. Group key establishment (GKE) protocols are used to satisfy the confidentiality requirement of a newly started communication session by the generation or sharing of an ephemeral common key between the group members. In this study, we analyze the computation and communication efficiency of GKE protocols. Besides confidentiality, the security characteristics of identification and integrity control are also required for all steps of the protocol implementations. Thus, the main contribution of this work is to provide the computation and communication efficiency analysis of the same GKE protocols along with the identification of the group entities and integrity control of messages during the protocol steps. The specific implementation and analysis of GKE protocols are performed by group key agreement (GKA) with pairing-based cryptography and group key distribution (GKD) with verifiable secret sharing, respectively. Finally, a comparison of GKA and GKD protocols on the basis of their strong points and cost characteristics are also provided to inform potential users. [ABSTRACT FROM AUTHOR]

In large-scale distributed systems, where adversarial attacks have extensive impact, authentication provides fortification against threats involving impersonation of entities and tampering of data. Towards this, we introduce the first tetrahedron (three-dimensional (3D)) based two-server Password Authenticated and Key Exchange (PAKE) protocol to represent text passwords. A 3D PAKE protocol is a hybrid cryptographic algorithm that requires two servers for authentication; one server engages with users and the other is hidden from the clients. A remarkable aspect of the proposed 3D PAKE protocol is that reclaiming password from the stored credentials is not possible when either one/both the servers gets compromised. In this paper, we discuss the properties of tetrahedron that mesh well with Diffie–Hellman key exchange protocol and elliptic curve cryptography encryption scheme and proved that the protocol is resistant against cryptographic attacks without the involvement of public key infrastructure. The proposed protocol is the first provably secure two-server PAKE protocol against an offline dictionary attack. [ABSTRACT FROM PUBLISHER]

Duplicate address detection (DAD) is an important component of the address resolution protocol (ARP) and the neighbor discovery protocol (NDP). DAD determines whether an IP address is in conflict with other nodes. In traditional DAD, the target address to be detected is broadcast through the network, which provides convenience for malicious nodes to attack. A malicious node can send a spoofing reply to prevent the address configuration of a normal node, and thus, a denial-of-service attack is launched. This study proposes a hash method to hide the target address in DAD, which prevents an attack node from launching destination attacks. If the address of a normal node is identical to the detection address, then its hash value should be the same as the “Hash_64” field in the neighboring solicitation message. Consequently, DAD can be successfully completed. This process is called DAD-h. Simulation results indicate that address configuration using DAD-h has a considerably higher success rate when under attack compared with traditional DAD. Comparative analysis shows that DAD-h does not require third-party devices and considerable computing resources; it also provides a lightweight security resolution. [ABSTRACT FROM AUTHOR]

The SMEN protocol, proposed by Wu and Ustaoglu in 2009, has been considered to be secure as the authors claimed, and numerous theories are proposed based on this protocol. This paper analyzes the SMEN protocol and finds that this protocol is not resistant to the session corruption attack and the key compromise impersonation attack. Then, we propose an improved protocol with tight security reduction. Our improved protocol not only avoids the above attacks but also embraces the same efficiency as the SMEN protocol in terms of exponentiation. Besides, formal analysis of the improved protocol is presented by using the formal automatic security analysis tool Scyther. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

This article introduces a definition of privacy for Direct Anonymous Attestation schemes. The definition is expressed as an equivalence property which is suited to automated reasoning using Blanchet's ProVerif. The practicality of the definition is demonstrated by analysing the RSA-based Direct Anonymous Attestation protocol by Brickell, Camenisch & Chen. The analysis discovers a vulnerability in the RSA-based scheme which can be exploited by a passive adversary and, under weaker assumptions, corrupt issuers and verifiers. A security fix is identified and the revised protocol is shown to satisfy our definition of privacy. [ABSTRACT FROM AUTHOR]

We introduce the concept of cryptographic reduction, in analogy with a similar concept in computational complexity theory. In this framework, class A of crypto-protocols reduces to protocol class B in a scenario X, if for every instance a of A, there is an instance b of B and a secure transformation X that reproduces a given b, such that the security of b guarantees the security of a. Here we employ this reductive framework to study the relationship between security in quantum key distribution (QKD) and quantum secure direct communication (QSDC). We show that replacing the streaming of independent qubits in a QKD scheme by block encoding and transmission (permuting the order of particles block by block) of qubits, we can construct a QSDC scheme. This forms the basis for the block reduction from a QSDC class of protocols to a QKD class of protocols, whereby if the latter is secure, then so is the former. Conversely, given a secure QSDC protocol, we can of course construct a secure QKD scheme by transmitting a random key as the direct message. Then the QKD class of protocols is secure, assuming the security of the QSDC class which it is built from. We refer to this method of deduction of security for this class of QKD protocols, as key reduction. Finally, we propose an orthogonal-state-based deterministic key distribution (KD) protocol which is secure in some local post-quantum theories. Its security arises neither from geographic splitting of a code state nor from Heisenberg uncertainty, but from post-measurement disturbance. [ABSTRACT FROM AUTHOR]

In 2007, Bohli et al. (Int J Inf Secur 6:243-254, ) proposed a two-round group key agreement protocol in the random oracle model, which in addition to semantic security offers strong entity authentication and a security guarantee against malicious insiders. We suggest a modification of this protocol that preserves the security guarantees and the round complexity, but reduces the amount of data that has to be sent and also reduces the number of signature computations and verifications by 50 %. Moreover, we propose a variant of Bohli et al.'s protocol whose security analysis does not require a random oracle or other idealizing assumptions. [ABSTRACT FROM AUTHOR]

The three-particle deterministic secure and high bit-rate direct quantum communication protocol and its improved version are analyzed. It shows that an eavesdropper can steal the sender's secret message by the intercept-resend attack and the entanglement attack. The original version is even fragile under denial-of-service attack. As a result, some suggestions to revise them are given. [ABSTRACT FROM AUTHOR]

We present StatVerif, which is an extension of the ProVerif process calculus with constructs for explicit state, in order to be able to reason about protocols that manipulate global state. Global state is required by protocols used in hardware devices (such as smart cards and the trusted platform module), as well as by protocols involving databases that store persistent information. We provide the operational semantics of StatVerif. We extend the ProVerif compiler to a compiler for StatVerif, which takes processes written in the extended process language and produces Horn clauses. Our compilation is carefully engineered to avoid many false attacks. We prove the correctness of the StatVerif compiler. We illustrate our method on two examples: a small hardware security device and a contract signing protocol. We are able to prove their desired properties automatically. [ABSTRACT FROM AUTHOR]

Most Petri nets-based methods that have been developed to analyze cryptographic protocols provide the analysis of one attack trace only. Only a few of them offer the analysis of multiple attack traces, but they are rather inefficient. Analogously, the limitation of the analysis of one attack trace occurs in most model checking methods for cryptographic protocols. In this paper, we propose a very simple but practical Coloured Petri nets-based model checking method for the analysis of cryptographic protocols, which overcomes these limitations. Our method offers an efficient analysis of multiple attack traces. We apply our method to two case studies which are TMN authenticated key exchanged protocol and Micali's contract signing protocol. Surprisingly, our simple method is very efficient when the numbers of attack traces and states are large. Also, we find many new attacks in those protocols. [ABSTRACT FROM AUTHOR]

We motivate and present two designs for the composition of the authentication protocol, Kerberos, and the key transport protocol, Multimedia Internet KEYing (MIKEY) for authenticated transport of cryptographic keys for secure group-communication in enterprise and public-safety settings. A technical challenge, and our main contribution, is the analysis of the security of the composition. Towards this, we design our compositions to have intuitive appeal and thereby less prone to security vulnerabilities. We then employ protocol composition logic (PCL), a state-of-the-art approach for analyzing our composition. For this, we first articulate two properties that are of interest. Both properties are on the group key that is transported; we call them Group Key Confidentiality and Acquisition. Group Key Confidentiality is the property that if a principal possesses the key, then it is an authorized member of the group. Group Key Acquisition is the property that if a principal is a member of the group, then it is able to acquire the group key. In the course of our rigorous analysis, we discovered a flaw in our first design, which we point out, and which lead us to our second design. We have implemented both designs starting with the publicly available reference implementation of Kerberos, and an open-source implementation of MIKEY. Our implementations are available as open-source. We discuss our experience from the implementation, and present empirical results. [ABSTRACT FROM PUBLISHER]

It is well known (cf. Impagliazzo and Luby [in Proceedings of the 30th Annual IEEE Symposium on Foundations of Computer Science, 1989, pp. 230-235]) that the existence of almost all "interesting" cryptographic applications, i.e., ones that cannot hold information theoretically, implies one-way functions. An important exception where the above implication is not known, however, is the case of coin-flipping protocols. Such protocols allow honest parties to mutually flip an unbiased coin, while guaranteeing that even a cheating (efficient) party cannot bias the output of the protocol by much. Impagliazzo and Luby proved that coin-flipping protocols that are safe against negligible bias do imply one-way functions, and, very recently, Maji, Prabhakaran, and Sahai [in Proceedings of the 2001 51st Annual IEEE Symposium on Foundations of Computer Science, 2010, pp. 613-622] proved the same for constant-round protocols (with any nontrivial bias). For the general case, however, no such implication was known. We make progress towards answering the above fundamental question, showing that (strong) coin-flipping protocols safe against a constant bias (concretely, √2-1/2 - o(1)) imply one-way functions. [ABSTRACT FROM AUTHOR]

Quantum steganography is the art of hiding the fact that communications, which transmit the secret message in an insecure quantum channel, are occurring. This paper presents a novel quantum steganography protocol based on probability measurements for transmitting n qubits secret message in an insecure quantum channel. In the protocol, senders embed the secret message into the cover data by POVM measurements. Then, receivers can correctly extract the secret message and recover the cover data with a certain probability by selecting two sets of appropriate protective measurement operators to act projective measurements, respectively. More importantly, the existence of the secret message has no influence on the cover data. In addition, the security of our protocol does not rely on other protocols. The paper analyzes the secrecy and the security in detail. [ABSTRACT FROM AUTHOR]

Three-party key exchange protocol is one of the most essential cryptographic technique in the secure communication areas. In this protocol, two clients, each shares a human-memorable password, working with a trusted server, can agree a secure session key. Recently, Lu and Cao proposed a new simple three-party key exchange (S-3PAKE) protocol and claimed that it is not only very simple and efficient, but also can survive against various known attacks. However, Nam et al. pointed out that S-3PAKE is vulnerable to both off-line password guessing attack and undetectable on-line password guessing attack. Based on their finding, Nam et al. proposed an improved method to resolve this weakness. They further claimed that so far no off-line password guessing attack has been successful against their proposed protocol. In this paper, we demonstrate that Nam et al.'s improved protocol, unfortunately, is still vulnerable to an undetectable on-line password guessing attack. We therefore propose a simple and powerful method to address this issue. Which results in an improved three-party key exchange protocol that can protect against an undetectable on-line password guessing attack. [ABSTRACT FROM AUTHOR]

Abstract: Security for the Internet of Things (IoT) presents the challenge of offering suitable security primitives to enable IP-based security protocols such as IPSec and DTLS. This challenge is here because host-based implementations and solutions are not providing a proper performance over the devices used in the IoT. This is mainly because of the use of highly constraint devices in terms of computational capabilities. Therefore, it is necessary to implement new optimized and scalable cryptographic primitives which can use existing protocols to provide security, authentication, privacy and integrity to the communications. Our research focus on the mathematical optimization of cryptographic primitives for Public Key Cryptography (PKC) based on Elliptic Curve Cryptography (ECC). PKC has been considered, since the IoT requires high scalability, multi-domain interoperability, self-commissioning, and self-identification. Specifically, this contribution presents a set of optimizations for ECC over constrained devices, and a brief tutorial of its implementation in the microprocessor Texas Instrument MSP430 (Briel, 2000) [1] (commonly used in IoT devices such as 6LoWPAN, active RFID and DASH7). Our main contribution is the proof that these special pseudo-Mersenne primes, which we have denominated ‘shifting primes’ can be used for ECC primitives with 160-bit keys in a highly optimal way. This paper presents an ECC scalar multiplication with 160-bit keys within 5.4 million clock cycles over MSP430 devices without hardware multiplier. Shifting primes provide a set of features, which make them more compliant with the set of instructions available with tiny CPUs such as the MSP430 and other 8 and 16-bit CPUs. [Copyright &y& Elsevier]

Recently, an enhanced multiparty quantum secret sharing of classical message by using entanglement swapping was presented. In this protocol, a code table was used to improve the efficiency. However, as we show, this protocol is insecure in the sense that an outside attacker or two special dishonest agents can eavesdrop part or all information about the secret. Hence, this high efficiency may be unrealistic because it results in the decrease of security. [ABSTRACT FROM AUTHOR]

Abstract: Electronic auctions (e-auction) enable bidders to bid for diverse sold objects under an electronic platform via the Internet. Relevant literature has presented numerous online bidding auction schemes considering different security issues. However, none of them can satisfy all essential properties simultaneously and some of them possess security vulnerabilities. For example, the winner cannot hold the properties of anonymity and unlinkability without re-registration for the auction of another product. In order to cope with the above problems, this study presents an e-auction scheme which owns the following features: every bidder’s anonymity during the entire auction, unlinkability among plural auctions of different selling topics, unforgeability, no framing (tamper resistance of bidding tickets), non-repudiation, public verifiability of all bidding tickets, and easy revocation for illegal activities. In our e-bidding protocol, all participants can take part in a sequence of different auctions for various products unlimitedly after performing one time of registration, where the winner does not need to re-register again, either. We formally prove the security of the proposed scheme and also provide comparisons to show that it is the most efficient one as compared with previous works. [Copyright &y& Elsevier]

Dynamic group signatures (DGS) enable a user to generate a signature on behalf of a group of users, allowing a prospective user to join via an appropriate join protocol. A natural security requirement in the dynamic setting is to permit an adversary to concurrently perform join protocol executions. To date, most of DGS schemes do not provide the efficient concurrent join protocols in their security analysis, because of the need to use knowledge extractors. Also, DGS schemes have to provide efficient batch verifications for practical applications such as Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communication, where a large number of group signatures should be verified in a very short time. In this paper, we propose a new practical DGS scheme that supports not only efficient concurrent joins but also batch verifications. The concurrent security is proven by showing that our join protocols are simulated without any knowledge extractor in security analysis. To do this, we introduce a modified Pointcheval–Sanders (PS) problem that can guarantee efficiently checking equality of discrete logarithms. In terms of efficiency, when considering a type-3 pairing, our DGS scheme has the advantages that the signature generation and verification are faster and especially our batch verification is at least 7 times faster in case of verifying 100 signatures, compared to other comparable pairing-based DGS schemes in the literature. • Construct a dynamic group signature scheme based on the sign–randomize–prove paradigm. • Prove concurrent security of our join protocol under a variant of Pointcheval–Sanders assumption. • Achieve the fastest signing and (batch) verification, compared with all of the existing pairing-based schemes. [ABSTRACT FROM AUTHOR]

Abstract: Formal methods have proved their usefulness for analyzing the security of protocols. Most existing results focus on trace properties like secrecy or authentication. There are however several security properties, which cannot be defined (or cannot be naturally defined) as trace properties and require a notion of behavioral equivalence. Typical examples are anonymity, privacy related properties or statements closer to security properties used in cryptography. In this paper, we consider three notions of equivalence defined in the applied pi calculus: observational equivalence, may-testing equivalence, and trace equivalence. First, we study the relationship between these three notions. We show that for determinate processes, observational equivalence actually coincides with trace equivalence, a notion simpler to reason with. We exhibit a large class of determinate processes, called simple processes, that capture most existing protocols and cryptographic primitives. While trace equivalence and may-testing equivalence seem very similar, we show that may-testing equivalence is actually strictly stronger than trace equivalence. We prove that the two notions coincide for image-finite processes, such as processes without replication. Second, we reduce the decidability of trace equivalence (for finite processes) to deciding symbolic equivalence between sets of constraint systems. For simple processes without replication and with trivial else branches, it turns out that it is actually sufficient to decide symbolic equivalence between pairs of positive constraint systems. Thanks to this reduction and relying on a result first proved by M. Baudet, this yields the first decidability result of observational equivalence for a general class of equational theories (for processes without else branch nor replication). Moreover, based on another decidability result for deciding equivalence between sets of constraint systems, we get decidability of trace equivalence for processes with else branch for standard primitives. [Copyright &y& Elsevier]

SUMMARY In this paper, we first showed that Lou and Huang's three-party password-based key exchange protocol is still vulnerable to offline dictionary attacks. Thereafter, we proposed an enhanced protocol that can defeat the attack described and yet is efficient. Finally, we provided the rigorous proof of the security for it. Copyright © 2011 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

This paper presents a secure protocol for spontaneous wireless ad hoc networks which uses an hybrid symmetric/asymmetric scheme and the trust between users in order to exchange the initial data and to exchange the secret keys that will be used to encrypt the data. Trust is based on the first visual contact between users. Our proposal is a complete self-configured secure protocol that is able to create the network and share secure services without any infrastructure. The network allows sharing resources and offering new services among users in a secure environment. The protocol includes all functions needed to operate without any external support. We have designed and developed it in devices with limited resources. Network creation stages are detailed and the communication, protocol messages, and network management are explained. Our proposal has been implemented in order to test the protocol procedure and performance. Finally, we compare the protocol with other spontaneous ad hoc network protocols in order to highlight its features and we provide a security analysis of the system. [ABSTRACT FROM PUBLISHER]

In this paper we propose an extended version of the ping-pong protocol and study its security. The proposed protocol incorporates the usage of mutually unbiased bases in the control mode. We show that, by increasing the number of bases, it is possible to improve the security of this protocol. We also provide the upper bounds on eavesdropping average non-detection probability and propose a control mode modification that increases the attack detection probability. [ABSTRACT FROM AUTHOR]

SUMMARY This paper focuses on two interesting radio-frequency identification (RFID) cryptographic protocols: the server-less RFID authentication protocol that allows readers to authenticate tags without the help of any online backend servers, and the RFID searching protocol in which the verifier explicitly specifies the target tag to be searched and authenticated. These two kinds of RFID protocols play important roles in many RFID applications; however, the existing protocols either had security weaknesses or exhibited poor efficiency. This paper shows the weaknesses, and then proposes our server-less RFID authentication protocol and RFID searching protocol. The proposed protocols greatly enhance the security using one more hashing. Copyright © 2011 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Although the objective of secure communication can be achieved by using cryptographic tools, the undeniability that results from cryptographic properties may create a potential threat to the sender of the message. Unfortunately, most existing deniable protocols only provide 1-out-of-2 deniability. When both parties (the sender and the receiver) are allowed to deny generating the message, a dispute might occur between these two parties. The 1-out-of-2 deniable protocol can result in an unfair resolution of the dispute. Therefore, we propose a new model of deniability, called 1-out-of-∞ deniability, that can provide full deniability. The 1-out-of-∞ deniability protocol allows the originator of the message to deny that he or she generated the message, since there are an infinite number of possible message generators; at the same time, all transmitted messages can be protected and authenticated between the sender and the intended receiver. Our design can be implemented by using any public-key cryptography technique. We also analyze the correctness of the proposed protocols based on logical rules, and two practical examples are given to illustrate our design. [ABSTRACT FROM AUTHOR]

Radio-frequency identification (RFID) technology enables the identification and tracking of objects by means of the wireless signals emitted by a tag attached to the objects of interest. Without adequate protection, however, malicious attackers can easily eavesdrop, scan or forge the information within the tag, thereby threatening the integrity of the system. Previous research has shown that the basic security requirements of RFID systems, i.e. identity authentication, information privacy and location privacy, can be satisfied using conventional cryptographic components. However, such components are expensive, and therefore conflict with the general requirement for low-cost tag designs. Accordingly, this paper presents a low-cost challenge-response security protocol designated as the hidden mutual authentication protocol (HMAP) to accomplish both a mutual authentication capability between the tag and the reader and information privacy. The results show that HMAP provides an efficient means of concealing the authentication messages exchanged between the tag and the reader and is robust toward replay attacks. In addition, it is shown that HMAP is easily extended to provide complete location privacy by utilizing a hash function to generate different tag identifiers in each authentication session. Copyright © 2011 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Abstract: Asymmetric pairings for which an efficiently-computable isomorphism is known are called Type 2 pairings; if such an isomorphism is not known then is called a Type 3 pairing. Many cryptographic protocols in the asymmetric setting rely on the existence of for their security reduction while some use it in the protocol itself. For these reasons, it is believed that some of these protocols cannot be implemented with Type 3 pairings, while for some the security reductions either cannot be transformed to the Type 3 setting or else require a stronger complexity assumption. Contrary to these widely held beliefs, we argue that Type 2 pairings are merely inefficient implementations of Type 3 pairings, and appear to offer no benefit for protocols based on asymmetric pairings from the point of view of functionality, security, and performance. [Copyright &y& Elsevier]

In this paper, we analyse the Transport Layer Security (TLS) protocol (in particular, bilateral TLS in public-key mode) within the strand spaces setting. In Proceedings of the 16th IEEE Computer Security Foundations Workshop (CSFW), IEEE Computer Society, 2003, pp. 141-154, Broadfoot and Lowe suggested an abstraction of TLS. The abstraction models the security services that appear to be provided by the protocol to the high-level security layers. The outcome of our analysis provides a formalisation of the security services provided by TLS and proves that, under reasonable assumptions, the abstract model suggested by Broadfoot and Lowe is correct. To that end, we reduce the complexity of the protocol using fault-preserving simplifying transformations. We extend the strand spaces model in order to include the cryptographic operations used in TLS and facilitate its analysis. Finally, we use the extended strand spaces model to fully analyse the public-key mode of bilateral TLS with its two main components: the Handshake and Record Layer protocols. [ABSTRACT FROM AUTHOR]

Recently, Shieh et al. have pointed out that Juang's password authenticated key agreement scheme and Chien et al.'s remote authentication scheme are vulnerable to some attacks. Therefore, they presented a modified protocol to avoid those attacks. However, the authors of this article shall show that Shieh et al.'s scheme and Juang's scheme have two weaknesses, respectively. Therefore, we shall improve the weaknesses of their schemes. [ABSTRACT FROM AUTHOR]

Recently, Hsueh and Chen [in Proceedings of the 14th Information Security Conference, National Taiwan University of Science and Technology, Taipei, pp. 236-242, ] proposed a quantum key agreement (QKA) protocol with maximally entangled states. Their protocol allows two users to negotiate a secret key in such a way that no one can predetermine the shared key alone. This study points out two security flaws in their protocol: (1) a legitimate but malicious user can fully control the shared key alone; (2) an eavesdropper can obtain the shared key without being detected. A possible solution is presented to avoid these attacks and also Tsai et al.'s CNOT attack [in Proceedings of the 20th Cryptology and Information Security Conference, National Chiao Tung University, Hsinchu, pp. 210-213, ] on Hsueh and Chen protocol to obtain the shared key without being detected. [ABSTRACT FROM AUTHOR]

Abstract: In the traditional identity-based cryptography, when a user holds multiple identities as its public keys, it has to manage an equal number of private keys. The recent advances of identity-based cryptography allow a single private key to map multiple public keys (identities) that are selectable by the user. This approach simplifies the private key management. Unfortunately, the existing schemes have a heavy computation overhead, since the private key generator has to authenticate all identities in order to generate a resultant private key. In particular, it has been considered as a drawback that the data size for a user is proportional to the number of associated identities. Moreover, these schemes do not allow dynamic changes of user identities. When a user upgrades its identities, the private key generator (PKG) has to authenticate the identities and generate a new private key. To overcome these problems, in this paper we present an efficient dynamic identity-based key exchange protocol with selectable identities, and prove its security under the bilinear Diffie–Hellman assumption in the random oracle model. [Copyright &y& Elsevier]

Cryptanalysis is an important branch in the study of cryptography, including both the classical cryptography and the quantum one. In this paper we analyze the security of two three-party quantum key distribution protocols (QKDPs) proposed recently, and point out that they are susceptible to a simple and effective attack, i.e., the dense-coding attack. It is shown that the eavesdropper Eve can totally obtain the session key by sending entangled qubits as the fake signal to Alice and performing collective measurements after Alice's encoding. The attack process is just like a dense-coding communication between Eve and Alice, where a special measurement basis is employed. Furthermore, this attack does not introduce any errors to the transmitted information and consequently will not be discovered by Alice and Bob. The attack strategy is described in detail and a proof for its correctness is given. Finally, the root cause of this insecurity and a possible way to improve these protocols are discussed. [ABSTRACT FROM PUBLISHER]

While many scenarios of anonymous communication can be solved by various famous classical techniques including mix nets or dining cryptographers (DC), an abundant amount of anonymous tasks remains open. In this paper, we present a solution to one such task. Our protocol serves as a private communication channel for quantum messages while ensuring that both the sender and the receiver stay anonymous in a set of all parties. Our protocol is a continuation of our previous work on anonymous transmission of quantum information. The protocol does not require trusted parties, and is secure against an active adversary. It can also withstand denial of service attacks. The protocol exhibits an advantage of quantum resources over classical because no classical solution is known (in the same security settings). Entanglement swapping technique is used to create "symmetry" in the protocol, which makes it very transparent and easier to analyze. The security analysis we present is heavily based on our previous work on quantum anonymous communication. The task we implement is also a nice illustration of a cryptographic task where two parties in a multi-party protocol can be dishonest at the same time, but are not cooperating. [ABSTRACT FROM AUTHOR]

Abstract: In 2008, Lee et al. proposed two multiple-key agreement protocols, first one based on elliptic curve cryptography (ECC) and the other one, based on bilinear pairings. Shortly after publication, Vo et al. showed that the Lee–Wu–Wang’s pairing-based protocol is vulnerable to impersonation attack then for removing the problem, they proposed an improved protocol. In this paper, first We show that the Lee–Wu–Wang’s ECC-based protocol is insecure against forgery attack and also, if long-term private keys of two entities and one key of the session keys are revealed, the other session keys are exposed too. Then, we demonstrate that the Vo–Lee–Yeun–Kim’s protocol is vulnerable to another kind of forgery attacks and a reflection attack. [Copyright &y& Elsevier]

Abstract: In this paper, we present a strongly secure identity-based (ID-based) two-party authenticated key agreement (AKA) protocol, which captures all basic desirable security properties including master key forward secrecy, ephemeral secrets reveal resistance and so on, and is provably secure in the extended Canetti–Krawczyk (eCK) model. The security of the protocol can be reduced to the standard Computational Bilinear Diffie–Hellman assumption in the random oracle model. Our scheme is secure as long as each party has at least one uncompromised secret. Also, we give a strongly secure variant of the protocol. The variant has a much lower computational overhead than the original scheme, while its security relies on the Gap Bilinear Diffie–Hellman assumption. Currently, there are few ID-based AKA protocols that are provably secure in the strong eCK model. Compared with previous ID-based AKA schemes, our protocols have advantages over them in security or efficiency. [Copyright &y& Elsevier]

In this paper, we study the question of whether or not it is possible to construct protocols for general secure computation in the setting of malicious adversaries and no honest majority that use the underlying primitive (e.g., enhanced trapdoor permutation) in a black-box way only. Until now, all known general constructions for this setting were inherently non-black-box since they required the parties to prove zero-knowledge statements that are related to the computation of the underlying primitive. Our main technical result is a fully black-box reduction from oblivious transfer with security against malicious parties to oblivious transfer with security against semihonest parties. As a corollary, we obtain the first constructions of general multiparty protocols (with security against malicious adversaries and without an honest majority) which make only a black-box use of semihonest oblivious transfer, or alternatively a black-box use of lower-level primitives such as enhanced trapdoor permutations or homomorphic encryption. In order to construct this reduction we introduce a new notion of security called privacy in the presence of defensible adversaries. This notion states that if an adversary can produce (retroactively, after the protocol terminates) an input and random tape that make its actions appear to be honest, then it is guaranteed that it learned nothing more than its prescribed output. We then show how to construct defensible oblivious transfer from semihonest oblivious transfer, and malicious oblivious transfer from defensible oblivious transfer, all in a black-box way. [ABSTRACT FROM AUTHOR]

Abstract: This paper presents a secured I2C (Inter-Integrated Circuit) protocol for Chip-to-Chip communications. The well known AES-GCM cryptographic and authentication algorithm is used to secure this low speed serial communication protocol. This securization allows the use of this standard into applications where security is an issue and the computation resources are constrained. Both the hardware architecture and the protocol are presented. The implementation of the I2CSec presented in the paper has been optimized for FPGA devices. [Copyright &y& Elsevier]

In mobile ad hoc networks (MANETs), identity (ID)-based cryptography with threshold secret sharing is a popular approach for the security design. Most previous work for key management in this framework concentrates on the protocols and structures. Consequently, how to optimally conduct node selection in ID-based cryptography with threshold secret sharing is largely ignored. In this paper, we propose a distributed scheme to dynamically select nodes with master key shares to do the private key generation service. The proposed scheme can minimize the overall threat posed to the MANET while simultaneously taking into account of the cost (e.g., energy consumption) of using these nodes. Intrusion detection systems are modeled as noisy sensors to derive the system security situations. We use stochastic system to formulate the MANET to obtain the optimal policy. Simulation results are presented to illustrate the effectiveness of the proposed scheme. [ABSTRACT FROM AUTHOR]

First-order logic models of security for cryptographic protocols, based on variants of the Dolev–Yao model, are now well-established tools. Given that we have checked a given security protocol π using a given first-order prover, how hard is it to extract a formally checkable proof of it, as required in, e.g., common criteria at the highest evaluation level (EAL7)? We demonstrate that this is surprisingly hard in the general case: the problem is non-recursive. Nonetheless, we show that we can instead extract finite models M from a set S of clauses representing π, automatically, and give two ways of doing so. We then define a model-checker testing M |= S, and show how we can instrument it to output a formally checkable proof, e.g., in Coq. Experience on a number of protocols shows that this is practical, and that even complex (secure) protocols modulo equational theories have small finite models, making our approach suitable. [ABSTRACT FROM AUTHOR]

Peer-to-peer (P2P) networks are vulnerable to peers who cheat, propagate malicious code, leech on the network, or simply do not cooperate. The traditional security techniques developed for the centralized distributed systems like client-server networks are insufficient for P2P networks by the virtue of their centralized nature. The absence of a central authority in a P2P network poses unique challenges for reputation management in the network. These challenges include identity management of the peers, secure reputation data management, Sybil attacks, and above all, availability of reputation data. In this paper, we present a cryptographic protocol for ensuring secure and timely availability of the reputation data of a peer to other peers at extremely low costs. The past behavior of the peer is encapsulated in its digital reputation, and is subsequently used to predict its future actions. As a result, a peer's reputation motivates it to cooperate and desist from malicious activities. The cryptographic protocol is coupled with self-certification and cryptographic mechanisms for identity management and countering Sybil attack. We illustrate the security and the efficiency of the system analytically and by means of simulations in a completely decentralized Gnutella-like P2P network. [ABSTRACT FROM AUTHOR]

Abstract: Most of the decision procedures for symbolic analysis of protocols are limited to a fixed set of algebraic operators associated with a fixed intruder theory. Examples of such sets of operators comprise XOR, multiplication, abstract encryption/decryption. In this report we give an algorithm for combining decision procedures for arbitrary intruder theories with disjoint sets of operators, provided that solvability of ordered intruder constraints, a slight generalization of intruder constraints, can be decided in each theory. This is the case for most of the intruder theories for which a decision procedure has been given. In particular our result allows us to decide trace-based security properties of protocols that employ any combination of the above mentioned operators with a bounded number of sessions. [Copyright &y& Elsevier]

Abstract: In this article, we attempt to formally study two very intuitive physical models: sealed envelopes and locked boxes, often used as illustrations for common cryptographic operations. We relax the security properties usually required from locked boxes [such as in bit-commitment (BC) protocols] and require only that a broken lock or torn envelope be identifiable to the original sender. Unlike the completely impregnable locked box, this functionality may be achievable in real life, where containers having this property are called “tamper-evident seals”. Another physical object with this property is the “scratch-off card”, often used in lottery tickets. We consider three variations of tamper-evident seals, and show that under some conditions they can be used to implement oblivious transfer, BC and coin flipping (CF). We also show a separation between the three models. One of our results is a strongly fair CF protocol with bias bounded by (where is the number of rounds); this was a stepping stone towards achieving such a protocol in the standard model (in subsequent work). [Copyright &y& Elsevier]

Mobile Ad-hoc NETworks (MANETs) are expected to play an important role in tactical military networks by providing infrastructureless communication. However, maintaining secure and instant information sharing is a difficult task especially for highly dynamic military MANETs. To address this requirement, we propose a new multi-tier adaptive military MANET security protocol using hybrid cryptography and signcryption. In our protocol, we bring novelties to secure military MANET communication for three main points: Cryptographic methods used in MANETs, hybrid key management protocols and structural organization of the military MANETs. As a new approach, we use hybrid cryptography mechanisms and Elliptic Curve Pintsov-Vanstone Signature Scheme (ECPVS8) that provide security and performance advantages when compared to some traditional cryptographic methods. Furthermore, multi-leveled security approach of our protocol provides adaptive solutions according to the requirements of different military units in the MANET. We also use a hybrid key management technique that combines the benefits of both decentralized protocols with single point of failure resistivity and centralized protocols with low rekeying cost. Last, the proposed network structure facilitates certification and key management for the MANET by providing flexibility for Mobile Backbone Network (MBN) tiers. [ABSTRACT FROM AUTHOR]

Abstract: Lee et al. proposed two new authenticated multiple key exchange protocols based on Elliptic Curve Cryptography (ECC) and bilinear pairings. In this paper, we show an impersonation attack on their pairing-based authenticated key exchange protocol. We demonstrate that any attacker can impersonate an entity to share multiple session keys with another entity of his/her choice by using only the public key of the victim. Moreover, their protocol fails to provide perfect forward secrecy, despite of their claim to the contrary. Thus, we propose a simple modification to the original protocol which avoids our attack. [Copyright &y& Elsevier]

We present a semiformal model of anonymous communication with several participants performing several anonymous actions on several messages, e.g. in digital pseudosignatures. The goal is to design a model having enough expressive power to model simple as well as very complex anonymous communication patterns. Our model concentrates on anonymity of a sender, a receiver, and on the relationship anonymity. However, the model is easy to adopt to other types of anonymity. A special anonymous channel formalism is introduced and extensively explored in this paper. The formalism builds on the top of so-called estimation procedure which takes knowledge of the adversary and processes it to find anonymous participants. Some other, already published, models of anonymity, e.g. the model of Hughes and Shmatikov or of Halpern and O'Neill, are compatible with our model – they could be used as building blocks together with (or instead of) our estimation procedure. Therefore, the tools developed for those models can be easily adapted to be used with our model. We use protocol runs and an observational equivalence on the runs which is induced by adversary's knowledge. This is a well developed area of the theoretical computer science and many tools developed therein can be adapted to work with our model. Our model is also open to many additional features, e.g. the possibility to include probability distributions on anonymity sets. [ABSTRACT FROM AUTHOR]