Authenticated encryption schemes with message linkages for message flows

Two efficient authenticated encryption schemes with message linkages are proposed. One is a basic scheme, that it has the better performance in comparison with the all previously proposed schemes in terms of the communication and the computation costs. However, it has a property as same as the previously proposed schemes, that the message blocks can be recovered only after the entire signature blocks have been received. Therefore, the basic scheme is applicable to encrypt all-or-nothing flow. Thus, we improve the basic scheme and also propose a generalized scheme, which allows the receiver to recover the partial message blocks before receiving the entire signature blocks. That is, the receiver may perform the receiving and the recovering processes simultaneously. Therefore, the generalized scheme is applicable to message flows. The generalized scheme requires smaller bandwidth and computational time as compared to the previously proposed authenticated encryption schemes with message linkages for message flows.     

A new convertible authenticated encryption scheme with message linkages

In this article, we present an authenticated encryption scheme with message linkages used to deliver a large message. To protect the receiver’s benefit, the receiver can easily convert the signature into an ordinary one that can be verified by anyone. Several feasible attacks will be discussed, and the security analysis will prove that none of them can successfully break the proposed scheme.     

General classification of the authenticated encryption schemes for the CAESAR competition

An authenticated encryption scheme is a scheme which provides privacy and integrity by using a secret key. In 2013, CAESAR (the “Competition for Authenticated Encryption: Security, Applicability, and Robustness”) was co-founded by NIST and Dan Bernstein with the aim of finding authenticated encryption schemes that offer advantages over AES-GCM and are suitable for widespread adoption. The first round started with 57 candidates in March 2014; and nine of these first-round candidates were broken and withdrawn from the competition. The remaining 48 candidates went through an intense process of review, analysis and comparison. While the cryptographic community benefits greatly from the manifold different submission designs, their sheer number implies a challenging amount of study. This paper provides an easy-to-grasp overview over functional aspects, security parameters, and robustness offerings by the CAESAR candidates, clustered by their underlying designs (block-cipher-, stream-cipher-, permutation-/sponge-, compression-function-based, dedicated). After intensive review and analysis of all 48 candidates by the community, the CAESAR committee selected only 30 candidates for the second round. The announcement for the third round candidates was made on 15th August 2016 and 15 candidates were chosen for the third round.     

Breaking the Shin-Shin-Rhee remotely keyed encryption schemes

Remotely keyed encryption (RKE) schemes provide fast symmetric encryption and decryption using a small-bandwidth security module and a powerful host. Such schemes keep the key inside the security module to prevent key compromise.Shin, Shin, and Rhee proposed a length-preserving as well as a length-increasing RKE scheme that both use only a single round of interaction between host and security module. With the length-preserving scheme they claim to answer an open problem of Blaze, Feigenbaum, and Naor.However, in the present paper we show that both their schemes are completely insecure. Further, we present heuristic arguments on why a one-round length-preserving RKE scheme might be impossible.     

Improvements of generalization of threshold signature and authenticated encryption for group communications

Recently, Wang et al. proposed a (t,n) threshold signature scheme with (k,l) threshold shared verification and a group-oriented authenticated encryption scheme with (k,l) threshold shared verification. However, this article will show that both the schemes violate the requirement of the (k,l) threshold shared verification. Further, two improvements are proposed to eliminate the pointed out security leaks inherent in the original schemes.     

Improved convertible authenticated encryption scheme with provable security

Convertible authenticated encryption (CAE) schemes allow a signer to produce an authenticated ciphertext such that only a designated recipient can decrypt it and verify the recovered signature. The conversion property further enables the designated recipient to reveal an ordinary signature for dealing with a later dispute over repudiation. Based on the ElGamal cryptosystem, in 2009, Lee et al. proposed a CAE scheme with only heuristic security analyses. In this paper, we will demonstrate that their scheme is vulnerable to the chosen-plaintext attack and then further propose an improved variant. Additionally, in the random oracle model, we prove that the improved scheme achieves confidentiality against indistinguishability under adaptive chosen-ciphertext attacks (IND-CCA2) and unforgeability against existential forgery under adaptive chosen-message attacks (EF-CMA).     

Enhancements of authenticated multiple key exchange protocol based on bilinear pairings

Lee et al. [4] proposed two new authenticated multiple key exchange protocols based on Elliptic Curve Cryptography (ECC) and bilinear pairings. In this paper, we show an impersonation attack on their pairing-based authenticated key exchange protocol. We demonstrate that any attacker can impersonate an entity to share multiple session keys with another entity of his/her choice by using only the public key of the victim. Moreover, their protocol fails to provide perfect forward secrecy, despite of their claim to the contrary. Thus, we propose a simple modification to the original protocol which avoids our attack.     

Symmetric key-based authenticated encryption protocol

ABSTRACT

Authenticated Encryption (AE) – is a block cipher mode of operation protocol which gives privacy, integrity, and authenticity confirmations on the data at the same time; incorporating decryption in a single step with an integrity check. The requirement for AE has risen out of the perception that safely integrating a confidentiality feature with an authentication feature could be error-prone and troublesome. It is confirmed by various practical assaults brought into the creation of authentication protocols and applications by wrong execution or lack of authentication. It is a challenge to design and develop such a kind of AE protocols which compromises authenticity and confidentiality with all possibly provable security notions. In this paper, we have developed a symmetric-key based fast, efficient, and secure AE protocol. Our protocol meets the objectives of distinguishing authentication, mutual authentication while guaranteeing data integrity, confidentiality, authenticity and secure key sharing between involved parties. We have used ProVerif to verify our proposed protocol formally and found it to be provably safe on all the standard tests.     

代理可转换认证加密方案

结合代理签名和可转换认证加密两种方案,提出了代理可转换认证加密方案和(t,n)门限代理方案。方案能够使一个代理人代理被代理人认证加密一个消息给某个特定的接收者。     

Cryptanalysis of an encryption scheme for binary images

In 1998, Chung and Chang proposed a new method to encrypt binary images. When compared to its predecessors, their method can actually obtain better compression ratio by putting different scan patterns at the same level in the scan tree structure and using the two-dimensional run-encoding technique. However, their scheme seems to be quite vulnerable to attacks if it uses the same key to encrypt different images. In this paper, we show that their scheme can be broken with some pairs of plain image and cipher image.     

A survey of certificateless encryption schemes and security models

This paper surveys the literature on certificateless encryption schemes. In particular, we examine the large number of security models that have been proposed to prove the security of certificateless encryption schemes and propose a new nomenclature for these models. This allows us to “rank” the notions of security for a certificateless encryption scheme against an outside attacker and a passive key generation centre, and we suggest which of these notions should be regarded as the “correct” model for a secure certificateless encryption scheme. We also examine the security models that aim to provide security against an actively malicious key generation centre and against an outside attacker who attempts to deceive a legitimate sender into using an incorrect public key (with the intention to deny the legitimate receiver that ability to decrypt the ciphertext). We note that the existing malicious key generation centre model fails to capture realistic attacks that a malicious key generation centre might make and propose a new model. Lastly, we survey the existing certificateless encryption schemes and compare their security proofs. We show that few schemes provide the “correct” notion of security without appealing to the random oracle model. The few schemes that do provide sufficient security guarantees are comparatively inefficient. Hence, we conclude that more research is needed before certificateless encryption schemes can be thought to be a practical technology.     

一种基于身份的认证加密方案的改进

基于身份加密是一种以用户的身份标识符作为公钥的加密体制。通过分析现有的基于身份的认证加密方案,针对其中存在的用户不能防止自身假冒其他用户发送消息给自己,即不能认证信息主体的真实性的安全隐患,结合双线性映射的特性,提出了改进方案。新方案的安全性是基于双线性Diffie-Hellman问题的,并对改进方案的安全性和效率进行了分析。结果表明,改进方案保持了原方案优点的同时,消除了隐患,进一步提高了安全性。     

A Convertible Multi-Authenticated Encryption scheme for group communications

Recently, Wu et al. proposed a Convertible Multi-Authenticated Encryption (CMAE) scheme, which allows a signing group with multiple signers to generate a multi-authenticated ciphertext signature on the chosen message so that only a designated verifier can recover and verify the message. In case of later dispute, the verifier can convert the multi-authenticated ciphertext signature into an ordinary one that can be verified by anyone. In this study, a CMAE scheme for group communications is proposed. This is presented by first reviewing the concepts of group-oriented encryption schemes and the merits of Wu et al.’s scheme. This shows that not only can a multi-authenticated ciphertext signature be generated by a signing group, but also the message can be recovered and verified by a verifying group with multiple verifiers. The security of the proposed scheme is based solely on the DDH problem, which provides higher security confidence than using the CDH problem in Wu et al.’s CMAE scheme.     

Bio-PUF-MAC authenticated encryption for iris biometrics

Biometrics is one of the ways for human authentication. Fabrication of biometrics by intruders, limits the accuracy of authentication. The user-specific keys (ie,) pseudo-random numbers give more security for biometric template protection and increase the accuracy of authentication also. The user-specific token or keys can also be fabricated by intruders by any of the prediction methods. To avoid the creation of fake biometric and fake user-specific keys, a device-specific Physical Unclonable Function (PUF) is proposed. In this article, iris authentication is provided by unclonable PUF-based true random numbers to enhance the unique authentication. Nonreversible Message Authentication Codes (MAC) are developed using PUF and Discrete Wavelet Transform features of iris biometrics. Systematically, MAC codes also created with, encryption algorithm. Encryption is additionally providing confidentiality in the individual iris. Experiments are done with CUHK Iris Image Dataset. Proposed Bio-PUF system has significant functional advantages in point of view of the unclonable pseudo-random number from PUF. Experimentally, Avalanche effect, entropy, NCPR, and UACI parameters are analyzed with PUF-based crypt functions. For 75% of matching with the Bio-PUF-MAC codes with enrolment, the accuracy for correct identification is 77.73%.     

Privacy leakage of certificateless public key authenticated searchable encryption via frequency analysis: Attacks and revises

Certificateless public key authenticated searchable encryption (CLPASE) is a versatile asymmetric searchable encryption that enables ciphertext retrieval, resists inside keyword guessing attacks, and avoids both certificate management problem and key escrow problem. However, most existing CLPASE schemes are vulnerable to frequency analysis which can extract keywords from user-generated trapdoors (i.e., search queries) and thus compromise user’s search privacy.In this paper, we give a detailed analysis showing that most CLPASE schemes reveal the underlying frequency distribution of the target keywords in the trapdoors searched by users, regardless of whether the trapdoor generation algorithm is deterministic or not. The analysis shows that frequency analysis has become a significant threat to users’ search privacy in the CLPASE system. To address this issue, we provide a concrete CLPASE scheme against frequency analysis. We then compare our scheme with previous CLPASE schemes in terms of features and performance evaluation. As a result, our scheme provides higher guarantee for user’s search privacy with comparable efficiency.     

Signature scheme with message recovery and its application

Recently Chen, [K. Chen, Signature with message recovery, Electronics Letters, 34(20) (1998) 1934], proposed a signature with message recovery. But Mitchell and Yeun [C. J. Mitchell and C. Y. Yeun, Comment - signature with message recovery, Electronics Letters, 35(3) (1999) 217] observed that Chen's scheme is only an authenticated encryption scheme and not a signature scheme as claimed. In this article, we propose a new signature scheme in the sense of Mitchell and Yeun and with message recovery feature. The designated verifier signature is introduced by Jakobsson et al. [M. Jakobsson, K. Sako, R. Impagliazzo, Designated verifier proofs and their applications, Proc. of Eurocrypt’96, LNCS 1070 (1996) pp. 143–154]. We propose a designated verifier signature scheme with non-repudiation of origin. We also give a protocol for a convertible designated verifier signature scheme with non-repudiation of origin. Both of these schemes are based on our proposed signature scheme with message recovery.     

Cryptanalysis of tripartite and multi-party authenticated key agreement protocols

Al-Riyami and Paterson proposed four authenticated tripartite key agreement protocols which make use of the Weil pairing. Recently, Lee et al. extended the protocols to a multi-party setting assuming the existence of cryptographic multilinear forms. In this paper we show that the tripartite and multi-party authenticated key agreement protocols are insecure against several active attacks.     

A pairing-free identity-based authenticated key agreement protocol with minimal message exchanges

Based on the computational Diffie-Hellman problem, this paper proposes an identity-based authenticated key agreement protocol which removes bilinear pairings. Compared with previous protocols, the new protocol minimizes message exchange time with no extra cost. The protocol provides strong security guarantees including key compromise impersonation resilience, perfect forward secrecy, and master key forward secrecy. A security proof with the modular approach in the modified Bellare-Rogaway model is also provided.     

Security of Wang et al.''s group-oriented (t,n) threshold signature schemes with traceable signers

This paper describes a new forgery attack on the group-oriented (t,n) threshold signature schemes proposed by Wang et al. Our attack is more fundamental than Tseng–Jan's attack in the sense that it cannot be recognized or blocked at the designated clerk level of the signature schemes.     

A weakness in OCB3 used with short nonces allowing for a break of authenticity and confidentiality

OCB3 is a mature and provably secure authenticated encryption mode of operation which allows for associated data (AEAD). This note reports a small flaw in the security proof of OCB3 that may cause a loss of security in practice, even if OCB3 is correctly implemented in a trustworthy and nonce-respecting module. The flaw is present when OCB3 is used with short nonces. It has security implications that are worse than nonce-repetition as confidentiality and authenticity are lost until the key is changed. The flaw is due to an implicit condition in the security proof and to the way OCB3 processes nonces. Different ways to fix the mode are presented.