Anonymous Conference Key Distribution Scheme with Perfect Forward Security

In order to hold secure electronic conference in communication networks via insecure channels, a conference key distribution system should be constructed. The conference key distribution system (CKDS) is used for distributing a conference key shared among the participants of the conference and hence secure communications are achieved. In this paper, by using the secret sharing scheme based on the MDS code and the Diffie-Hellman key exchange scheme as the basic component, we propose an efficient and anonymous conference-key distribution scheme that supports conference membership changes dynamically. We also show that, based on the Diffie-Hellman (DH) and the one-way assumption, the proposed CKDS is secure against impersonation and conspiracy attacks, and the unattended ones reveal no useful knowledge about the conference key. In addition, the proposed CKDS allows for user anonymity.

Provably secure identity-based authenticated key agreement protocols with malicious private key generators

A new anonymous conference key distribution system based on the elliptic curve discrete logarithm problem

Recently, Chen et al. proposed an identity-based quantum signature scheme (IDQSS). Their scheme has the advantages of the classical identity-based signature (IDS) scheme. However, Chen et al.’s scheme cannot resist against the private key generator (PKG)’s forgery attack. On the other hand, in their scheme, many rounds of quantum swap tests have to be performed by the verifier during the signature verification phase. To improve the security and efficiency of the IDQSS, a new IDQSS is proposed. In our scheme, the private key of the signer is generated by PKG according to the signer’s identity, which is used as the corresponding public key. The signer generates a quantum signature with her private key and the secret parameters shared with the verifier. Anyone can verify the quantum signature with the identity of the signer. Our scheme overcomes the security drawback of Chen et al.’s scheme and inherits the merits of the classical IDS system. It has the security properties such as information-theoretical security, non-repudiation and unforgeability. At the same time, in our scheme, the verifier need not perform any quantum swap test. Therefore, our IDQSS is more secure and efficient.

Authentication with key agreement (AKA) protocols are implemented to provide identity authentication and session keys for communication entities. In order to reduce the heavy trust reliance on key generator center (KGC) in identity based AKA protocols, a certificateless based AKA (CLAKA) protocol for client-server environment without the third-party (i.e., KGC) is introduced in this paper. The proposed protocol is constructed based on elliptic curve cryptosystem (ECC) and multi-factor protections (such as password, biometrics, and smart card). Moreover, security proof based on BAN-logic is carried out and shows that our protocol can provide mutual authentication, user anonymity, dynamic identity and perfect forward security, and resist to user impersonation attack, server spoofing attack and privileged insider attack. Meanwhile, security and efficiency analysis shows that our proposed protocol outperforms the previous related ones.

In Identity-Based Encryption (IBE) system, the Private Key Generator (PKG) holds the master secret key and is responsible for generating private keys for the users. This incurs the key-escrow problem, i.e. the PKG can decrypt any user' any ciphertexts without any possible detection. Also, compromising the master secret key will enable an adversary to do anything to the whole system, and having the master secret key be unavailable implies that new users cannot obtain private keys from the PKG, and existing users cannot get their private keys back from the PKG when they lost them. To address the key-escrow problem and protect the master secret key as much as possible with strong security and availability, distributed PKG protocols supporting threshold policy have been adopted in some IBE schemes. In this paper, we propose a distributed PKG protocol that supports the policy to be any monotonic access structures. Also, we propose the first distributed PKG protocol that supports the dynamic changes of the PKGs and the policy, while remaining the master secret key unchanged. The two protocols do not need any third party acting as a trusted dealer to present, and the master secret key should never be generated or resided in any one single site. The protocols are applicable to a generic IBE template, which covers many existing important IBE schemes. When applied to this generic type of IBE schemes, the two distributed PKG protocols do not affect the encryption and decryption algorithms, and only each user knows his own private key.

Identity-based revocation system (IBRS) generates the ciphertext with a revoked identity list such that only the non-revoked identities can use their private keys to decrypt this ciphertext. IBRS can be efficiently applied in some practical applications, such as the pay-TV systems when the number of revoked identities are much less than the non-revoked ones. However, since IBRS is based on identity-based cryptography, it also suffers from the inherent key escrow problem where the private key generator (PKG) has full control of each user’s private key. As a consequence, it is hard to judge whether a pirated private key is generated by the PKG or the suspected user. There is no study on IBRS fulfilling accountability in literature to date. In this paper, we introduce the notion of accountable authority IBRS (A-IBRS), which provides accountability in IBRS schemes. In an A-IBRS, the aforementioned problem can be alleviated and resolved. Furthermore, a full black-box A-IBRS can distinguish the creator of a black box between the PKG and the associated user and the dishonest PKG is allowed to access the decryption results of the user private key. We formalize the definition and security models of the full black-box A-IBRS schemes. Then, we present a concrete full black-box A-IBRS scheme with constant-size master public key and private key. Finally, we prove the security of our scheme under the defined security models without random oracle.

The rapid development of network technology has brought new challenges to data security. As the first gateway of a certain mobile internet system, access authentication is an essential step that guarantees the internal security of the network. However, there are some problems in traditional cryptosystem-based authentication mechanisms, such as certificate management problem and centralized key escrow problem. Centralized storage of user information is restricted by the server, the security of the server is not within the user’s control, the stability of the server cannot be guaranteed, and personal privacy on the server may be leaked. In this paper, we focus on the private key escrow problem caused by the Private Key Generator (PKG) in Identity-Based Cryptosystems (IBC) mechanism and propose a Blockchain-assisted user public-private key generation scheme (BAKG) which introduces the blockchain to improve the robustness and reliability of key management. In BAKG, the user’s private key is determined by itself through combining the partial private keys from different PKGs, which prevents the risk of private key exposure caused by a single PKG. Meanwhile, based on the theory of the Combined Public Key (CPK) algorithm, we have designed a feasible blockchain-based key generation logic and developed a prototype authentication system based on the above concept. We further analyze the security of BAKG and the analytical results show that BAKG can meet various security requirements. In addition, according to the performance evaluation results, BAKG has good performance in both read/write consensus and different key length calculations, which means it has good potential for lightweight authentication applications.KeywordsBlockchainAuthenticationIdentity-Based CryptosystemsCombine public key

Blockchain is an up-and-coming technology, and it is exploring its existence in all our day-to-day lives, particularly for business applications. Due to this, security has become a major and a higher priority concern during the transaction process of data, cryptocurrency, etc. Achieving integrity, authentication, and non-repudiation with blockchain technology through digital signatures are the factors for its success. Hence, we imply a novel hybrid chaotic map–based proactive RSA/digital signature scheme for a better securable transaction of blocks compared to earlier works. Faster encryption and decryption could be expected by this novel approach. This could surely be resistant to brute force attacks, chosen plain text attacks and chosen cipher text attacks. OPENMP and OPENSSL libraries could be employed for good performance and security in a multicore platform. Chaotic map theory has its unique characteristics in the design of highly secure asymmetric encryption and decryption processes, with lesser computational cost in lesser time. The strength of RSA lies in the prime factorization of larger prime numbers in the generation of public and private keys. RSA has a severe backlog in computational time; while the length of the prime number is longer, to ensure higher security, the longer one is preferable. Hence to speedup the factorization process, chaotic mapping theory has been synchronized with the RSA cryptosystem. Second, chaotic mapping theory provides an enhanced avalanche effect, which leads to a two-factor RSA encryption process. Chaotic maps are highly sensitive to initial values and control parameters. The unique feature of inclusion of chaotic maps is that any slight change in the initial conditions of the plain text would cause a remarkable deviation in the message digest. This nature would make the hacker limit their prediction ability. Computational time, cost, and level of resistance to attacks are the factors to be considered to measure the efficiency of our new approach when compared to other RSA approaches. The work was simulated using MATLAB and it is proved that that the proposed RSA with hybrid GLT chaotic maps is 1.53 times and 1.27 times faster than the existing ones.

Distributed online social network (DOSN) solves the challenges of single-point failure and user data privacy faced by traditional online social network (OSN). Online discussion group, allowing a user to facilitate the communications with other users, is one of the most important components of (D)OSN. Key management is the key technology to ensure the secure establishment of discussion groups in DOSNs. However, the existing key management schemes for secure discussion group establishment in DOSNs cannot meet the requirements of sender non-restriction, receiver controllability, round optimal, certificate freeness simultaneously. In this paper, we propose a novel key management scheme for secure discussion group establishment in DOSNs. In our scheme, any user could use our key management scheme to initialize a discussion group with a piece of discussion group information. Users who are interested in the group topic contained in the discussion group information can join and leave the discussion group at any time once the discussion group is initialized with one-round communication. Any user/sender can find the users that he/she wants to communicate with by looking up the discussion group information of a discussion group and then send encrypted messages to some or all of the users in the discussion group. Therefore, our scheme achieves sender non-restriction, receiver controllability, round optimal, certificate freeness simultaneously. Security analysis also shows that our scheme achieves confidentiality, authentication, full collusion resistance, known-key security and perfect forward security.

A secure cross-domain authentication scheme with perfect forward security and complete anonymity in fog computing

Hierarchical Identity-Based Encryption (HIBE) is a generalization of Identity-Based Encryption (IBE) that mirrors an organizational hierarchy, however, the residual key escrow problem has still remained. This paper introduces a new scheme, based on the security notion of anonymous ciphertext indistinguishability against key generation center (ACI-KGC) security proposed by Chow, to remove the inherent key escrow problem. The scheme employs multiple Identity Certification Authorities (ICAs) which can ensure that the Private Key Generators (PKGs) distribute private key without knowing the list of user’s identity information, so as to prevent malicious PKGs from decrypting message on behalf of user or maliciously make user’s private key public. Security analysis shows that the scheme can solve the key escrow with keeping the high-efficiency and security of HIBE system. In contrast to Chen’s T-HIBE and Chow’s scheme, to generating the user’s private key, our scheme does not require the multiple KPAs or the complex interactive protocol which take too much extra computation costs. And comparing with GS-HIBE, our scheme focuses on solving the key escrow problem with outstanding performance and security of HIBE system.

The objective of the PKA encryption scheme is to complement, or replace, existing Public Key Infrastructures (PKI) [1]. In this scheme, the initialization step is based on the secure exchange of addressable cryptographic tables between the communicating parties. These tables are generated either with random numbers, or with arrays of addressable Physical Unclonable Function (PUFs). The subsequent communications between the parties can therefore occurs over untrusted channels, by exchanging dynamically generated public keys. Private keys are, generated independently with all communicating parties using their cryptographic tables, and the shared public keys. The private keys are combined with methods such as the Advanced Encryption Standard (AES) to encrypt and decrypt the communication between users. The generation of private keys is done without mathematical computations that are potentially vulnerable to quantum computers using algorithms such as the one developed by Shor [2]. PKA is fast and requires approximately 800 CPU clock cycles. We implemented, and tested the PKA dynamic key exchange scheme in legacy systems to secure PC-to-PC communication, and PC to smart card communication with AES.

ABSTRACTA certificateless public key cryptosystem can make a special contribution to building key distribution and management architecture in resource‐constrained mobile ad hoc networks (MANETs) because it has no separate certificate and no complex certificate management problems. In this paper, we present a virtual private key generator (VPKG)‐based escrow‐free certificateless public key cryptosystem as a novel combination of certificateless and threshold cryptography. Using secret sharing, we build a VPKG whose members collaboratively calculate the partial private key and send it to the user via public channels. The private key of a user is generated jointly by the VPKG and the user. Each of them has “half” of the secret information about the private key of the user. In addition, binding a user's public key with its identity and partial private key, respectively, raises our schemes to the same trust level as is enjoyed in a traditional public key infrastructure. We also show that the proposed scheme is secure against public key replacement attacks and passive attacks. Copyright © 2012 John Wiley & Sons, Ltd.

Identity-based encryption algorithm is applied to cloud storage to protect data security and provide a flexible access control scheme. However, in the existing schemes, the private key generator (PKG) knows secret keys of all users, which means that the PKG can decrypt all ciphertexts. In this paper, we propose a secure identity-based proxy re-encryption scheme, in which the PKG only generates partial secret keys for users. This can ensure users’ data confidentiality and privacy security. Its security is based on the decision bilinear Diffie-Hellman (DBDH) assumption in the random oracle model. Besides, our scheme can resist collusion attacks and support user revocation. In addition, we compare our scheme with other existing schemes. The result demonstrates our scheme is comparable with other schemes in computation complexity.