Anonymous certificate-based broadcast encryption with constant decryption cost

Fiat and Naor [5] presented at Crypto '93 a new encryption scheme designed for broadcast transmissions. The feature of this scheme is to allow a central broadcast site to broadcast secure transmissions to an arbitrary set of recipients. In this paper we model the problem of unconditionally secure broadcast encryption schemes with an information theoretic framework. We obtain tight limitations both on the number of private keys associated with each user and on the number of keys generated by the center. Finally, we consider the model where interaction is allowed in the common key computation phase proving that the interaction cannot help in decreasing the size of the pieces of information given to the users in the broadcast encryption schemes.

Broadcast encryption with personalized messages (BEPM) is a newly proposed cryptographic primitive, which supports a broadcaster to deliver the common encrypted broadcast message to a group of authorized users. It also supports a broadcaster to deliver the personalized messages to the individual authorized users simultaneously. However, none of the existing BEPM schemes consider the anonymity of authorized users, which is a crucial security requirement for many BEPM application scenarios. Besides, the previous studies on BEPM only achieve security against chosen-plaintext attack adversaries. Certificate-based cryptosystem gives a viable way to construct more secure and efficient BEPM schemes. We propose the new concept of anonymous certificate-based broadcast encryption with personalized messages (ANON-CBBE-PM). Subsequently, we illustrate the formal definition and the security model of ANON-CBBE-PM. Furthermore, we present an ANON-CBBE-PM scheme, which solves key escrow problem in identity-based cryptosystem and certificate management problem in traditional public key cryptosystem. Compared with the existing BEPM schemes, the proposed scheme not only protects the privacy of authorized users, but also has advantage in performance. To be more specific, the lengths of the user secret key and the system public parameters, as well as the cost for decryption are constant. For those BEPM applications with a multitude of users whose computing ability is limited, the proposed scheme is more practical. In addition, our scheme simultaneously achieves anonymity and confidentiality under adaptive chosen-ciphertext attack in the standard model.

In this study, the authors present an efficient public-key broadcast encryption (PKBE) scheme with sub-linear size of public keys, private keys and ciphertexts and prove its adaptive security under standard assumptions. Compared with the currently best scheme of Garg et al. (CCS 2010) that provides adaptive security under standard assumptions and sub-linear size of various parameters, the ciphertext size of the author's scheme is 94% shorter and the encryption algorithm of their scheme is also 2.8 times faster than the scheme of Garg et al. To achieve their scheme, they adapt the dual system encryption technique of Waters. However, there is a challenging problem to use this technique for the construction of PKBE with sub-linear size of ciphertexts such as a tag compression problem. To overcome this problem, they first devise a novel tag update technique for broadcast encryption. Using this technique, they build an efficient PKBE scheme in symmetric bilinear groups, and prove its adaptive security under standard assumptions.

Broadcast encryption is a primary technology that has been used for content protection. It enables a broadcaster to distribute content to a set of users so that only a privileged subset of users can access the content and another subset of revoked users cannot access the content. The main enabling block in a broadcast encryption scheme is the session key block, which each authorized user processes differently, but each gets the same valid session key. Currently all existing broadcast encryption schemes have assumed that the content and authorized users are equally privileged. There are emerging scenarios that demand protection for content with different privileges and for users with different privileges. In this paper we shall present a new broadcast encryption scheme that continues to employ single session key blocks but provides different privileged protections for different content and users. In particular we will expand the elegant subset-cover-based broadcast encryption scheme. We shall introduce a new concept called “security class” into the session key blocks. We use keys derived from a chain of one-way functions. Our approach is simple, efficient and secure.

Broadcast encryption is a novel concept for sending a special message to a subset of users. In broadcast encryption schemes, the distribution center broadcasts the message in encrypted form and expect that only the intended users be able to decrypt the message. This concept has several applications such as pay-per-service TVs. In this paper, we investigate one of the most recent broadcast encryption schemes and show that the introduced scheme does not provide the main requirement of broadcast encryption schemes. For this purpose, we demonstrate that all of the users, including authorized and unauthorized users, can decrypt the broadcasted encrypted message.

Broadcast Encryption (BE) schemes allow a sender to efficiently encrypt messages for a large set of receivers. The currently most efficient BE schemes in the stateless receiver scenario are based on symmetric cryptography. However, a variety of business models with mutually mistrusting senders necessitates the use of asymmetric cryptography. We propose a generic framework that allows to transform a large class of symmetric BE schemes into asymmetric schemes, where the transformation employs an arbitrary hierarchical identity based encryption scheme. Applying our framework, we transform a recent symmetric scheme, called layered punctured interval scheme, for which no asymmetric version has yet been published. In addition, we give a formal proof of the chosen ciphertext security of our framework, which allows to generically transform any future symmetric BE scheme within the large class into a chosen-ciphertext-secure asymmetric scheme with the same efficiency measures.

We propose a new and efficient scheme for broadcast encryption. A broadcast encryption system allows a broadcaster to send an encrypted message to a dynamically chosen subset RS, |RS|=n, of a given set of users, such that only users in this subset can decrypt the message. An important component of broadcast encryption schemes is revocation of users by the broadcaster, thereby updating the subset RS. Revocation may be either temporary, for a specific cipher text, or permanent. In the existing public key schemes which support temporary revocation of the users, the broadcaster is required to keep track of the revoked users. We present the first public key broadcast encryption scheme that supports permanent revocation of users. Unlike previous schemes, the broadcaster in our scheme should not keep track of the revoked users (saving memory and computation power). Our scheme is fully collusion-resistant. In other words, even if all the revoked users collude, the revoked user cannot encrypt messages without receiving new keys from the broadcaster. The procedure is based on Cipher-text Policy Attribute-Based Encryption (CP-ABE). The overhead of revocation in our system is constant in all major performance measures including length of private and public keys, computational complexity, user's storage space, and computational complexity of encryption and decryption. The scheme we construct improves on our original scheme in a poster presentation [7] by a factor of O(log n) in all major performance measures.

The task of searchable encryption schemes in multi-user setting is to handle the problem of dynamical user injection and revocation with consideration of feasibility. Especially, we have to make sure that user revocation will not cause security problem, such as leakage of secret key. Recently, fine-grained access control using trusted third party is proposed to resolve this issue. However, it increases the management complexity for maintaining massive authentication information of users. We present a new concept of coarse-grained access control for the first time and use it to construct a multi-user searchable encryption model in hybrid cloud. In our construction, there are two typical schemes, one is broadcast encryption (BE) scheme to simplify access control, the other is a single-user searchable encryption scheme, which supports two-phases operation and is secure when untrustful server colludes with the adversary. Moreover, we implement such a practical scheme using an improved searchable symmetric encryption scheme, and security analysis support our scheme.

Broadcast authentication schemes that employ only symmetric PRFs include certificates-based schemes like one-time-signatures (OTS), and timed efficient stream loss tolerant authentication (TESLA), and identity-based schemes based on probabilistic subset allocation. Identity-based subset allocation schemes can take advantage of the decrypt only when necessary (DOWN) assurance and plentiful untrusted storage resources to realize compact signatures. Well known broadcast encryption (BE) schemes are tree based. Only some of them can be extended to facilitate broadcast by multiple sources, but only by employing asymmetric primitives. BE schemes based on probabilistic key distribution, however, readily extends themselves to multiple source scenarios. They can be as efficient as the most efficient of tree-based schemes in terms of bandwidth overhead for the encrypted broadcast. Furthermore, they have the ability to offer privacy of group memberships as broadcasts do not have to explicitly specify the identities of revoked nodes. This chapter also outlines the utility of BE schemes based on subset allocation for generic publish–subscribe systems, where group keys and predistributed keys are protected by a tamper-responsive module like a smart-card associated with each participant.

Securing Network Program update is essential for many crucial military applications. Present Network Programming protocols proposed by Hailun Tan et al. provides confidentiality and authentication with high computational effort and power consumption. We have developed a confidential network program update protocol for clustered wireless sensor networks. Our scheme has two phases, key computation phase and network program update phase. In key computation phase, we provide an efficient key computation scheme for securing the program image. The key is dynamically computed using broadcast encryption scheme when required without storing neither any keys before deployment, nor communicating directly. Network program update phase follows an approach based on Deluge, an open source code dissemination protocol, and provides confidentiality along with authentication. An immediate and independent authentication is achieved without time synchronization between the base station and the sensor nodes. The scheme is resilient to malicious program image injection by the compromised nodes. Mobile agents are used to know about the node compromise. We implement our scheme in TinyOS and evaluate the performance.

Recently Cash, Kiltz, and Shoup [13] showed a variant of the Cramer-Shoup (CS) scheme [14] whose chosen-ciphertext (CCA) security relies on the computational Diffie-Hellman (CDH) assumption. The cost for this high security is that the size of ciphertexts is much longer than the CS scheme (which is based on the decisional Diffie-Hellman assumption). In this paper, we show how to achieve CCA-security under the CDH assumption without increasing the size of ciphertexts. We also show a more efficient scheme under the hashed Diffie-Hellman assumption. Both of our schemes are based on a certain broadcast encryption (BE) scheme while the Cash-Kiltz-Shoup scheme is based on the Twin DH problem. Of independent interest, we also show a generic method of constructing CCA-secure PKE schemes from BE schemes.

We consider broadcast encryption schemes wherein a center needs to broadcast a secret message to a privileged set of receivers. We prescribe a probability distribution P on the privileged set. In this setting, the transmission overhead can be viewed as a random variable over P and we define its expected value as the average transmission overhead (or ATO). Given P , the Shannon's entropy function H (.) provides a lower bound on the average number of bits required to identify every privileged set. This implies a natural lower bound for the ATO in terms of H ( P ). For session key distribution, we consider the subset cover framework and bound the ATO in terms of the size of the cover. We further specialize our bound to accommodate storage constraints at receivers. We consider two families of distributions for P that occur naturally in broadcast networks. 1. Each receiver independently joins the privileged set with probability p . 2. The privileged set is selected uniformly from a collection of subsets of receivers. We evaluate the ATO of some practical schemes such as the subset difference method, the LSD scheme and the Partition-and-Power scheme under these distributions. Our investigations lead us to conclude that each scheme is inherently tailored to perform optimally for specific distributions.

In traditional public key signature, the public key of a signer is essentially a random string selected from a given set. It is infeasible to prove that a party is indeed the signer for a given signature. In general, the public key of a user needs a management authority to authenticate it. It results in that traditional public key cryptosystem (PKC) requires high maintenance cost for certificate management. Although, identity based cryptosystem (IBC) reduces the overhead of management, it suffers from the drawback of key escrow. Certificate-based cryptosystem combines the advantage of both PKC and IBC as it avoids the usage of certificates and does not suffer from key escrow. Recently, Liu et.al proposed an efficient Certificate-based signature and showed that the scheme was secure in the random oracles. Unfortunately, this paper shows that the scheme is insecure and discusses the flaws in their security proof. Then the corresponding attacks are given. To overcome the flaws, an improved scheme is proposed and the result shows that the scheme is provable secure against two game attacks of certificate-based signature in the random oracle model. The security is closely related to the computational Diffie-Hellman problem.KeywordsSecurity analysisattackimproved schemethe CDH problemcertificate-based signature

Since certificateless public key cryptosystem can solve the complex certificate management problem in the traditional public key cryptosystem and the key escrow problem in identity-based cryptosystem and the pairing computation is slower than scalar multiplication over the elliptic curve, how to design certificateless signature (CLS) scheme without bilinear pairings is a challenge. In this paper, we first propose a new pairing-free CLS scheme, and then the security proof is presented in the random oracle model (ROM) under the discrete logarithm assumption. The proposed scheme is more efficient than the previous CLS schemes in terms of computation and communication costs and is more suitable for the applications of low-bandwidth environments.

Tampering, forgery and theft of the measurement and control messages in a smart grid could cause one breakdown in the power system. However, no security measures are employed for communications in intelligent substations. Communication services in an intelligent substation have high demands for real-time performance, which must be considered when deploying security measures. This paper studies the security requirements of communication services in intelligent substations, analyzes the security capabilities and shortages of IEC 62351, and proposes a novel security scheme for intelligent substation communications. This security scheme covers internal and telecontrol communications, in which the real-time performance of each security measure is considered. In this scheme, certificateless public key cryptography (CLPKC) is used to avoid the latency of certificate exchange in certificate-based cryptosystem and the problem of key escrow in identity-based cryptosystem; the security measures of generic object-oriented substation event, sampled measure value and manufacturing message specification in IEC 62351 are improved to meet the real-time requirements of the messages as well as to provide new security features to resist repudiation and replay attacks; and the security at transport layer is modified to fit CLPKC, which implements mutual authentication by exchanging signatures. Furthermore, a deployment of CLPKC in an intelligent substation is presented. We also evaluate the security properties of the scheme and analyze the end-to-end delays of secured services by combining theoretical calculation and simulation in this paper. The results indicate that the proposed scheme meets the requirements of security and real-time performance of communications in intelligent substations.