Public key exchange scheme that is addressable (PKA)

The rapid development of network technology has brought new challenges to data security. As the first gateway of a certain mobile internet system, access authentication is an essential step that guarantees the internal security of the network. However, there are some problems in traditional cryptosystem-based authentication mechanisms, such as certificate management problem and centralized key escrow problem. Centralized storage of user information is restricted by the server, the security of the server is not within the user’s control, the stability of the server cannot be guaranteed, and personal privacy on the server may be leaked. In this paper, we focus on the private key escrow problem caused by the Private Key Generator (PKG) in Identity-Based Cryptosystems (IBC) mechanism and propose a Blockchain-assisted user public-private key generation scheme (BAKG) which introduces the blockchain to improve the robustness and reliability of key management. In BAKG, the user’s private key is determined by itself through combining the partial private keys from different PKGs, which prevents the risk of private key exposure caused by a single PKG. Meanwhile, based on the theory of the Combined Public Key (CPK) algorithm, we have designed a feasible blockchain-based key generation logic and developed a prototype authentication system based on the above concept. We further analyze the security of BAKG and the analytical results show that BAKG can meet various security requirements. In addition, according to the performance evaluation results, BAKG has good performance in both read/write consensus and different key length calculations, which means it has good potential for lightweight authentication applications.KeywordsBlockchainAuthenticationIdentity-Based CryptosystemsCombine public key

A Physical Unclonable Function (PUF) is a die specific random function that can be used in a number of secure IC applications including die identification/authentication and key generation. At the core of a silicon PUF is a circuit (the PUF core) that generates random bits. These bits are like a silicon biometric, unique across dies, but can be reliably reproduced multiple times on a die across voltage and temperature variations and aging. In this thesis, we discuss various aspects of a PUF design, with a strong focus on circuit details. We describe the properties and the figures of merit of a PUF and then compare various PUF core implementations. We identify the biggest design challenges and provide several solutions. Results in this work are supported by measurement data from testchips designed in 65nm bulk CMOS. We provide an apples-to-apples comparison of various PUF implementations. We demonstrate that while adequate randomness and uniqueness is achievable for most PUF implementations, achieving high reliability is a challenge. The conventional method to achieve high reliability is to use error correcting codes (ECC). Unfortunately, the overheads associated with these techniques grows very quickly with error correction capability. Alternately, researchers have proposed several error reduction techniques to minimize the use of error correction. In this work, we evaluate four orthogonal and complementary error reduction techniques. Two of these techniques, categorized as extrinsic techniques, are multiple evaluation (ME) and activation control (AC) and are able to reduce errors in PUF response by ~70-80%. The other two techniques, categorized as intrinsic, are post-silicon selection (PSS) and directed accelerated aging (DAA) and show ~100% correction of errors. As a proof of concept prototype, we describe a self-contained, BIST-controlled key-generator that implements the PSS technique to autonomously generate bits with a bit error rate < 5 * 10^-9, equivalent to a 128-bit key error rate < 10^-6. We also describe a realization of a strong-PUF that uses these highly reliable bits in conjunction with an Advanced Encryption Standard (AES) primitive.

Public-Key Infrastructure (PKI) provides the authenticity of the public keys for a particular user. The public key is embedded in Digital Certificates. Therefore we tried to develop a specialized Hierarchical Trust Model. In this digital certificates are created using RSA of 2048 bits for key generation and combination of symmetric and asymmetric cryptography for the purpose of the security. As RSA is not suitable for large message encryption, we used AES-128 bit symmetric key for signing the information. The private key is stored locally on Machine, that is why sensitive information is stored as attributes of an Object. The object of a class is converted into Byte Array. This Byte Array is stored in BLOB data type of the database. The data is retrieved from MySQL database from BLOB data type field. This Byte Array is then converted into an object. The required data is extracted from the object.

Currently, the pervasive cooperation of a group of Unmanned Aerial Vehicles (UAVs) has gained a lot of attention and use for its low price and widespread availability. For drones from different network domains to cooperate with each other, temporary Internet of Drones (IoD) is needed. The collaboration with drones requires frequent identity verification. However, owing to unreliable environment and weak connectivity of the IoD. Unmanned aerial vehicles (UAVs) are weak in energy, computing, cross-domain and memory resources. It is very difficult to design an efficient and the complete authentication scheme without abundant computing and memory resources. The conventional authentication methods are not suitable for IoD, Public Key Infrastructure (PKI) needs online and high bandwidth resources, at the same time, the construction and operation and maintenance costs of certificate authority (CA) are very high; Identity-Based Cryptograph (IBC) using a lot of operational resources, is a “heavy” algorithm, and in different domains (private key distribution from different Private Key Generator (PKG)) is difficult to authenticate each other. This paper proposes a two-layer lightweight key management scheme based on Unified Multi-domain Identity (UMI), which implement cross-domain authentication, effectively reduce the computing and traffic brought by public key certificate verification which is especially suitable for UAVs network. Finally, through verification, the scheme has better performance and security than other schemes.KeywordsUnmanned aerial vehicles (UAVs)Key authenticationPublic-key cryptographyInternet of Drones (IoD)

Provably secure identity-based authenticated key agreement protocols with malicious private key generators

Identity-based cryptosystems were introduced to overcome one of the main problems in public key encryption, the generation of public and private keys. In the identity-based cryptosystem, an identifier such as an e-mail address of a user can be used to generate public and private keys by a trusted third party. The trusted third party uses a system-wide master secret to provide private keys to a user. Identity-based cryptosystems can be constructed using the idea of pairings. This article discusses four different identity-based cryptosystems: the Boneh-Franklin scheme, the Cock's scheme, the Authenticated IBE scheme and the Hierarchical IBE scheme. This article also discusses the security notions considered for the identity-based cryptosystem. The security notions considered are: one-wayness, indistinguishability, semantic security and non-malleability. An architecture consisting of a public parameter server and private key generator for the implementation of the identity-based cryptosystems is also discussed.

In Identity-Based Encryption (IBE) system, the Private Key Generator (PKG) holds the master secret key and is responsible for generating private keys for the users. This incurs the key-escrow problem, i.e. the PKG can decrypt any user' any ciphertexts without any possible detection. Also, compromising the master secret key will enable an adversary to do anything to the whole system, and having the master secret key be unavailable implies that new users cannot obtain private keys from the PKG, and existing users cannot get their private keys back from the PKG when they lost them. To address the key-escrow problem and protect the master secret key as much as possible with strong security and availability, distributed PKG protocols supporting threshold policy have been adopted in some IBE schemes. In this paper, we propose a distributed PKG protocol that supports the policy to be any monotonic access structures. Also, we propose the first distributed PKG protocol that supports the dynamic changes of the PKGs and the policy, while remaining the master secret key unchanged. The two protocols do not need any third party acting as a trusted dealer to present, and the master secret key should never be generated or resided in any one single site. The protocols are applicable to a generic IBE template, which covers many existing important IBE schemes. When applied to this generic type of IBE schemes, the two distributed PKG protocols do not affect the encryption and decryption algorithms, and only each user knows his own private key.

Physical unclonable functions (PUFs) are primitives that generate high-entropy, tamper resistant bits for use in secure systems. For applications such as cryptographic key generation, the PUF response bits must be highly reliable, consistent across multiple evaluations under voltage and temperature variations. Conventionally, error correcting codes (ECC) have been used to improve response reliability, but these techniques have significant area, power, and delay overheads and are vulnerable to information leakage. In this work, we present a highly-reliable, PUF-based, cryptographic key generator that uses no ECC, but instead uses built-in self-test to determine which PUF bits are reliable and only uses those bits for key generation. We implemented a prototype of the key generator in a 65nm bulk CMOS testchip. The key generator generates 1213 bits in an area of <;50k/μm <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> with a measured bit error rate of <; 5 <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">*</sub> 10 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">-9</sup> in both the nominal and worst case corners (100k measurements each). This is equivalent to a 128-bit key failure rate of <; 10 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">-6</sup> . The system can generate a 128-bit key in 1.15μs. Finally, we present a realization of a “strong”-PUF that uses 128 of these highly reliable bits in conjunction with an Advanced Encryption Standard (AES) cryptographic primitive and has a response time of 40ns and is realized in an area of 84k/μm <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> .

Identity-based revocation system (IBRS) generates the ciphertext with a revoked identity list such that only the non-revoked identities can use their private keys to decrypt this ciphertext. IBRS can be efficiently applied in some practical applications, such as the pay-TV systems when the number of revoked identities are much less than the non-revoked ones. However, since IBRS is based on identity-based cryptography, it also suffers from the inherent key escrow problem where the private key generator (PKG) has full control of each user’s private key. As a consequence, it is hard to judge whether a pirated private key is generated by the PKG or the suspected user. There is no study on IBRS fulfilling accountability in literature to date. In this paper, we introduce the notion of accountable authority IBRS (A-IBRS), which provides accountability in IBRS schemes. In an A-IBRS, the aforementioned problem can be alleviated and resolved. Furthermore, a full black-box A-IBRS can distinguish the creator of a black box between the PKG and the associated user and the dishonest PKG is allowed to access the decryption results of the user private key. We formalize the definition and security models of the full black-box A-IBRS schemes. Then, we present a concrete full black-box A-IBRS scheme with constant-size master public key and private key. Finally, we prove the security of our scheme under the defined security models without random oracle.

A Public Key Infrastructure (PKI) is security standards to mana ge and use public key cryptosystem. A PKI is used to provide digital signature, authentication, public key encryption functi onality on insecure channel, such as E-banking and E-commerce o n Internet. A soft-token private key in PKI is leaked easily because it is stored in a file at standardized location. Also it is vulnerable to a brute-force password attack as is protected by password-based encryption.In this paper, we proposed a new method that detects private ke y compromise and is probabilistically secure against a brute-force password attack though soft-token private key is le aked. The main idea of the proposed method is to use a genuine signature key pair and () fake signature key pairs to make an attacker difficult to generate a valid signature with probability  even if the attacker found the correct password. The proposed method provides detection and notification functionality when an attacker make an attempt at authentication, and enhances the security of soft-token private key without the additional cost of construction of infrastructure thereby extending the function o f the existing PKI and SSL/TLS.Keywords: Public Key Infrastructure, key compromise detection, certificate revocation, revocation notification 접수일(2014년 6월 3일), 수정일(2014년 9월 11일), 게재확정일(2014년 9월 25일)* 이 논문은 2014년도 정부(미래창조과학부)의 재원으로 한국연구재단-차세대정보・컴퓨팅기술개발사업의 지원을 받 아 수행된 연구임(No. 2010-0020726)†주저자, rudrnrwlska@naver.com‡교신저자, donghlee@korea.ac.kr(Corresponding author)

A masked advanced encryption standard (AES) physical unclonable function (PUF) architecture is proposed for hardware authentication against hybrid side‐channel (SCA) and machine‐learning attacks (MLAs). The random mismatches of the load capacitance of the masked substitution‐boxes in the AES cryptographic circuit induced by the fabrication process are utilised for generating the critical‐authentication data against SCAs. Moreover, a mask data is added to the input challenge data to mask the actual input data of the proposed PUF against MLAs. As demonstrated in the results, the masked AES PUF proposed shows a nearly 51.1% uniformity, 50.7% inter‐Hamming distance, and 98.1% reliability. Furthermore, if a hybrid SCA/MLA is performed on the proposed PUF by combining the corresponding side‐channel leakage with the deep neural network algorithm, the prediction rate of the output responses of the masked AES PUF is only 55.2% after 100,000 number of challenge‐to‐response pairs are used for training.

With the continuous development of quantum technology, the quantum signature as an application of quantum cryptography has received great attention. In this paper, we propose a public-key quantum group blind signature scheme based on single-qubit rotations. In this scheme, the group manager generates a public key. Each group member randomly generates his own private key according to the public key. The signer uses his private key and random sequence to generate the signature. The verifier uses the public key to verify the correctness of the quantum signature. The public and private keys can be reused, which simplifies the key management of the signature system. In this scheme, the random sequence is used to enhance the security of the scheme. At the same time, the quantum efficiency is improved by using single-qubit rotations. The security analysis shows that our scheme can ensure the security of the keys, the unforgeability and the non-deniability of the signature.

The rapid proliferation of the Internet of Things (IoT) leaves terminal devices vulnerable to considerable security challenges, notably the absence of robust yet efficient identity authentication mechanisms. Traditional certificate-based approaches incur substantial management overhead and storage expenditure, whereas Identity-Based Cryptography poses inherent key escrow risks. To tackle these challenges, this paper proposes a PUF and SM2-based certificateless identity authentication mechanism that integrates SM2 Certificateless Public Key Cryptography (a Chinese national cryptographic standard) with Physical Unclonable Functions (PUFs). Initially, the proposed solution utilizes PUF technology to derive a unique hardware-generated “fingerprint” from an IoT device, which functions as a root key to generate a partial user private key. This approach essentially binds the terminal’s identity to its physical hardware, thereby effectively mitigating physical cloning attacks against nodes. Moreover, through the adoption of a Certificateless Public Key Cryptography (CLPKC) framework, the complete user private key is jointly generated by a semi-trusted Key Generation Centre (KGC) and the terminal device itself. The comprehensive security analysis proves that the proposed scheme is provably secure under the random oracle model, capable of resisting various common attacks such as physical cloning, man-in-the-middle, and replay attacks. Performance evaluation confirms that the implemented PUF + SM2 certificateless mechanism significantly reduces the size of user public key identifiers to within 64 bytes, offering a substantial advantage over the 1–2 KB certificates typically required in conventional PKI/CA systems, thereby enhancing efficiency in storage and communication.

The Northern Sahara uses groundwater as the only source of drinking water, irrigation and industry. To achieve better exploitation, we suggest implementing a Decision Support System (DSS) to sustain the management of water boreholes in the south of Algeria while exposing the key characteristics of these settlements. Data exchanged in our system is critical and must be secured. This paper presents a digital signature system based on the Public Key Infrastructure (PKI) of the different documents exchanged in the DSS. The cryptographic system was developed with JAVA technology based on PKCS standards (Public Key Cryptographic Standards). To have a PKI server, we have configured the Linux server through an open SSL. The PKI is used for creating users' certificates with their private and public keys.

Hierarchical Identity-Based Encryption (HIBE) is a generalization of Identity-Based Encryption (IBE) that mirrors an organizational hierarchy, however, the residual key escrow problem has still remained. This paper introduces a new scheme, based on the security notion of anonymous ciphertext indistinguishability against key generation center (ACI-KGC) security proposed by Chow, to remove the inherent key escrow problem. The scheme employs multiple Identity Certification Authorities (ICAs) which can ensure that the Private Key Generators (PKGs) distribute private key without knowing the list of user’s identity information, so as to prevent malicious PKGs from decrypting message on behalf of user or maliciously make user’s private key public. Security analysis shows that the scheme can solve the key escrow with keeping the high-efficiency and security of HIBE system. In contrast to Chen’s T-HIBE and Chow’s scheme, to generating the user’s private key, our scheme does not require the multiple KPAs or the complex interactive protocol which take too much extra computation costs. And comparing with GS-HIBE, our scheme focuses on solving the key escrow problem with outstanding performance and security of HIBE system.