Universal Padding Schemes for RSA

In this paper, we analyse the Libert-Quisquater's q-DH signcryption scheme proposed in SCN'2004. Although the paper proved that their scheme is secure against adaptive chosen ciphertext attacks in the random oracle model, we disprove their claim and show that their scheme is not even secure against non-adaptive chosen ciphtertext attacks, which is the weaker security than the adaptive chosen ciphertext attacks. We further show that the semantically secure symmetric encryption scheme defined in their paper is not sufficient to guarantee their signcryption scheme to be secure against adaptive chosen ciphertext attacks.

OAEP 3-Round is a famous padding scheme.But if the attacker could obtain the random string of the OAEP 3-Round,it would not be indistinguishable against adaptive chosen ciphertext attacks any more.Examples are given to support the argument.The authors improve the OAEP 3-Round padding scheme to be plaintext awareness and prove that the revised version is semantic security against adaptive chosen ciphertext attacks in the random oracle model even in the case that attacker could get the random string of the padding scheme.

Recently, Duan and Cao proposed an multi-receiver identity-based signcryption scheme. They showed that their scheme is secure against adaptive chosen ciphertext attacks in the random oracle model. In this paper, we show that their scheme is in fact not secure against adaptive chosen ciphertext attacks under their defined security model.

The Fujisaki-Okamoto (FO) conversion is a generic conversion to enhance a public key encryption scheme with security of one-way against chosen plaintext attacks (OW-CPA) to security of indistinguishable against adaptive chosen ciphertext attacks (IND-CCA) in the random oracle model. Existing works have shown that the FO conversion also can generically upgrade the security of the identity-based encryption (IBE) schemes or certificateless public key encryption (CL-PKE) schemes. However, it is still unknown if the same holds for certificate-based encryption (CBE) schemes. In this paper, we investigate the generic security of the CBE scheme obtained by applying the FO conversion to an arbitrary underlying OW-CBE-CPA secure CBE scheme and confirm that the FO conversion can generically convert any OW-CBE-CPA secure CBE into an IND-CBE-CCA secure CBE. We also note that the straightforward application of the FO conversion only leads to a CBE scheme with a loose reduction. To solve this problem, we propose an enhanced FO conversion which just introduces minor extra computation overhead, but results in considerably more efficient security reduction.

Quite recently, Tseng and Tsai proposed a revocable identity (ID)-based encryption (RIBE) with a public channel, in which the private key generator (PKG) can efficiently revoke misbehaving/compromised users by using a public channel. Considering the problem where a sender would like to encrypt an identical message for n receivers, the sender must re-encrypt the message n times using Tseng and Tsai’s RIBE scheme. In such a case, n expensive pairing operations are required for the re-encrypting procedure. In this paper, for reducing the pairing operations, we extend Tseng and Tsai’s RIBE to propose an efficient revocable multi-receiver ID-based encryption (RMIBE) scheme. Our scheme only needs one pairing operation to encrypt an identical message for n receivers while remaining the merit of user revocability in Tseng and Tsai’s RIBE scheme. We demonstrate that the RMIBE scheme is semantically secure against adaptive chosen ciphertext attacks (CCA) in the random oracle model.DOI: http://dx.doi.org/10.5755/j01.itc.42.2.2244

In recent years, secure communication and privacy‐preserving are gaining popularity because of the advent of wireless network. Certificateless cryptography (CLC) and identity‐based cryptography (IBC) have already been widely applied in the area of wireless network. Hence, to achieve secure communication from CLC to IBC, we present a heterogeneous signcryption scheme that enables a sender in the CLC to transmit a message to multi‐receiver in the IBC. Our scheme has no restrictions on the system parameters and master keys; private key generator and key generating center generate their own system parameters and master key for the IBC users and the CLC user, separately. Considering privacy‐preserving in heterogeneous communication, we show that our scheme can realize the anonymity of all receivers. Compared with other schemes, our scheme has more advantages, such as public verification and decryption fairness, which are attractive for wireless network applications. Moreover, our scheme has the indistinguishability against adaptive chosen ciphertext attacks, the existential unforgeability against adaptive chosen messages attacks, and anonymous indistinguishability of encryptions under selective‐ID, chosen ciphertext attack in the random oracle model. Copyright © 2016 John Wiley & Sons, Ltd.

We define new algorithmic problems and discuss their properties (in particular, we present a careful study of their computational complexity). We apply the new problems to design public key encryption protocols with semantic security relative to their decisional variants. We then show how to provide efficient schemes that are semantically secure under adaptive chosen ciphertext attacks in the random oracle model. Finally, we show that the ideas developed in this extended abstract can be used to design the most efficient known cryptosystem with semantic security under non-adaptive chosen ciphertext attacks in the standard security model.

Attribute-based encryption (ABE) scheme has become an important technology in cryptography. However, the considerable overhead of encryption and decryption restricts its application on the devices with limited resource. Fortunately, as the development of cloud computing, someone presents that outsourcing decryption and encryption can be used to deal with the problem. This idea has drawn a lot of attention after being proposed. Recently, Li et al. put forward an efficient verifiable outsourced ABE scheme which outsources the encryption and decryption to the cloud server and enables its valid receivers to verify the correctness of the message after decrypting. However, in this paper, we prove that their scheme is not secure under chosen plaintext attack which is the basic security requirement of ABE scheme. Then, we improve their scheme and illustrate that the improved scheme is adaptive chosen ciphertext attack (CCA2) secure in the random oracle model. The final comparison shows that we do not add extra computational burden to improve the security.

Non-malleability is an important and intensively studied security notion for many cryptographic primitives. In the context of public key encryption, this notion means it is infeasible for an adversary to transform an encryption of some message m into one of a related message m' under the given public key. Although it has provided a strong security property for many applications, it still does not suffice for some scenarios like the system where the users could issue keys on-the-fly. In such settings, the adversary may have the power to transform the given public key and the ciphertext. To withstand such attacks, Fischlin introduced a stronger notion, known as complete non-malleability, which requires that the non-malleability property be preserved even for the adversaries attempting to produce a ciphertext of some related message under the transformed public key. To date, many schemes satisfying this stronger security have been proposed, but they are either inefficient or proved secure in the random oracle model. In this work, we put forward a new encryption scheme in the common reference string model. Based on the standard DBDH assumption, the proposed scheme is proved completely non-malleable secure against adaptive chosen ciphertext attacks in the standard model. In our scheme, the well-formed public keys and ciphertexts could be publicly recognized without drawing support from unwieldy techniques like non-interactive zero knowledge proofs or one-time signatures, thus achieving a better performance.

In 1998, Boneh, Durfee and Frankel described several attacks against RSA enabling an attacker given a fraction of the bits of the private exponent d to recover all of d. These attacks were later improved and extended in various ways. They however always consider that the private exponent d is smaller than the RSA modulus N. When it comes to implementation, d can be enlarged to a value larger than N so as to improve the performance (by lowering its Hamming weight) or to increase the security (by preventing certain side-channel attacks). This paper studies this extended setting and quantifies the number of bits of d required to mount practical partial key exposure attacks. Both the cases of known most significant bits (MSBs) and least significant bits (LSBs) are analyzed. Our results are based on Coppersmith’s heuristic methods and validated by practical experiments run through the SAGE computer-algebra system.KeywordsRSA cryptosystemcryptanalysiskey exposureCoppersmith’s methodslattice reduction

Notes on a provably-secure certificate-based encryption against malicious CA attacks

Cryptanalysis of an (hierarchical) identity based parallel key-insulated encryption scheme

According to most existing identity-based ring signcryption schemes are based on random oracle model and have too many pairings, a new efficient identity-based ring signcryption scheme is proposed. It can satisfy the unconditional anonymity of the sender by using symmetric encryption algorithm and reduce the pairings by skillfully setting public parameters. Its indistinguishability under adaptive chosen ciphertext attack is proofed by the intractability of the DBDH problem and the unforgeability under adaptive chosen message attack is proved by the intractability of the CDH problem.

In order to keep the confidential data in the cloud against unauthorized parties, a cryptographic access control solution based on Attribute-Based Encryption (ABE) and Identity-Based Signature (IBS) is introduced in this paper. Under the premise that cloud service provider is untrustful, the proposed scheme can ensure the data security of the cloud storage system in an open environment, as well as reduce the complexity of management. Analysis and experimental results show that the scheme can be semantically secure against adaptive chosen ciphertext attacks under the random oracle model. Our concrete access control scheme can enhance the efficiency of the cloud to a certain extent.

To achieve heterogeneous communication from certificateless cryptography (CLC) to identity-based cryptography (IBC), we present a heterogeneous scheme that enables m senders in the CLC to transmit m message to n receivers in the IBC. In the proposed signcryption scheme, each sender is mapped to a distinct pseudo identity, so the sender’s identity privacy preservation can be guaranteed. At the same time, to ensure the receiver’s identity privacy, the identity information of all authorized recipients is mixed by the Lagrange interpolation polynomial during the signcryption process, which prevents the receiver’s identity from being exposed. Compared with existing schemes, the proposed scheme presents efficient computational overhead and is suitable for heterogeneous environments. In addition, our scheme has the indistinguishability against adaptive chosen ciphertext attacks and existential unforgeability against adaptive chosen-message attacks in the random oracle model.