FlexiADKG: Asynchronous Distributed Key Generation with configurable access structures and constant round complexity

This paper studies error-free, multi-bit non-committing encryptions in the universally composable (UC) framework with constant round complexity. Previous efficient protocols such as the Beaver's protocol and the Damgard-Nielsen's protocol cause errors with certain probability, and require restarting the channel setup procedures if an error happens. This causes the main problem of UC-security of a non-committing protocol with error. The proposed error-free, l- bit non-committing encryption is fixed 4-round and it is as efficient as l-instance of the Beaver's protocol running in parallel. We show that the proposed scheme realizes the UC-security in the presence of adaptive adversary assuming that the decisional Diffie-Hellman problem is hard.

Renaming is a fundamental problem in distributed computing. It consists in having a set of processes with unique ids from a large namespace pick distinct names from a smaller namespace. Order-preserving renaming is a stronger variant of the renaming problem where the new names are required to preserve the ordering of the initial ids. This paper addresses order-preserving renaming in synchronous message passing systems with Byzantine failures. Although in this model order-preserving renaming can be solved by using consensus, it is known that this problem is "weaker" than consensus. Therefore, we are interested in designing algorithms that are more efficient than consensus-based solutions. This paper makes three contributions in this direction. We present an order-preserving renaming algorithm with N > 3t resiliency, a target namespace of size N + t -- 1, and O(log N ) round complexity (N is the number of processes and t is an upper bound on the number of faults). We also show that with N > t2 +2t our algorithm can be modified to have constant round complexity while achieving tight namespace of size N. Finally, we present an algorithm that solves order-preserving renaming in just 2 communication rounds with N > 2t2 + t.

Secure two-party computation is a rapidly emerging field of research and enables a large variety of privacy-preserving applications such as mobile social networks or biometric identification. In the late eighties, two different approaches were proposed: Yao’s garbled circuits and the protocol of Goldreich-Micali-Wigderson (GMW). Since then, research has mostly focused on Yao’s garbled circuits as they were believed to yield better efficiency due to their constant round complexity. In this work we give several optimizations for an efficient implementation of the GMW protocol. We show that for semi-honest adversaries the optimized GMW protocol can outperform today’s most efficient implementations of Yao’s garbled circuits, but highly depends on a low network latency. As a first step to overcome these latency issues, we summarize depth-optimized circuit constructions for various standard tasks. As application scenario we consider privacy-preserving face recognition and show that our optimized framework is up to 100 times faster than previous works even in settings with high network latency.

We propose a protocol for the problem of secure two-party pattern matching, where Alice holds a text t?{0,1}? of length n, while Bob has a pattern p?{0,1}? of length m. The goal is for Bob to (only) learn where his pattern occurs in Alice's text, while Alice learns nothing. Private pattern matching is an important problem that has many applications in the area of DNA search, computational biology and more. Our construction guarantees full simulation in the presence of malicious, polynomial-time adversaries (assuming the hardness of DDH assumption) and exhibits computation and communication costs of O(n+m) group elements in a constant round complexity. This improves over previous work by Gennaro et al. (Public Key Cryptography, pp. 145---160, 2010) whose solution requires overhead of O(nm) group elements and exponentiations in O(m) rounds. In addition to the above, we propose a collection of protocols for important variations of the secure pattern matching problem that are significantly more efficient than the current state of art solutions: First, we deal with secure pattern matching with wildcards. In this variant the pattern may contain wildcards that match both 0 and 1. Our protocol requires O(n+m) communication and O(1) rounds using O(nm) computation. Then we treat secure approximate pattern matching. In this variant the matches may be approximated, i.e., have Hamming distance less than some threshold, ?. Our protocol requires O(n?) communication in O(1) rounds using O(nm) computation. Third, we have secure pattern matching with hidden pattern length. Here, the length, m, of Bob's pattern remains a secret. Our protocol requires O(n+M) communication in O(1) rounds using O(n+M) computation, where M is an upper bound on m. Finally, we have secure pattern matching with hidden text length. Finally, in this variant the length, n, of Alice's text remains a secret. Our protocol requires O(N+m) communication in O(1) rounds using O(N+m) computation, where N is an upper bound on n.

We propose a dedicated protocol for the highly motivated problem of secure two-party pattern matching: Alice holds a text t ∈ {0,1}*. of length n, while Bob has a pattern p ∈ {0,1}*. of length m. The goal is for Bob to learn where his pattern occurs in Alice’s text. Our construction guarantees full simulation in the presence of malicious, polynomial-time adversaries (assuming that ElGamal encryption is semantically secure) and exhibits computation and communication costs of O(n + m) in a constant round complexity. In addition to the above, we propose a collection of protocols for variations of the secure pattern matching problem: The pattern may contain wildcards (O(nm) communication in O(1) rounds). The matches may be approximated, i.e., Hamming distance less than some threshold ((O(nm) communication in O(1) rounds). The length, m, of Bob’s pattern is secret (O(nm) communication in O(1) rounds). The length, n, of Alice’s text is secret (O(n + m) communication in O(1) rounds).

Among various cloud services, storage is one of the fast utilizing and hugest category of cloud service. Very huge amount of data is stored at cloud storage servers by various users or organizations. With such services, various key issues are arises such as data security, confidentiality. To overcome these, the key concept was introduced such as Cryptography. In cryptography, various keys are used to encrypt or decrypt the data before uploading or downloading from cloud server. To generate the private and public key pair, distributed key generation (DKG) protocol was introduced. But within organization there is another issue is arises, regarding to authority based data access control policy. That is only user with particular authority can access data stored at cloud, based on their authority level. For this hierarchical threshold access structure (HTAS) is used along with DKG, known as HTDKG. In this, various users are divided into levels based on their designation and some threshold is assigned. At the time of data access, only specific levels users can access the specific amount of data. Because of this, all data is not revealed to any unconcern user. In existing system, HTDKG key generation and management is perform at user side which increases the management overhead. To overcome this issue, we introduced the third party Key Distribution Center (KDC), which execute the HTDKG protocol and take responsibility of all key generation, distribution and management activities. Experimental results prove that the proposed system decrease the processing time and enhances the memory utilization by utilizing of KDC.

Group based transactions are becoming common via handhelds. Single key based systems may not be able to meet various security requirements. In this paper, we propose a threshold signature scheme based on Pedersen distributed key generation principle which is suitable for handheld devices and ad-hoc networks. Existing distributed key generation protocols use either cryptosystems based on the hardness of discrete logarithm over a finite field or integer factorization. Elliptic curve cryptosystems provide a promising alternative with efficiency which is suitable for low-power devices in terms of memory and processing overhead. In the proposed scheme, the public key from the key generation protocol follows a uniform distribution in the elliptic curve additive group, and the signature can be generated and verified efficiently. We evaluated the proposed key generation protocol and signature scheme using PARI/GP, and the key generation time takes a fraction of a second and the signature signing and verifying can be finished in a few milliseconds on the LINUX Intel PXA 255 processor.

A Distributed Key Generation (DKG)p rotocol is an essential component of any threshold cryptosystem. It is used to initialize the cryptosystem and generate its private and public keys, and it is used as a subprotocol, for example to generate a one-time key pair which is a part of any threshold El-Gamal-like signature scheme. Gennaro et al. showed [GJKR99] that a widely-known non-interactive DKG protocol suggested by Pedersen does not guarantee a uniformly random distribution of generated secret keys even in the static adversary model. Furthermore, Gennaro et al. proposed to replace this protocol with one that guarantees a uniform distribution of the generated key but requires an extra round of reliable broadcast communication.We investigate the question whether some discrete-log based threshold cryptosystems remain secure when implemented using the more efficient DKG protocol of Pedersen, in spite of the fact that the adversary can skew the distribution of the secret key generated by this protocol. We answer this question in the positive. We show that threshold versions of some schemes whose security reduces to the hardness of the discrete logarithm problem, remain secure when implemented with Pedersen DKG. We exemplify this claim with a threshold Schnorr signature scheme.However, the resulting scheme has less efficient security reduction (in the random oracle model)from the hardness of the discrete logarithm problem than the same scheme implemented with the computationally more expensive DKG protocol of Gennaro et al. Thus our results imply a trade-o. in the design of threshold versions of certain discrete-log based schemes between the round complexity of a protocol and the size of the modulus.KeywordsThreshold cryptographydistributed key generationdiscrete logarithmexact securityrandom oracle model

Blockchain systems built on classical cryptography face immediate risks from large-scale quantum computers, while purely quantum-based blockchains often rely on a single Private Key Generator (PKG) and incur heavy resource overheads. To overcome these issues, this paper proposes a hybrid quantum and post-quantum blockchain approach that removes single points of trust by using Distributed Key Generation and a dual-layer signature mechanism. This method integrates quantum digital signatures, rooted in the Fully Flipped Permutation problem, with classical post-quantum (lattice-based) cryptography, enabling users to switch between quantum and classical signatures according to security requirements and channel conditions. Delegated Proof-of-Stake with node behavior and Borda count has been incorporated to manage consensus, ensuring that witness nodes are regularly re-elected and malicious actors are penalized by distributing secret shares among multiple rotating witnesses. We eliminate the central vulnerability of a sole PKG while maintaining rigorous resistance to collusions. Our analytical model indicates that a fraction of transactions can use quantum signatures without system-wide bottlenecks, while the remaining transactions follow classical PQC paths with throughput approaching classical baselines under our modeling assumptions. Consequently, this hybrid method offers higher scalability, robust collusion resistance, and long-term security even under quantum-capable adversaries. This paper presents extensive theoretical analyses, probability models, and algorithmic complexities, demonstrating that our design provides resilient infrastructure that meets the key performance and security requirements of next-generation blockchain systems.

Although distributed key generation (DKG) has been studied for some time, it has never been examined outside of the synchronous setting. We present the first realistic DKG architecture for use over the Internet. We propose a practical system model and define an efficient verifiable secret sharing scheme in it. We observe the necessity of Byzantine agreement for asynchronous DKG and analyze the difficulty of using a randomized protocol for it. Using our verifiable secret sharing scheme and a leader-based agreement protocol, we then design a DKG protocol for public-key cryptography. Finally, along with traditional proactive security, we also introduce group modification primitives in our system.

Distributed key generation (DKG) is widely used in multi-party computation and decentralized applications. DKG has two phases, namely sharing and reconstruction. Most of the prior DKG protocols need at least 2 rounds for the sharing phase, in case some party raises a dispute. The existing 1-round DKG protocol [Fouque <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> , PKC’01], built based on a publicly verifiable secret sharing (PVSS) scheme, assumes a static adversary model and its reconstruction phase requires <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$O(n^{2})$ </tex-math></inline-formula> communication complexity. Motivated by the observation that a ciphertext-policy attribute-based encryption (CP-ABE) scheme hides secret sharing (SS) in ciphertext, we utilize decentralized CP-ABE to achieve the first adaptively secure 1-round DKG protocol. Firstly, a CP-ABE scheme enables the ciphertexts in DKG to be externally decrypted, making our protocol superior to the PVSS-based DKG protocol in reconstruction. The communication and computation complexities are both lowered to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$O(n)$ </tex-math></inline-formula> thanks to the constant-sized decryption key and the proposed batch decryption. The use of CP-ABE also makes our DKG protocol storage-friendly, i.e., the parties store no ciphertext after the sharing phase. Secondly, we add non-interactive zero-knowledge (NIZK) proofs to make the CP-ABE ciphertext publicly verifiable by leveraging the sigma protocol and the Fiat-Shamir heuristic. Thirdly, we demonstrate our protocol’s feasibility by presenting a proof-of-concept implementation over Ethereum, which is used as a public channel and a trustworthy computation platform. The implementation is a non-trivial task due to Ethereum’s incompatibility with the bilinear mapping group.

A Distributed Key Generation (DKG) protocol is an essential component of threshold cryptosystems required to initialize the cryptosystem securely and generate its private and public keys. In the case of discrete-log-based (dlog-based) threshold signature schemes (ElGamal and its derivatives), the DKG protocol is further used in the distributed signature generation phase to generate one-time signature randomizers (r = gk). In this paper we show that a widely used dlog-based DKG protocol suggested by Pedersen does not guarantee a uniformly random distribution of generated keys: we describe an efficient active attacker controlling a small number of parties which successfully biases the values of the generated keys away from uniform. We then present a new DKG protocol for the setting of dlog-based cryptosystems which we prove to satisfy the security requirements from DKG protocols and, in particular, it ensures a uniform distribution of the generated keys. The new protocol can be used as a secure replacement for the many applications of Pedersen's protocol. Motivated by the fact that the new DKG protocol incurs additional communication cost relative to Pedersen's original protocol, we investigate whether the latter can be used in specific applications which require relaxed security properties from the DKG protocol. We answer this question affirmatively by showing that Pedersen's protocol suffices for the secure implementation of certain threshold cryptosystems whose security can be reduced to the hardness of the discrete logarithm problem. In particular, we show Pedersen's DKG to be sufficient for the construction of a threshold Schnorr signature scheme. Finally, we observe an interesting trade-off between security (reductions), computation, and communication that arises when comparing Pedersen's DKG protocol with ours.

In the cloud-assisted Industrial Internet of Things (IIoT), ciphertext-policy attribute-based encryption (CP-ABE) could help the data owner (DO) share his sensitive data via the cloud under self-defined access structures. Among general CP-ABE schemes, the decryption overhead, the key generation cost, and the ciphertext length increase with the number of involved attributes. Additionally, only regular attributes are taking into consideration rather than weighted attributes. In this article, we proposed a secure, efficient, and weighted access control scheme (SEWAC) for cloud-assisted IIoT applications. SEWAC enables the DO to formulate any fine-grained access structure over weighted attributes without making it more complicated. Furthermore, such weighted attributes would not add the length of ciphertext. SEWAC also supports online/offline key generation to alleviate the computational cost of the authority from answering mass key requests in the online phase, while most computational tasks are executed in the offline phase. The heavy decryption overhead is offloaded to the cloud. To ensure the cloud to honestly execute the process of outsourced decryption, we design an efficient batch verification method, which allows the user to spend only three bilinear pairing operations in checking the correctness of batch results. We also give the formal security proof of the proposed scheme. Comprehensive comparisons and implementation results indicate that SEWAC can better achieve weighted access control, compressed ciphertext length, efficient key generation, and the assurance of the outsourced decryption result.

Public Key Infrastructures (PKI) are important for the security of many networked systems. The current designs of PKIs often rely on a centralized key Certification Authority (CA) for the certification and distribution of keys. This centralized entity poses a performance and scalability bottleneck. In addition, it creates a serious security risk – if the CA is penetrated, the security of the entire system is irretrievably compromised. In this paper, we present an innovative method to generate globally unique keys in a completely distributed fashion. The ability to perform distributed key generation facilitates decentralized PKIs. We present security analysis of the method as well as a set of experimental performance results. Our method scales well, and is cryptographically strong.

MDKG: Module-Lattice-Based Distributed Key Generation