Algebraic MACs and Keyed-Verification Anonymous Credentials

Sensitive data are usually transferred within a vehicle using FlexRay protocol. To prevent the in-vehicle data from the manipulation and man-in-the-middle attacks through On Board Diagnostic (OBD-II) port, appropriate security schemes should be applied. In this paper, we propose a scheme to embed data integrity and confidentiality into the original FlexRay data frames and reuse the Cyclic Redundancy Check (CRC) field of existing FlexRay data frame to implement data integrity, which does not require to modify the current FlexRay protocol. We select a recently invented lightweight authenticated encryption scheme, AEGIS [5], to protect the dynamic frames, which achieves a shorter latency. We apply AES-CCM (Counter with CBC-MAC (CCM) [1]) to protect the static frames, whose latency is not stringent. We achieve a real-time 32-bit Message Authentication Code (MAC) for the static frames and an offline 64-bit MAC for the dynamic frames. In addition, we propose a unified architecture for implementing both AES-CCM and AEGIS, which reduces the required hardware resources. The experimental results show that our proposed design can achieve 3.71 Gbits/s and 9.44 Gbits/s for computing AES-CCM and AEGIS on automotive-grade XA Zynq-700 all programmable SoCs (XC7Z020), respectively. Compared to the state-of-the-art work of AES-CCM, our proposed design reduces 17.98% clock cycles.

We present a new Authenticated Encryption (AE) scheme based on finite automata using the method Encrypt-then-MAC. The scheme is constructed from two cryptographic primitives, a symmetric encryption scheme based on finite automata known as FASKC and a Message Authentication Code (MAC) constructed from a finite automaton. The paper shows how the scheme works and how to construct a MAC from a finite automaton using a boolean function with good cryptographic properties. Due to the construction method and the assumption that the symmetric encryption scheme is secure under Chosen Plaintext Attack (CPA), it is shown that the MAC is unforgeable under Chosen Message Attack (UF-CMA) making the scheme secure under Chosen Ciphertext Attack (CCA).

Oblivious Transfer(OT) protocol is a fundamental primitive in the modern cryptography. In the realistic unauthenticated setting, we should consider message authentication which is a prime necessity in the information security. It is, however, not considered in general for designing OT protocol because we can provide it in modular way. A shared key is established by authenticated key-exchange(AKE) protocol and used with message authentication code(MAC). By the way, the existing solutions for authentication introduce non-negligible computational overheads such as modular exponentiation. Thus, we have the following question: “Can we build the more efficient authentgnicated OT protocol?” In this work, we show, by presenting an efficient authenticated variant of Naor-Pinkas OT, that it is possible with little costs. We present a conceptually simple and unified primitive that does not require the authenticated channel assumption.

We present a fully secure ciphertext-policy attribute-based encryption (CP-ABE) scheme in prime order group by using a tool which can convert composite order paring-based encryption scheme into prime order one. Although, a fully secure CP-ABE scheme in prime order group has been proposed recently, our scheme needs less master secret key size and can be seen as a different version of it. Besides, the sketch of our scheme's security proof is also given.

Recently, Lu et al. and Chaudhry et al. presented an authenticated key agreement scheme for session initiation protocol (SIP), respectively. They illustrated their schemes are secure against various familiar attacks. However, we demonstrate Lu et al.’s scheme is vulnerable to stolen verifier attack and Chaudhry et al.’s scheme is insecure to session key attack. To solve these problems, we propose a new provably secure mutual authentication scheme for SIP. Informal security analysis illustrates this proposed protocol can withstand different kinds of familiar attacks including stolen verifier attack and session key attack. And the correctness and security of the proposed protocol is also proved through Protocol Composition Logic (PCL) and generic group model. Eventually, security comparison shows our proposed scheme is more secure and performance analysis demonstrates the computation cost is also acceptable.

The generic group model (GGM) is a commonly used tool in cryptography, especially in the analysis of fundamental cryptographic problems, such as the complexity of the discrete logarithm problem [1,2,3] or the relationship between breaking RSA and factoring integers [4,5,6]. Moreover, the GGM is frequently used to gain confidence in the security of newly introduced computational problems or cryptosystems [7,8,9,10,11]. The GGM serves basically as an idealization of an abstract algebraic group: An algorithm is restricted to basic group operations, such as computing the group law, checking for equality of elements, and possibly additional operations, without being able to exploit any specific property of a given group representation. Different models formalizing the notion of generic groups have been proposed in the literature. Although all models aim to capture the same notion, it is not obvious that a security proof in one model implies security in the other model. Thus the validity of a proven statement may depend on the choice of the model. In this paper we prove the equivalence of the models proposed by Shoup [2] and Maurer [3].

We introduce $$\textsf{Corr}\textsf{GapCDH}$$ , the Gap Computational Diffie-Hellman problem in the multi-user setting with Corruptions. In the random oracle model, our assumption tightly implies the security of the authenticated key exchange protocols $$\textsf{NAXOS}$$ in the eCK model and (a simplified version of) $$\textsf{X3DH}$$ without ephemeral key reveal. We prove hardness of $$\textsf{Corr}\textsf{GapCDH}$$ in the generic group model, with optimal bounds matching the one of the discrete logarithm problem. We also introduce $$\textsf{CorrCR}\textsf{GapCDH}$$ , a stronger Challenge-Response variant of our assumption. Unlike standard $$\textsf{GapCDH}$$ , $$\textsf{CorrCR}\textsf{GapCDH}$$ implies the security of the popular AKE protocol HMQV in the eCK model, tightly and without rewinding. Again, we prove hardness of $$\textsf{CorrCR}\textsf{GapCDH}$$ in the generic group model, with (almost) optimal bounds. Our new results allow implementations of $$\textsf{NAXOS}$$ , $$\textsf{X3DH}$$ , and $$\textsf{HMQV}$$ without having to adapt the group sizes to account for the tightness loss of previous reductions. As a side result of independent interest, we also obtain modular and simple security proofs from standard $$\textsf{GapCDH}$$ with tightness loss, improving previously known bounds.

Recent work on structure-preserving signatures studies optimality of these schemes in terms of the number of group elements needed in the verification key and the signature, and the number of pairing-product equations in the verification algorithm. While the size of keys and signatures is crucial for many applications, another important aspect to consider for performance is the time it takes to verify a given signature. By far, the most expensive operation during verification is the computation of pairings. However, the concrete number of pairings that one needs to compute is not captured by the number of pairing-product equations considered in earlier work.To fill this gap, we consider the question of what is the minimal number of pairings that one needs to compute in the verification of structure-preserving signatures. First, we prove lower bounds for schemes in the Type II setting that are secure under chosen message attacks in the generic group model, and we show that three pairings are necessary and that at most one of these pairings can be precomputed. We also extend our lower bound proof to schemes secure under random message attacks and show that in this case two pairings are still necessary.Second, we build an automated tool to search for schemes matching our lower bounds. The tool can generate automatically and exhaustively all valid structure-preserving signatures within a user-specified search space, and analyze their (bounded) security in the generic group model. Interestingly, using this tool, we find a new randomizable structure-preserving signature scheme in the Type II setting that is optimal with respect to the lower bound on the number of pairings, and also minimal with respect to the number of group operations that have to be computed during verification.KeywordsGroup ElementSignature SchemeSignature ElementBlind SignatureSigning AlgorithmThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Regular (non-private) mining can be applied to manage and utilize accumulated transaction data. For example, the accumulated relative service time per user per month can be calculated given individual transaction from which the user compliance with a service agreement can be determined and possibly billing can be processed. Nevertheless, due to user concerns, cryptographic research developed transactions based on unlinkable anonymous credentials. Given the nature of anonymous credentials the ease of managing accumulated (e.g., per user) is lost. To restore the possibility of management and accumulation of it seems that a suitable form of preserving mining is needed. Indeed, preserving mining methods have been suggested for various protocols and interactions where individual can be contributed in an encrypted form, but not within the context of anonymous credentials. Given our motivation we suggest a new notion of performing privacy preserving mining within the context of anonymous cryptographic credential systems, so as to protect both the of individually contributed and the identity of their sources while revealing only what is needed. To instantiate our approach we focus on a primitive we call data mining group signatures (DMGS), where it is possible for a set of authorities to employ distributed quorum control for conducting preserving mining operations on a batch of transactions while preserving maximum possible anonymity. We define and model the new primitive and its security goals, we then present a construction and finally show its and security properties. Along the way we build a methodology that safely combines multi-server protocols as sub-procedures in a more general setting.

Optimized authentication algorithm for privacy-preserving anonymous credentials using randomized aggregate signatures

The beyond 5G networks (B5G) are characterized by high throughputs at extremely low latencies and better energy consumptions. This has seen them being deployed as the backbone of numerous Internet of Things (IoT) application domains such as smart homes, smart cities and in intelligent transport systems. Massive and private data flows in these ultra-dense networks and hence the need to protect them. As such, the Third-Generation Partnership Project (3GPP) has defined Authentication and Key Agreement (AKA) protocols for secure signaling and packet exchanges in these networks. However, these AKA protocols are susceptible to numerous attacks, such as impersonation and packet replays. This has seen the development of numerous schemes based on techniques such as public key cryptography, biometrics, group signatures and blockchain. Unfortunately, these schemes fail to offer the required levels of security and privacy protection at low execution time, energy and bandwidths. In this paper, a protocol is developed that leverages on the message authentication codes, symmetric cryptography and elliptic curve cryptography. It is shown that the proposed protocol is secure under the Dolev–Yao model. In terms of performance, it exhibited the lowest execution time and has the lowest bandwidth requirements.KeywordsAuthenticationCryptographyDolev–YaoECCKey agreementPrivacySecurity

One of the most important and successful tools for assessing hardness assumptions in cryptography is the Generic Group Model (GGM). Over the past two decades, numerous assumptions and protocols have been analyzed within this model. While a proof in the GGM can certainly provide some measure of confidence in an assumption, its scope is rather limited since it does not capture group-specific algorithms that make use of the representation of the group.

Oblivious Pseudorandom Functions (OPRFs) allow a client to evaluate a pseudorandom function (PRF) on her secret input based on a key that is held by a server. In the process, the client only learns the PRF output but not the key, while the server neither learns the input nor the output of the client. The arguably most popular OPRF is due to Naor, Pinkas and Reingold (Eurocrypt 2009). It is based on an Oblivious Exponentiation by the server, with passive security under the Decisional Diffie-Hellman assumption. In this work, we strengthen the security guarantees of the NPR OPRF by protecting it against active attacks of the server. We have implemented our solution and report on the performance. Our main result is a new batch OPRF protocol which is secure against maliciously corrupted servers, but is essentially as efficient as the semi-honest solution. More precisely, the computation (and communication) overhead is a multiplicative factor o ( 1 ) as the batch size increases. The obvious solution using zero-knowledge proofs would have a constant factor overhead at best, which can be too expensive for certain deployments. Our protocol relies on a novel version of the DDH problem, which we call the Oblivious Exponentiation Problem (OEP), and we give evidence for its hardness in the Generic Group model. We also present a variant of our maliciously secure protocol that does not rely on the OEP but nevertheless only has overhead o ( 1 ) over the known semi-honest protocol. Moreover, we show that our techniques can also be used to efficiently protect threshold blind BLS signing and threshold ElGamal decryption against malicious attackers.

In an anonymous credential system, a user can obtain credentials from the organization and can prove the possession of credentials to the service providers, without leaking the privacy. There are three kinds of parties in the scheme: organization, service providers and users. In the previous works, the anonymous credentials schemes cannot prevent the collusion between the organization and the service providers from finding the users' privacy. In this paper, a scheme of anti-collusion anonymous credentials is proposed, it can be based on any secure public key algorithm. In the scheme, there doesn't need a trusted third party to issue the public keys and the secret keys, the scheme take the advantage of the relation of the public key and the secret key, i.e., it is easy to generate a pair of public key and the corresponding secret key, but hard to deduce the secret key from a particular public key. Therefore, the participant only need to have the ability to generate a pair of public key and secret key.

Secure identity tokens such as Electronic Identity (eID) cards are emerging everywhere. At the same time user-centric identity management gains acceptance. Anonymous credential schemes are the optimal realization of user-centricity. However, on inexpensive hardware platforms, typically used for eID cards, these schemes could not be made to meet the necessary requirements such as future-proof key lengths and transaction times on the order of 10 seconds. The reasons for this is the need for the hardware platform to be standardized and certified. Therefore an implementation is only possible as a Java Card applet. This results in severe restrictions: little memory (transient and persistent), an 8-bit CPU, and access to hardware acceleration for cryptographic operations only by defined interfaces such as RSA encryption operations.Still, we present the first practical implementation of an anonymous credential system on a Java Card 2.2.1. We achieve transaction times that are orders of magnitudes faster than those of any prior attempt, while raising the bar in terms of key length and trust model. Our system is the first one to act completely autonomously on card and to maintain its properties in the face of an untrusted terminal. In addition, we provide a formal system specification and share our solution strategies and experiences gained and with the Java Card.