Lattice-based certificateless encryption scheme

Certificateless public key cryptography (CL-PKC) can solve the problems of certificate management in a public key infrastructure (PKI) and of key escrows in identity-based public key cryptography (ID-PKC). In CL-PKC, the key generation center (KGC) does not know the private keys of all users, and their public keys need not be certificated by certification authority (CA). At present, however, most certificateless encryption schemes are based on large integer factorization and discrete logarithms that are not secure in a quantum environment and the computation complexity is high. To solve these problems, we propose a new certificate-less encryption scheme based on lattices, more precisely, using the hardness of the learning with errors (LWE) problem. Compared with schemes based on large integer factorization and discrete logarithms, the most operations are matrixvector multiplication and inner products in our scheme, our approach has lower computation complexity. Our scheme can be proven to be indistinguishability chosen ciphertext attacks (IND-CPA) secure in the random oracle model.     

Breaking the Shin-Shin-Rhee remotely keyed encryption schemes

Remotely keyed encryption (RKE) schemes provide fast symmetric encryption and decryption using a small-bandwidth security module and a powerful host. Such schemes keep the key inside the security module to prevent key compromise.Shin, Shin, and Rhee proposed a length-preserving as well as a length-increasing RKE scheme that both use only a single round of interaction between host and security module. With the length-preserving scheme they claim to answer an open problem of Blaze, Feigenbaum, and Naor.However, in the present paper we show that both their schemes are completely insecure. Further, we present heuristic arguments on why a one-round length-preserving RKE scheme might be impossible.     

一个安全无证书的盲签名方案

提出了一个安全无证书的盲签名方案。新方案预运算e(P,P)=g作为系统公开参数,无需使用特殊的MapToPoint哈希函数,提高了方案的计算效率;同时方案中密钥生成中心（KGC）与用户间不再需要可信的安全通道,更加适合实际应用。此外新方案采用了无证书公钥密码体制,解决了基于证书签名方案的证书管理问题和基于身份签名方案的密钥托管问题。在q-SDH和CDH困难假设下新方案是不可伪造的。     

Privacy leakage of certificateless public key authenticated searchable encryption via frequency analysis: Attacks and revises

Certificateless public key authenticated searchable encryption (CLPASE) is a versatile asymmetric searchable encryption that enables ciphertext retrieval, resists inside keyword guessing attacks, and avoids both certificate management problem and key escrow problem. However, most existing CLPASE schemes are vulnerable to frequency analysis which can extract keywords from user-generated trapdoors (i.e., search queries) and thus compromise user’s search privacy.In this paper, we give a detailed analysis showing that most CLPASE schemes reveal the underlying frequency distribution of the target keywords in the trapdoors searched by users, regardless of whether the trapdoor generation algorithm is deterministic or not. The analysis shows that frequency analysis has become a significant threat to users’ search privacy in the CLPASE system. To address this issue, we provide a concrete CLPASE scheme against frequency analysis. We then compare our scheme with previous CLPASE schemes in terms of features and performance evaluation. As a result, our scheme provides higher guarantee for user’s search privacy with comparable efficiency.     

Authenticated encryption schemes with message linkages for message flows

Two efficient authenticated encryption schemes with message linkages are proposed. One is a basic scheme, that it has the better performance in comparison with the all previously proposed schemes in terms of the communication and the computation costs. However, it has a property as same as the previously proposed schemes, that the message blocks can be recovered only after the entire signature blocks have been received. Therefore, the basic scheme is applicable to encrypt all-or-nothing flow. Thus, we improve the basic scheme and also propose a generalized scheme, which allows the receiver to recover the partial message blocks before receiving the entire signature blocks. That is, the receiver may perform the receiving and the recovering processes simultaneously. Therefore, the generalized scheme is applicable to message flows. The generalized scheme requires smaller bandwidth and computational time as compared to the previously proposed authenticated encryption schemes with message linkages for message flows.     

Ciphertext verification security of symmetric encryption schemes

This paper formally discusses the security problem caused by the ciphertext verification,presenting a new security notion named IND-CVA(indistinguishability under ciphertext verification attacks) to characterize the privacy of encryption schemes in this situation. Allowing the adversary to access to both encryption oracle and ciphertext verification oracle,the new notion IND-CVA is slightly stronger than IND-CPA(indistinguishability under chosen-plaintext attacks) but much weaker than IND-CCA(indistinguisha...     

General classification of the authenticated encryption schemes for the CAESAR competition

An authenticated encryption scheme is a scheme which provides privacy and integrity by using a secret key. In 2013, CAESAR (the “Competition for Authenticated Encryption: Security, Applicability, and Robustness”) was co-founded by NIST and Dan Bernstein with the aim of finding authenticated encryption schemes that offer advantages over AES-GCM and are suitable for widespread adoption. The first round started with 57 candidates in March 2014; and nine of these first-round candidates were broken and withdrawn from the competition. The remaining 48 candidates went through an intense process of review, analysis and comparison. While the cryptographic community benefits greatly from the manifold different submission designs, their sheer number implies a challenging amount of study. This paper provides an easy-to-grasp overview over functional aspects, security parameters, and robustness offerings by the CAESAR candidates, clustered by their underlying designs (block-cipher-, stream-cipher-, permutation-/sponge-, compression-function-based, dedicated). After intensive review and analysis of all 48 candidates by the community, the CAESAR committee selected only 30 candidates for the second round. The announcement for the third round candidates was made on 15th August 2016 and 15 candidates were chosen for the third round.     

一个新的无证书多重无链接签名方案*

基于无证书密码体制,提出一个新的多重无链接签名方案,新方案允许用户在不同的应用场合中使用不同的身份信息,并要求由这些身份所导出的不同公钥对应的签名密钥是唯一的,不同公钥的使用可以保证公钥的无链接性,从而更好地保护用户的隐私。在随机预言模型下,新方案可以抵抗适应性选择消息攻击。     

Simulatability and security of certificateless threshold signatures

We analyze the relationship between the notion of certificateless public key cryptography (CL-PKC) and identity-based schemes without a trusted private key generator (PKG), formally define the security of certificateless threshold signatures, and propose a concrete implementation based on bilinear pairings. To exhibit the security of our proposal, we develop the theory of simulatability and relationship between the certificateless threshold signatures and the underlying (non-threshold) ID-based signatures. We show that the proposed scheme is robust and existentially unforgeable against adaptively chosen message attacks under CDH assumption in the random oracle model.     

Relations between semantic security and anonymity in identity-based encryption

Semantic security and anonymity are the two main properties that an identity-based encryption scheme can satisfy. Such properties can be defined in either an adaptive or a selective scenario, which differ on the moment where the attacker chooses the identity/ies that are the target of the attack. There are well-known separations between selective and adaptive semantic security on the one hand, and between selective and adaptive anonymity on the other hand.In this paper we investigate the relations between these selective and adaptive notions, for identity-based encryption schemes enjoying at the same time some security and anonymity properties. On the negative side, we prove that there is a separation between selective and adaptive anonymity even for schemes which enjoy adaptive semantic security. On the positive side, we prove that selective semantic security and adaptive anonymity imply adaptive semantic security.     

Improvements of authenticated encryption schemes with message linkages for message flows

Recently, Tseng et al. proposed two authenticated encryption schemes (basic scheme and generalized scheme) with message linkages, which are efficient in terms of the communication and computation costs in comparison with all the previously proposed schemes. The basic authenticated encryption scheme suited for only after receiving the entire signature blocks, the recipient can then recover the message blocks. In order to allow the receiver to perform the receiving and the recovering processes simultaneously according to application requirements and the transmission efficiency of the network, the generalized authenticated encryption scheme was then proposed. In this paper, we show that both Tseng et al.’s authenticated encryption schemes do not achieve integrity and authentication. Improvements are then proposed to repair the weaknesses.     

Breaking the short certificateless signature scheme

Certificateless cryptography eliminates the need of certificates in the Public Key Infrastructure and solves the inherent key escrow problem in the identity-based cryptography. Recently, Huang et al. proposed two certificateless signature schemes from pairings. They claimed that their first short certificateless signature scheme is provably secure against a normal type I adversary and a super type II adversary. In this paper, we show that their short certificateless signature scheme is broken by a type I adversary who can replace users’ public keys and access to the signing oracle under the replaced public keys.     

新的不使用冗余和Hash的安全认证加密方案

最近提出的一类新的认证加密方案首次将消息可恢复签名和对称加密有机结合,而且不需要使用Hash函数或Redundancy函数。但分析发现该方案不具有数字签名所要求的基本条件,不能抵抗消息接收者的伪造攻击。为此提出了一种新的认证加密方案,该方案的安全性以求解离散对数难题和双重模难题为基础,而且可以在发生纠纷时将认证加密的签名转化为普通的签名,任何人都可以验证签名的有效性。     

A survey of lattice based expressive attribute based encryption

Attribute Based Encryption (ABE) can be employed to enforce fine grained access control over encrypted data. Due to expressiveness, ABE schemes are currently employed in cloud computing and storage systems. The classical ABE schemes based on bilinear pairing are vulnerable to quantum cryptanalysis, whereas ABE schemes from lattices can resist quantum attacks. In this work, we comprehensively survey various kinds of attribute based encryption schemes in the lattice setting in terms of expressiveness, complexity assumptions, efficiency, security and so on. We also discuss attribute based encryption schemes from lattices deserving further research to specify future directions for cryptographers.     

Relations between the security models for certificateless encryption and ID-based key agreement

We discuss the relationship between ID-based key agreement protocols, certificateless encryption and ID-based key encapsulation mechanisms. In particular we show how in some sense ID-based key agreement is a primitive from which all others can be derived. In doing so we focus on distinctions between what we term pure ID-based schemes and non-pure schemes, in various security models. We present security models for ID-based key agreement which do not “look natural” when considered as analogues of normal key agreement schemes, but which look more natural when considered in terms of the models used in certificateless encryption. We illustrate our models and constructions with two running examples, one pairing based and one non-pairing based. Our work highlights distinctions between the two approaches to certificateless encryption and adds to the debate about what is the “correct” security model for certificateless encryption.     

Improved convertible authenticated encryption scheme with provable security

Convertible authenticated encryption (CAE) schemes allow a signer to produce an authenticated ciphertext such that only a designated recipient can decrypt it and verify the recovered signature. The conversion property further enables the designated recipient to reveal an ordinary signature for dealing with a later dispute over repudiation. Based on the ElGamal cryptosystem, in 2009, Lee et al. proposed a CAE scheme with only heuristic security analyses. In this paper, we will demonstrate that their scheme is vulnerable to the chosen-plaintext attack and then further propose an improved variant. Additionally, in the random oracle model, we prove that the improved scheme achieves confidentiality against indistinguishability under adaptive chosen-ciphertext attacks (IND-CCA2) and unforgeability against existential forgery under adaptive chosen-message attacks (EF-CMA).     

Self-generated-certificate public key encryption without pairing and its application

Recently, Liu et al. [26] discovered that Certificateless Public Key Encryption (CL-PKE) suffers the Denial-of-Decryption (DoD) attack. Based on CL-PKC, the authors introduced a new paradigm called Self-Generated-Certificate Public Key Cryptography (SGC-PKC) that captured the DoD attack and proposed the first scheme derived from a novel application of Water’s Identity-Based Encryption scheme [43]. In this paper, we propose a new SGC-PKE scheme that does not depend on the bilinear pairings and hence, is more efficient and requires shorter public keys than Liu et al.’s scheme. More importantly, our scheme reaches Girault’s trust level 3 [16] (cf. Girault’s trust level 2 of Liu and Au’s scheme), the same trust level achieved by a traditional PKI. In addition, we also discuss how our scheme can lead to a secure and self-organized key management and authentication system for ad hoc wireless networks with a function of user-controlled key renewal.     

一个改进的无证书签名和盲签名方案

改进了Zhang等人的无证书签名方案,使新的无证书签名方案在签名和验证阶段只需两个双线性运算。新的无证书签名方案在随机预言模型下被证明是安全的。它的安全性建立在计算Diffie-Hellman问题的困难性之上。同时,基于新的无证书签名方案,还给出一个无证书盲签名方案。无证书盲签名方案的安全性归结到新的无证书签名方案的安全性。     

Simulatable certificateless two-party authenticated key agreement protocol

Key agreement (KA) allows two or more users to negotiate a secret session key among them over an open network. Authenticated key agreement (AKA) is a KA protocol enhanced to prevent active attacks. AKA can be achieved using a public-key infrastructure (PKI) or identity-based cryptography. However, the former suffers from a heavy certificate management burden while the latter is subject to the so-called key escrow problem. Recently, certificateless cryptography was introduced to mitigate these limitations. In this paper, we first propose a security model for AKA protocols using certificateless cryptography. Following this model, we then propose a simulatable certificateless two-party AKA protocol. Security is proven under the standard computational Diffie-Hellman (CDH) and bilinear Diffie-Hellman (BDH) assumptions. Our protocol is efficient and practical, because it requires only one pairing operation and five multiplications by each party.