Defense against collusion scheme based on elliptic curve cryptography for wireless sensor networks

Wireless Sensor Networks (WSNs) are being deployed for a wide variety of applications and the security problems of them have received considerable attention. Considering the limitations of power, com-putation capability and storage resources, this paper proposed an efficient defense against collusion scheme based on elliptic curve cryptography for wireless sensor networks in order to solve the problems that sensor node-key leaking and adversaries make compromised nodes as their collusions to launch new attack. In the proposed scheme, the group-key distribution strategy is employed to compute the private key of each sensor node, and the encryption and decryption algorithms are constructed based on Elliptic Curve Cryptography (ECC). The command center (node) only needs to broadcast a controlling header with three group elements, and the authorized sensor node can correctly recover the session key and use it to decrypt the broadcasting message. Analysis and proof of the proposed scheme’s efficiency and security show that the proposed scheme can resist the k-collusion attack efficiently.     

AN IMPROVED AUTHENTICATED KEY AGREEMENT PROTOCOL

In 1999, Seo and Sweeney proposed a simple authenticated key agreement protocol that was designed to act as a Diffie-Hellman key agreement protocol with user authentication. Various attacks on this protocol are described and enhanced in the literature. Recently, Ku and Wang proposed an improved authenticated key agreement protocol, where they asserted the protocol could withstand the existing attacks. This paper shows that Ku and Wang＇s protocol is still vulnerable to the modification attack and presents an improved authenticated key agreement protocol to enhance the security of Ku and Wang＇s protocol. The protocol has more efficient performance by replacing exponentiation operations with message authentication code operations.     

Dynamic ID-based remote user mutual authentication scheme with smartcard using Elliptic Curve Cryptography

In the literature, several dynamic ID-based remote user mutual authentication schemes are implemented using password, smartcard and Elliptic Curve Cryptography （ECC）, however, none of them provides resilience against different attacks. Therefore, there is a great need to design an efficient scheme for practical applications. In this paper, we proposed such a scheme in order to provide desired security attributes and computation efficiencies. Compared with other existing techniques, our scheme is more efficient and secured. In addition, our scheme is provably secure in the random oracle model under the hardness assumption of computational Diffie-Hellman problem.     

EPON中的鉴权和加密方案的研究

基于以太网的无源光网络(EPON)是一个点到多点的系统,面临着很多安全隐患.为此,本文介绍了一种鉴权和将改进了的ECC与AES相结合的数据加密方案,并对这个加密方案在已知密钥的保密性、危及密钥安全的假冒、显式密钥鉴权和共享密钥的未知性等方面进行了性能分析.     

Three-party password authenticated key agreement protocol with user anonymity based on lattice

With the rapid development of quantum theory and the existence of polynomial algorithm in quantum computation based on discrete logarithm problem and large integer decomposition problem,the security of the algorithm was seriously threatened.Therefore,two authentication key agreement protocols were proposed rely on ring-learning-with-error (RLWE) assumption including lattice-based implicit authentication key agreement scheme and lattice-based explicit authentication key agreement scheme and proved its security.The implicit authentication key agreement protocol is less to communicate and faster to authentication,the explicit authentication key agreement protocol is more to secure.At the same time,bidirectional authentication of users and servers can resist unpredictable online dictionary attacks.The new protocol has higher efficiency and shorter key length than other password authentication key agreement protocols.It can resist quantum attacks.Therefore,the protocol is efficient,secure,and suitable for large-scale network communication.     

Two-factor authenticated key agreement protocol based on biometric feature and password

A new two-factor authenticated key agreement protocol based on biometric feature and password was proposed.The protocol took advantages of the user’s biological information and password to achieve the secure communication without bringing the smart card.The biometric feature was not stored in the server by using the fuzzy extractor technique,so the sensitive information of the user cannot be leaked when the server was corrupted.The authentication messages of the user were protected by the server’s public key,so the protocol can resist the off-line dictionary attack which often appears in the authentication protocols based on password.The security of the proposed protocol was given in the random oracle model provided the elliptic computational Diffie-Hellman assumption holds.The performance analysis shows the proposed protocol has better security.     

An efficient hash-based authenticated key agreement scheme for multi-server architecture resilient to key compromise impersonation

During the past decade, rapid advances in wireless communication technologies have made it possible for users to access desired services using hand-held devices. Service providers have hosted multiple servers to ensure seamless online services to end-users. To ensure the security of this online communication, researchers have proposed several multi-server authentication schemes incorporating various cryptographic primitives. Due to the low power and computational capacities of mobile devices, the hash-based multi-server authenticated key agreement schemes with offline Registration Server (RS) are the most efficient choice. Recently, Kumar-Om presented such a scheme and proved its security against all renowned attacks. However, we find that their scheme bears an incorrect login phase, and is unsafe to the trace attack, the Session-Specific Temporary Information Attack (SSTIA), and the Key Compromise Impersonation Attack (KCIA). In fact, all of the existing multi-server authentication schemes (hash-based with offline RS) do not withstand KCIA. To deal with this situation, we propose an improved hash-based multi-server authentication scheme (with offline RS). We analyze the security of the proposed scheme under the random oracle model and use the ‘‘Automated Validation of Internet Security Protocols and Applications’’ (AVISPA) tool. The comparative analysis of communication overhead and computational complexity metrics shows the efficiency of the proposed scheme.     

GF(2m)域ECC点乘算法优化设计

针对无线传感器网络(Wireless Sensor Network,WSN)高安全、低功耗、轻量化的应用需求,重点对椭圆曲线密码体制的模乘和模逆运算作了优化设计,设计了一种GF(2m)域的ECC点乘计算优化方案,并进行了相应的硬件电路设计.经过FPGA平台仿真测试,在GF(2233)域上完成一次点乘运算共需要1.644...     

基于动态补偿的椭圆曲线密码低成本抗功耗攻击策略及硬件结构研究

椭圆曲线密码(ECC)芯片的抗功耗攻击能力往往以电路性能、面积或功耗为代价.该文分析了在椭圆曲线密码点乘运算中密钥猜测正确与错误时的中间数据汉明距离概率分布差异性,提出一种基于动态汉明距离调控的功耗补偿方法,利用模拟退火算法离线寻找最优的映射矩阵,最终形成椭圆曲线密码硬件电路的等概率映射补偿模型,大大降低了中间数据与功...     

不同PKG环境下可证安全的基于身份AKA协议

目前大多数基于身份认证密钥协商协议需要参与协议双方在同一个PKG环境下,而实际应用中需要在不同PKG环境下的用户之间也能进行安全通信。该文结合twin Diffie-Hellman问题提出了一个全新的不同PKG环境下的基于身份认证密钥协商协议。利用Cash等人在2008年欧密会上提出的trapdoor test技术在eCK模型中将新协议的安全性规约到标准的CDH和BDH 假设。     

一个新的基于ECC的广播多重数字签名方案

提出一个新的基于椭圆曲线密码体制的广播多重数字签名方案。本方案能够克服已有的方案不能适用于广播签名的缺点,同时能够实现多重数字签名私钥的共享。与已有的椭圆曲线数字签名方案(ECDSS)相比,该方案效率高,可以有效的抵抗多种攻击,安全性较高。     

一种基于ECC的高效双向身份认证

椭圆曲线密码体制和零知识证明在密码学里面得到了广泛的研究和应用.文章提出了一种基于椭圆曲线密码体制的零知识证明的双向身份认证方案,该方案用椭圆曲线密码体制代替传统的公钥密码体制,并将椭圆曲线的算法加入到了零知识证明的思想里面,使得认证的安全性和准确度有了很大的提高.     

一种可证安全的车联网无证书聚合签名改进方案

车联网(VANETs)是组织车－X(X：车、路、行人及互联网等)之间的无线通信和信息交换的大型网络,是智慧城市重要组成部分。其消息认证算法的安全与效率对车联网至关重要。该文分析王大星等人的VANETs消息认证方案的安全不足,并提出一种改进的可证安全的无证书聚合签名方案。该文方案利用椭圆曲线密码构建了一个改进的安全无证书聚合认证方案。该方案降低了密码运算过程中的复杂性,同时实现条件隐私保护功能。严格安全分析证明该文方案满足VANETs的安全需求。性能分析表明该文方案相比王大星等人方案,较大幅度地降低了消息签名、单一验证以及聚合验证算法的计算开销,同时也减少了通信开销。

     

双有限域模乘和模逆算法及其硬件实现

有限域上的模乘和模逆运算是椭圆曲线密码体系的两个核心运算。该文在Blakley算法的基础上提出一种radix-4快速双有限域模乘算法,该算法采用Booth编码技术将原算法的迭代次数减少一半,并利用符号估计技术简化约减操作;在扩展Euclidean求逆算法的基础上提出一种能够同时支持双有限域运算的高效模逆算法,该算法不仅避免了大整数比较操作,而且提高了算法在每次迭代过程中的移位效率。然后针对这两种算法特点设计出一种能够同时完成双有限域上模乘和模逆操作的统一硬件结构。实现结果表明：256位的模乘和模逆统一硬件电路与同类型设计相比较,在电路面积没有增加的情况下,模乘运算速度提高68%,模逆运算的速度也提高了17.4%。     

椭圆曲线密码处理器的高效并行处理架构研究与设计

为了解决当前椭圆曲线密码处理器普遍存在灵活性低、资源占用大的问题,该文采用统计建模的方式,以面积-时间(AT)综合性能指标为指导,提出了一种面向椭圆曲线密码并行处理架构的量化评估方式,并确定3路异构并行处理架构可使处理器综合性能达到最优。其次,该文提出一个分离分级式存储结构和一个运算资源高度复用的模运算单元,可增强存储器的访问效率和运算资源的利用率。在90 nm CMOS工艺下综合,该文处理器的面积为1.62mm2,完成一次GF(2571)和GF(p521)上的点乘运算分别需要2.26 ms/612.4J和2.63 ms/665.4J。与同类设计相比,该文处理器不仅具有较高的灵活性、可伸缩性,而且其芯片面积和运算速度达到了很好的折中。     

密码算法的研究综述

对密码算法进行了概述和分类,并在此基础上论述了密码算法的现状。在哈希函数方面,研究了在MD5和SHA-1被破解后HMAC的健壮性是否变化;在对称密钥算法方面,论述了AES的特点并将其与DES,3DES及IDEA进行了比较;在非对称密钥算法方面,比较了RSA,DSA和ElGamal,并且详细说明了ECC。最后对密码算法的发展进行了展望。     

一种可认证的动态秘密共享方案

该文基于椭圆曲线加密的安全性提出了一种改进的秘密共享方案。该方案可防欺骗、防参与者数据误发,参与者和管理者相互之间能相互进行身份认证,并且较好地解决了秘密共享的更新和复用问题,该方案在现在网络通信中有较高的应用价值。     

一种新型基于环上带误差学习问题的认证密钥交换方案

利用格上判定带误差学习问题(Ring-DLWE)困难假设,该文基于Peikert的调和技术构造认证密钥交换方案。在标准模型下,该方案是CK模型中可证明安全的,并达到弱前向安全性(wPFS)。与现有的基于LWE的密钥交换方案相比,该方案使用平衡的密钥提取函数,因而保护共享会话密钥,同时因其基于格中困难问题,所以能抵抗量子攻击。     

基于GF(2~n)的ECC协处理器芯片设计

文章讨论了定义在GaloisField(GF)2有限域上椭圆曲线密码体制(ECC)协处理器芯片的设计。首先在详细分析基于GF(2n)ECC算法的基础上提取了最基本和关键的运算,并提出了通过协处理器来完成关键运算步骤,主处理器完成其它运算的ECC加/解密实现方案。其次,进行了加密协处理器体系结构设计,在综合考虑面积、速度、功耗的基础上选择了全串行方案来实现GF(2n)域上的乘和加运算。然后,讨论了加密协处理器芯片的电路设计和仿真、验证问题。最后讨论了芯片的物理设计并给出了样片的测试结果。     

两个认证密钥协商协议的前向安全性分析

目前,网络安全及隐私受到广泛关注。前向安全性是Günther在1989年提出的一种认证密钥协商协议( AKA)的安全属性(doi: 10.1007/3-540-46885-4_5),该性质经过30年的蓬勃发展已经成为研究领域的热点之一。该文主要分析了MZK20和VSR20两个AKA协议。首先在启发式分析的基础上,利用BAN逻辑分析了MZK20协议不具有弱前向安全性;其次利用启发式分析和Scyther工具证明了VSR20协议不具备前向安全性。最后,在分析VSR20协议设计缺陷的基础上,提出了改进方案,并在eCK模型下证明了改进后协议的安全性;并且,结合Scyther软件证明了改进VSR20协议与VSR20协议相比明显提高了安全性。