基于身份加密中可验证的私钥生成外包算法

提出了包含私钥生成外包算法的基于身份加密方案,PKG将私钥生成的任务外包给服务器,并能有效验证外包结果的正确性。在标准模型中证明了方案的密文不可区分性和外包结果的可验证性,并对所提方案进行了仿真实现。实验结果表明,外包算法中PKG的计算量远小于直接生成用户私钥,且小于服务器的计算量。     

Oblivious transfer with access control and identity-based encryption with anonymous key issuing

In ACM’CCS 2009, Camenisch, et al. proposed the Oblivious Transfer with Access Control (AC-OT) in which each item is associated with an attribute set and can only be available, on request, to the users who have all the attributes in the associated set. Namely, AC-OT achieves access control policy for conjunction of attributes. Essentially, the functionality of AC-OT is equivalent to the simplified version that we call AC-OT-SV: for each item, one attribute is associated with it, and it is requested that only the users who possess the associated attribute can obtain the item by queries. On one hand, AC-OT-SV is a special case of AC-OT when there is just one associated attribute with each item. On the other hand, any AC-OT can be realized by an AC-OT-SV. In this paper, we first present a concrete AC-OT-SV protocol which is proved to be secure in the model defined by Camenisch, et al. Then from the protocol, interestingly, a concrete Identity-Based Encryption (IBE) with Anonymous Key Issuing (AKI) is given which is just a direct application to AC-OT-SV. By comparison, we show that the AKI protocol we present is more efficient in communications than that proposed by Chow.     

Novel hierarchical identity-based encryption scheme from lattice

Aiming at the high complexity in user’s private key extraction and large expansion ratio of trapdoor size in previous hierarchical identity-based encryption (HIBE) schemes,a new HIBE scheme was proposed.The implicit extension method to improve preimage sampling algorithm was used,and then combined the improved algorithm with MP12 trapdoor delegation algorithm to construct an efficient HIBE user’s private key extraction algorithm.Finally,the new extraction algorithm and the Dual-LWE algorithm was integrated to complete the scheme.Compared with the similar schemes,the efficiency of the proposed scheme was improved in system establishment and user’s private key extraction stage,the trapdoor size grows only linearly with the system hierarchical depth,and the improved preimage sample algorithm partly solves the Gaussian parameter increasing problem induced by MP12 trapdoor delegation.The security of the proposed scheme strictly reduces to the hardness of decisional learning with errors problem in the standard model.     

Novel identity-based fully homomorphic encryption scheme from lattice

The previous identity-based homomorphic encryption schemes from lattice was analyzed.That the high complexity in previous schemes was mainly caused by trapdoor generation and preimage sampling was pointed out.A new solution was proposed.A novel identity-based encryption scheme from lattice by combining new trapdoor function and dual-LWE algorithm organically was constructed,and it was transformed to an identity-based fully homomorphic encryption scheme from lattice by employing the idea of eigenvector.Comparative analysis shows that the scheme’s complexity of trapdoor generation has a significant reduction,the complexity of preimage sampling has a nearly three-fold reduction,and the SIVP approximation factor has a $\sqrt{m}$ times reduction.The security of the proposed scheme strictly reduces to the hardness of decisional learning with errors problem in the standard model.     

Fast key generation for Gentry-style homomorphic encryption

The key issue of original implementation for Gentry-style homomorphic encryption scheme is the so called slow key generation algorithm. Ogura proposed a key generation algorithm for Gentry-style somewhat homomorphic scheme that controlled the bound of the evaluation circuit depth by using the relation between the evaluation circuit depth and the eigenvalues of the primary matrix. However, their proposed key generation method seems to exclude practical application. In order to address this problem, a new key generation algorithm based on Gershgorin circle theorem was proposed. The authors choose the eigenvalues of the primary matrix from a desired interval instead of selecting the module. Compared with the Ogura's work, the proposed key generation algorithm enables one to create a more practical somewhat homomorphic encryption scheme. Furthermore, a more aggressive security analysis of the approximate shortest vector problem (SVP) against lattice attacks is given. Experiments indicate that the new key generation algorithm is roughly twice as efficient as the previous methods.     

ID-based authentication scheme combined with identity-based encryption with fingerprint hashing

Current identity-based （ID） cryptosystem lacks the mechanisms of two-party authentication and user＇s private key distribution. Some ID-based signcryption schemes and ID-based authenticated key agreement protocols have been presented, but they cannot solve the problem completely. A novel ID-based authentication scheme based on ID-based encrypfion （IBE） and fingerprint hashing method is proposed to solve the difficulties in the IBE scheme, which includes message receiver authenticating the sender, the trusted authority （TA） authenticating the users and transmitting the private key to them. Furthermore, the scheme extends the application of fingerprint authentication from terminal to network and protects against fingerprint data fabrication. The fingerprint authentication method consists of two factors. This method combines a token key, for example, the USB key, with the user＇s fingerprint hash by mixing a pseudo-random number with the fingerprint feature. The security and experimental efficiency meet the requirements of practical applications.     

一个新的具有欺骗识别功能的密钥托管方案

提出一个新的基于ElGamal公开密钥算法具有欺骗识别功能的密钥托管方案,采用公开可验证的秘密分享方法,使设计的密钥托管方案可以满足实际应用的需要。不仅各个密钥托管代理可以识别并阻止非法用户的欺骗行为,而且在恢复阶段监听机构也能够确切地验证出哪些托管代理伪造或篡改子密钥。方案采用了门限密钥托管方法,当存在一个和几个密钥托管代理不愿合作或不能合作时,仍能实现有效监听。方案中采用用户和CA共同生成私钥,防止了影子公钥的攻击。     

具有固定公钥和私钥长度的广播加密方案

利用双线性配对技术提出一个新的基于身份的广播加密方案。在标准模型下,证明了该方案具有适应性攻击安全模型下选择明文安全性。方案中的公钥参数和用户私钥均为固定长度,密文长度较短,并且,新方案还满足完全抗同谋攻击。与现有的广播加密方案相比,新方案更适用于存储量小的系统。     

Designing a secure designated server identity-based encryption with keyword search scheme: still unsolved

There exist only a few papers in the literature which target the problem of “proposing a secure designated server identity-based encryption with keyword search scheme.” In this paper, we prove that they all suffer from security issues, and therefore, this challenging problem still remains open.     

ATM cell encryption and key update synchronization

This paper presents a data compaction/randomization based approach as a mode of block encryption for ATM (Asynchronous Transfer Mode) cells. The presented approach converts a plaintext into pseudo‐random plaintext before ciphering to conceal patterns in the plaintext. The underlying idea behind this scheme is the Shannon's principles of “confusion” and “diffusion” which involve breaking dependencies and introducing as much randomness as possible into the ciphertext. In this scheme, confusion and diffusion are introduced into the system by first compressing the ATM cell payload and then spreading a continuously changing random data over the entire content of the cell. As a mode of operation for block ciphering, this scheme offers the following attractive features:(i) plaintext patterns are pseudo‐randomized and chained with ciphertext (thereby, preventing against “dictionary”, “known plaintext”, and “statistical analysis” attacks), (ii) it is self‐synchronizing, (iii) cell loss has no additional negative effect, (iv) no IV (Initialization Vector) storage is required, (v) it is encryption‐algorithm independent, (vi) there is no cell‐to‐cell dependency (no feedback from previous cells), and (vii) it is highly scalable (i.e., cells from the same stream can be ciphered and deciphered in parallel). This paper also presents a secure mechanism for in‐band synchronization of encryption/decryption key updates using a “marker‐cell” that is carried within the data channel. An important aspect of both the above mechanisms is that they do not require any changes to the ATM cell header or ATM infrastructure. This revised version was published online in June 2006 with corrections to the Cover Date.     

可公开验证的短密钥公钥加密方案

利用一个选择身份安全的基于身份加密方案(IBE)和2个目标抗碰撞散列函数,构造了一个可公开验证的公钥加密方案.在判定性BDHI假设的基础上,证明了新方案在标准模型下是适应性选择密文安全的.相比现有可公开验证的公钥加密方案,新方案的公私钥长度较短且与安全参数相互独立.     

针对服务器安全的指定验证者可搜索公钥加密

在指定验证者的可搜索公钥加密(dPEKS)中,提出IND-KGA-SERVER安全模型,形式化描述针对服务器的安全。基于IND-KGA安全的dPEKS、数字证书授权中心CA、以及强不可伪造和不可否认的签名,在攻击者是服务器的情况下构造出抗KG(keyword guessing)攻击的dPEKS方案。方案是从IND-KGA安全到IND-KGA-SERVER安全的编译器。     

标准模型下完美前向安全的基于身份认证密钥交换

一轮Diffie-Hellman密钥交换(One-Round Diff ie-Hellman key exchange,OR-DHKE)协议被认为无法实现完美的前向安全性(Perfect Forward Secrecy,PFS)。基于身份的OR-DHKE协议也是如此,现有研究仅实现了弱的完美 前向安全性(wPFS)。基于Cremers等人对密钥交换协议完美前向安全性的研究,文章提出 一种新的具有完美前向安全的基于身份认证密钥交换方案。文章首先提出一种较弱安全性的 基于身份 OR-DHKE协议π₀,然后采用Cremers等人提出的SIG变换方法,将π₀转化为具有完美前 向安全的基于身份认 证密钥交换方案π₁。文章简要分析了CK、CK⁺、eCK和eCK-PFS安全模型的异同,在此 基 础上定义了基于身 份认证密钥交换协议分析的强安全模型ID-eCK-PFS。在ID-eCK-PFS模型下,协议π₀和π₁的安全性被规约为 求解判定性BDH(Decisional Bilinear Diffie-Hellman,DBDH)问题,规约过程未使用随 机预言机,实现了在标准模型下的完美前向安全性和可证明安全性。     

Short cycling in the Kravitz-Reed public key encryption system

The Kravitz-Reed public key encryption system, a variant of the MIT system based on Galois fields, is interesting because it offers the potential of high security with efficient implementation. In the letter we demonstrate that high security and efficient implementation are not, in reality, compatible goals with this algorithm. Efficient implementation is subject to a short cycling attack that exposes the secret key to computation. If the parameters of the algorithm are selected for high security, then the algorithm cannot be efficiently implemented.     

可证安全的高效可托管公钥加密方案

可托管公钥加密方案中一个公钥对应于2个解密私钥,它可大大减少公钥基础设施PKI中公钥证书的数目,从而降低其公钥证书管理的负荷。同时对于用户端来说,它也能减小所需私钥存储空间,减轻用户的私钥管理负担。提出2个新的可托管公钥加密方案,其中第二个方案是文献中所有现存同类方案中最为高效的一个。它也是第一个可证安全的方案,其安全性基于标准的双线性Diffie-Hellman假设。     

Identity-based key agreement and encryption for wireless sensor networks

1 Introduction WSN has received considerable attention during last decade [1?4] (see, for example, the proceedings of the ACM and IEEE Workshops on WSN). It has wide variety of applications, including military sensing and tracking, environment and securit…     

Chosen plaintext attack on JPEG image encryption with adaptive key and run consistency

A JPEG image encryption with the adaptive key and run consistency of MCUs is proposed. The chosen-plaintext attack (CPA) is given here on this encryption scheme. First, the adaptive key can be reproduced from the encrypted image, so that the plaintext images with the same adaptive key can be constructed. Second, the existence of run consistency of MCUs (RCM) between the original image and the encrypted image facilitates rapid estimation. In addition, the single swap for the runs of MCUs with RCM is designed for more accurate estimation. Detailed cryptanalytic results suggest that this encryption scheme can only be used to realize perceptual encryption but not to provide content protection for digital images. Furthermore, applications of the CPA to break other encryption schemes with RCM are presented.     

An identity-based signature scheme from the Weil pairing

We come up with an ID-based signature scheme from the Weil pairing. Our scheme is secure if the Diffie-Hellman problem is hard. Furthermore, our signature size is only about a quarter of ID-based Guillou-Quisquater (1988) signature size.     

Common randomness and secret key generation with a helper

We consider the generation of common randomness (CR), secret or not secret, by two user terminals with aid from a “helper” terminal. Each terminal observes a different component of a discrete memoryless multiple source. The helper aids the users by transmitting information to them over a noiseless public channel subject to a rate constraint. Furthermore, one of the users is allowed to transmit to the other user over a public channel under a similar rate constraint. We study the maximum rate of CR which can be thus generated, including under additional secrecy conditions when it must be concealed from a wiretapper. Lower bounds for the corresponding capacities are provided, and single-letter capacity formulas are obtained for several special cases of interest