Authenticated Encryption Research Articles

Efficient palm vein authentication encryption technique in wireless implantable medical devices

Implantable medical devices (IMD) are commonly utilized to treat chronic illnesses. Many IMD communicate in wireless mode using an external programmer, which raises security concerns. Security of IMD is a critical issue which assaults direct harm to patients. Many researches are carried out on IMD security and challenges when the patient is not in a critical situation. Still, it would be a major issue while the patient is unconscious. In this research, a novel scheme for emergency secure access control of IMD was proposed to improve the security of biometric-based IMD schemes. The proposed authentication scheme uses a combination of palm vein and zero-watermark to generate encrypted credential data for IMDs. Using quantitative assessment for evaluating images, such as the peak signal-to-noise ratio (PSNR), structural similarity index (SSIM), and the mean squared errors (MSE), the suggested framework is shown to be superior to existing methods. Two other study goals are improved efficiency and image quality at a lower computational cost.

JUSTIFICATION OF DIRECTIONS FOR IMPROVING AUTHENTICATION PROTOCOLS IN INFORMATION AND COMMUNICATION SYSTEMS

The analysis of information about the conducted cyber-threats makes it possible to identify modern information security problems when transmitted through unprotected communication channels. When conducting such an analysis, various components of the methods of implementing cyber threats are considered, but in this paper, it is proposed to pay attention to the motivational component of the emergence of threats and the existing effective tools for countering them. Such a comprehensive approach will make it possible to predict various modes of cyberattacks that cybercriminals can use against certain systems and to prepare the necessary digital security systems for the implementation of future threats. The influence of the exponential growth of the capacities of computing devices on the growth of the possibilities of implementing attacks by cybercriminals on cryptographic algorithms was also revealed. In this regard, the work considered the possibilities of increasing the level of resistance to such interventions, which are ensured by the NIST requirements for stability and security in the conditions of the post-quantum period. To determine the level of security of data transmission over an insecure network with privacy, integrity and authentication, a comparative analysis of the capabilities of information transmission protocols was conducted. The results of the analysis are presented in the form of a scheme of security and stability of protocols and algorithms that made it to the finals of the NIST competition. To ensure the integrity and authenticity of users when establishing communication sessions with websites, it is recommended to use TLS protocols. A scheme of the process of authenticated encryption and verification of the authenticity of an encrypted message transmitted using a TLS connection has been developed. The process diagram of authentication encryption and decryption of information when establishing a communication session in TLS protocols has been developed. A comparative analysis of different versions of TLS protocols was carried out.

Dual Server Public Key Authenticated Encryption with Keyword Search

Dual Server Public Key Authenticated Encryption with Keyword Search

English

The ubiquitous nature of wireless sensor networks (WSNs) means that their underlying network architecture may be used to serve a broad range of use cases, from "smart cities" to "smart homes" and beyond. Other serious problems, such as energy use and security, have persisted. When it comes to WSN security, the blockchain might be the answer. Traditional blockchains have limitations, such as inefficient transaction processing and limited scalability. When Wireless Sensor Networks (WSNs) are deployed, most of the time, the nodes are left unmanaged and vulnerable to various security threats. Reliable data distribution in WSNs is nontrivial because of the limited resources and dynamic behavior of sensor nodes. Traditional cryptography and authentication-based methods have been shown to be unsuitable for countering node misbehavior attacks due to their high cost and incapability. The lightweight authentication encryption system was developed to solve the problems of sensor resource scarcity and data security (data integrity and secrecy). Current trust-based solutions, on the other hand, increase traffic congestion and decrease the network's lifespan due to the high costs associated with trust estimates and network-wide dissemination. As a result, the objective of this study is to present an intrusion prevention architecture for mobile Internet of Things devices, along with its integration into WSN, to ensure data security while simultaneously improving the network delivery ratio. The architecture that has been suggested is made up of two different discrete components. To begin, the ambiguity principle is used to construct non-overlapping and independently structured clusters, which are then used to preserve the clusters' stability. Second, based on the architecture of the blockchain, encrypted multi-hop routing pathways with end-to-end coverage are being established. By reducing end-to-end latency, time consumption, packet loss rate, and energy usage while increasing throughput, our recommended model's simulation results reveal good results and security gains.

Design a Lightweight Authentication Encryption Based on Stream Cipher and Chaotic Maps with Sponge Structure for Internet of Things Applications

Design a Lightweight Authentication Encryption Based on Stream Cipher and Chaotic Maps with Sponge Structure for Internet of Things Applications

Certificateless Public Key Authenticated Encryption with Keyword Search Achieving Stronger Security

Transforming data into ciphertexts and storing them in the cloud database is a secure way to simplify data management. Public key encryption with keyword search (PEKS) is an important cryptographic primitive as it provides the ability to search for the desired files among ciphertexts. As a variant of PEKS, certificateless public key authenticated encryption with keyword search (CLPAEKS) not only simplifies certificate management but also could resist keyword guessing attacks (KGA). In this paper, we analyze the security models of two recent CLPAEKS schemes and find that they ignore the threat that, upon capturing two trapdoors, the adversary could directly compare them and distinguish whether they are generated using the same keyword. To cope with this threat, we propose an improved security model and define the notion of strong trapdoor indistinguishability. We then propose a new CLPAEKS scheme and prove it to be secure under the improved security model based on the intractability of the DBDH problem and the DDH problem in the targeted bilinear group.

A Comprehensive Review of Lightweight Authenticated Encryption for IoT Devices

Internet of Things (IoT) is a promising technology for creating smart environments, smart systems, and smart services. Since security is a fundamental requirement of IoT platforms, solutions that can provide both encryption and authenticity simultaneously have recently attracted much attention from academia and industry. This article analyses in detail state-of-the-art lightweight authenticated encryption (LAE) targeted to IoT systems. This work provides a thorough description of the algorithms, and the study systematically classifies them to facilitate understanding of relevant intricacies of the schemes. Among reviewed algorithms, there is a trade-off to retain design security, resources cost, and efficient performance. ACORN is the effective scheme on various platforms in terms of utilization of resources and power consumption, while MORUS and AES-CLOC are the fastest in hardware platforms. However, they are susceptible to misuse despite their resistance to side channel attacks. In contrast, JOLTICK, PRIMATESs, COLM, DeoxysII, OCB, and AES-JAMBU are provably resistant to nonce misuse. The challenges for possible future research are summarized. Overall, the article provides researchers and developers with practical guidance on various design aspects and limitations as well as open research challenges in the current lightweight authenticated encryption for IoT.

Universally Composable Oblivious Transfer with Low Communication

In this paper, a universally composable 1-out-of-N oblivious transfer protocol with low communication is built. This protocol obtained full simulation security based on the modulo learning with rounding (Mod-LWR) assumption. It can achieve universally composable security in the random oracle machine (ROM) model by combining random OT based on the key exchange protocol with the authentication encryption algorithm. It can be proven to resist static adversary attacks by simulating all corruption cases. Based on computer simulation and detailed mathematical derivation, this protocol was practicable and had better efficiency and lower communication.

GCM-SIV1.5: Optimal Tradeoff between GCM-SIV1 and GCM-SIV2.

GCM-SIV2 is a nonce-based beyond-birthday-bound (BBB)-secure authenticated encryption (AE) mode introduced by Iwata and Minematsu at FSE 2017. However, it is built by combining two instances of GCM-SIV1 and needs eight keys, which increases the costs of hardware and software implementation. This paper aims to reduce these costs by optimizing components (such as key materials, hash calls, and block cipher calls) and proposes an optimal tradeoff between GCM-SIV1 and GCM-SIV2 called GCM-SIV1.5. Moreover, we introduce the faulty nonce setting to AE and prove the BBB security of GCM-SIV1.5 with graceful security degradation in the faulty nonce setting by mirror theory. Finally, we discuss advantages of GCM-SIV1.5.

Sponge-Based Parallel Authenticated Encryption With Variable Tag Length and Side-Channel Protection

Authenticated Encryption (AE) protects confidentiality and integrity at the same time. The sponge construction is based on an iterated permutation or transformation that can be used to implement hashing, and AE schemes, among others. Sponge-based AE schemes offer desirable characteristics like parallelizability and incrementality. In addition, they provide security features such as protection against Chosen Plaintext Attacks, Chosen-Ciphertext Attacks, and Side-Channel Attacks (SCAs). Traditionally AE schemes assume the tag length, also called the stretch, as a fixed parameter per key, and the security is proved according to that assumption. However, the variable tag length per key could happen due to misconfiguration or misuse. In that case, the security would be violated, so it is vital to accommodate variable tag length without sacrificing other desirable features. Reyhanitabar et al. proposed Key Equivalent Separation by Stretch feature and concretized it for protection against tag length misuse attacks in block cipher-based AE schemes. However, the problem remains unresolved for sponge-based constructions, where current sponge-based schemes are vulnerable to tag length variation under the same key attacks. This work aims to bridge this gap by proposing a parallel, sponge-based AE scheme with a variable tag length per key that protects against SCAs and suggesting a lower bound for the recommended tag length. Finally, the security of the proposed scheme is discussed, and its performance is analyzed after implementing the proposed AE scheme in the C programming language.

Improved related‐tweakey rectangle attacks on round‐reduced Deoxys‐BC

AbstractDeoxys‐BC is the internal tweakable block cipher of the authenticated encryption (AE) Deoxys family, in which Deoxys‐II is the primary choice for the use case of ‘Defence in depth’ among the portfolio of CAESAR competition. Improvements of the related‐tweakey rectangle attacks on round‐reduced Deoxys‐BC using the known distinguishers is focussed in this study. Under the new related‐key rectangle attack framework proposed by Dong et al. in EUROCRYPT 2022, we present three kinds of precomputed tables to further reduce the time complexity in the key‐recovery phase. In the related‐tweakey rectangle attack, the invalid quartets are filtered or the subtweakey candidates are obtained by lookup the precomputed tables without more computation. Based on the precomputed table technique, we improved the related‐tweakey rectangle attacks on 11‐round Deoxys‐BC‐256, 13‐round and 14‐round Deoxys‐BC‐384. Furthermore, we reduce the time complexity of the 13‐round related‐tweakey rectangle attack on Deoxys AE scheme Deoxys‐I‐256‐128 by a factor of 224 compared with the best previous attack.

Certificateless Searchable Encryption Scheme in Multi-User Environment

Searchable encryption technology enables users to access data that has been made publicly encrypted without divulging the original content. The majority of the currently available multi-user certificateless searchable encryption technologies are based on identity-based public key encryption as well as conventional public key cryptosystems. Thus, they are challenged to adapt to the security needs of today’s large-scale network computing environment. As a result, issues such as excessive overhead, poor security, and the inability to handle large-scale applications are unavoidable. In order to address the aforementioned issues, this paper uses the method of combining public key authentication encryption and searchable encryption to propose a certificateless searchable encryption scheme in multi-user circumstances. The stochastic prediction model demonstrates that the scheme can effectively fend off keyword guessing attacks. The proposed algorithm not only performs well in terms of computation but also significantly reduces the amount of computation in simulations.

An Authentication Protocol for Next Generation of Constrained IoT Systems

With the exponential growth of connected Internet of Things (IoT) devices around the world, security protection and privacy preservation have risen to the forefront of design and development of innovative systems and services. For low-value IoT devices that identify and track billion of goods in various industries—such as radio-frequency identification (RFID) tags—this involves multiple challenges in very constrained environments. IoT devices aim to design low-cost, low-complexity infrastructure while enabling robust authentication protocols with reduced latency and energy consumption. Given these challenges, in this article, we present a new lightweight authentication protocol for IoT applications, employing an authenticated-encryption (AE) cryptosystem with associated data (AEAD). Since AEAD algorithms provide data confidentiality and message integrity simultaneously, security analysis [Real-or-Random (RoR) and Scyther] results prove the robustness of the proposed protocol against IoT threats. Furthermore, to measure the computation and communication cost, FPGA and ASIC simulations using four different AEAD candidates of National Institute of Standards and Technology (NIST) lightweight cryptography competition are executed. The implementation results [e.g., 4744 gate equivalent (GE) and 0.87-mw power] clearly show that our novel design can be applied to a wide range of constrained IoT devices complying with low-cost, lightweight, and high-speed requirements.

A Lightweight Authenticated Searchable Encryption without Bilinear Pairing for Cloud Computing

Outsourcing data to cloud services is a good solution for users with limited computing resources. Privacy and confidentiality of data is jeopardized when data is transferred and shared in the cloud. The development of searchable cryptography offers the possibility to solve these problems. Symmetric searchable encryption (SSE) is popular among researchers because it is efficient and secure. SSE often requires the data sender and data receiver to use the same key to generate key ciphertext and trapdoor, which will obviously cause the problem of key management. Searchable encryption based on public key can simplify the key management problem. A public key encryption scheme with keyword search (PEKS) allows multiple senders to encrypt keywords under the receiver’s public key. It is vulnerable to keyword guessing attacks (KGA) due to the small size of the keywords. The proposal of public key authenticated encryption with keyword search (PAEKS) is mainly to resist inside keyword guessing attacks. The previous security models do not involve the indistinguishability of the same keywords ( w 0 × × = w 1 ), which brings the user’s search pattern easy to leak. The essential reason is that the trapdoor generation algorithm is deterministic. At the same time, most of the existing schemes use bilinear pair design, which greatly reduces the efficiency of the scheme. To address these problems, the paper introduces an improved PAEKS model. We design a lightweight public key authentication encryption scheme based on the Diffie-Hellman protocol. Then, we prove the ciphertext indistinguishability security and trapdoor indistinguishability security of the scheme in the improved security model. Finally, the paper demonstrates its comparable security and computational efficiency by comparing it with previous PAEKS schemes. Meanwhile, we conduct an experimental evaluation based on the cryptographic library. Experimental results show that the computational overhead of our scheme compared with the ciphertext generation algorithm, trapdoor generation algorithm and test algorithm of other schemes Our scheme reduces 274, 158 and 60 times, respectively.

Brain inspired neuronal silencing mechanism to enable reliable sequence identification

Real-time sequence identification is a core use-case of artificial neural networks (ANNs), ranging from recognizing temporal events to identifying verification codes. Existing methods apply recurrent neural networks, which suffer from training difficulties; however, performing this function without feedback loops remains a challenge. Here, we present an experimental neuronal long-term plasticity mechanism for high-precision feedforward sequence identification networks (ID-nets) without feedback loops, wherein input objects have a given order and timing. This mechanism temporarily silences neurons following their recent spiking activity. Therefore, transitory objects act on different dynamically created feedforward sub-networks. ID-nets are demonstrated to reliably identify 10 handwritten digit sequences, and are generalized to deep convolutional ANNs with continuous activation nodes trained on image sequences. Counterintuitively, their classification performance, even with a limited number of training examples, is high for sequences but low for individual objects. ID-nets are also implemented for writer-dependent recognition, and suggested as a cryptographic tool for encrypted authentication. The presented mechanism opens new horizons for advanced ANN algorithms.

A Single-Pass and One-Round Message Authentication Encryption for Limited IoT Devices

In this work, we propose three efficient variants of a message authentication encryption (MAE) algorithm, which is based on the dynamic key-dependent concept and dynamic operation mode to reach a high level of security. These variants consist of a single pass and a single round, in addition to the use of common operations for the encryption and authentication processes to reduce the required execution time and resources. Accordingly, the proposed scheme outperforms the existing solutions that are based on the static approach with multiple rounds. Furthermore, to reduce the overhead associated with the regeneration of the dynamic key and the corresponding cryptographic primitives, we propose a simple, yet effective update process. In such a scheme, even when the same plaintext is processed, it will be encrypted and authenticated using different cryptographic primitives (substitution and permutation tables in addition to round keys), which guards against the existing cryptanalysis techniques. The experimental results show that the proposed MAE variants are more efficient than the counter with cipher block chaining message authentication code (CCM), Galois message authentication code (GMAC), offset codebook mode (OCB), and the Chacha20-poly1305. The best performance is achieved with the third MAE variant that presents a high throughput with an enhancement of at least 373% compared to CCM, 90% compared to GCM, 23% compared to OCB, and 22% compared to Chacha20-poly1305.

Multiple Impossible Differential Attacks for ForkAES

To yield a highly efficient authentication encryption design for very short messages, the tweakable forkcipher is proposed, which is a tweakable block cipher that uses forking construction to produce two output blocks. The designers also presented ForkAES, a forkcipher that is based on the round function of AES and the tweakable variant of KIASU. Therefore, the security of ForkAES is found on the block ciphers AES and KIASU. However, from the perspective of new forking construction, attackers may obtain some unique properties. Impossible differential attacks are widely used on block ciphers. This paper studies the security of ForkAES against multiple impossible differential cryptanalysis. Based on the property of the forking construction, two types of impossible differential distinguishers have been constructed. We first use the tweak with different truncated differences to build more attack trails. Then, we first propose the multiple impossible differential attack for ForkAES- <math xmlns="http://www.w3.org/1998/Math/MathML" id="M1"> <mi>∗</mi> </math> -5-4. Thus, only a single round would remain as a security margin. Utilizing multiple attack trails, our attack scenario obtains more subkey bytes and enhances the subkey’s sieving efficiency without increasing complexity. Furthermore, we carefully consider the process of recovering the master key, which can efficiently reject wrong candidate keys. In reconstruction queries, our attack reaches the longest number of rounds for ForkAES in impossible differential analysis, with <math xmlns="http://www.w3.org/1998/Math/MathML" id="M2"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>100.8</mn> </mrow> </msup> </math> lookups, <math xmlns="http://www.w3.org/1998/Math/MathML" id="M3"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>85.8</mn> </mrow> </msup> </math> chosen ciphertexts, and <math xmlns="http://www.w3.org/1998/Math/MathML" id="M4"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>92.7</mn> </mrow> </msup> </math> memory blocks to store AES states. In encryption queries, we improve the previous attacks on ForkAES by attacking one more round (i.e., ForkAES- <math xmlns="http://www.w3.org/1998/Math/MathML" id="M5"> <mi>∗</mi> </math> -5-4), with <math xmlns="http://www.w3.org/1998/Math/MathML" id="M6"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>118.2</mn> </mrow> </msup> </math> lookups, <math xmlns="http://www.w3.org/1998/Math/MathML" id="M7"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>111.4</mn> </mrow> </msup> </math> plaintexts, and <math xmlns="http://www.w3.org/1998/Math/MathML" id="M8"> <msup> <mrow> <mn>2</mn> </mrow> <mrow> <mn>92.7</mn> </mrow> </msup> </math> memory blocks to store AES states.

Face Authentication in Chat Application using Cryptography

Data plays a vital role in the world of computer network. There are many platforms to share data between a group of devices or individual or a group of peoples. Every person in the community needs him Information to keep safe from a third party. Here we have created a simple chat application with face authentication that can be used once to view end-to-end encryption authentication and shared message. This takes credentials to register and requires Face snap to authenticate the user. There are face snaps. Trained using the KNN Classifier. These face snaps are classified using the Haar cascade classifier algorithm for detection. User's face can be identified and logged in only if the user matches the credentials and can send messages. The receiving user is identified and the message is viewed.

Forward Secure Public-key Authenticated Encryption with Conjunctive Keyword Search

Abstract Public key encryption with keyword search is a promising primitive which enables search over encrypted data in secure data outsourcing services. In traditional construction, the associated keywords may be recovered from a given trapdoor by a malicious server through keyword guessing attacks. Therefore, the notion of public-key authenticated encryption with keyword search (PAEKS) was introduced, where a sender encrypts (and authenticates) the keywords using a receiver’s public key and its secret key. In this paper, we consider the forward security for PAEKS and introduce a new primitive: forward secure public-key authenticated encryption with keyword search (FS-PAEKS), which captures the information leakage risk from previously issued queries due to the updates on the outsourced data. Technically, we embed a non-interactively agreed key into the cipher-keyword generation algorithm, and bind the cipher-keyword and the trapdoor with a set converted from algorithm-generation time. Finally, we present an efficient FS-PAEKS scheme supporting conjunctive query, and prove its forward security against chosen keyword attacks and keyword guessing attacks. To illustrate practical performance, we implement our FS-PAEKS and related PAEKS schemes based on Enron dataset in real cloud environment.

STEB: A secure service trading ecosystem based on blockchain.

A service can be an intangible commodity in which no physical goods are transferred from the seller to the buyer. However, traditional trading platforms have many limitations in trading services due to dishonest buyers and brokers. In this paper, we propose a service trading ecosystem based on blockchain, named STEB, which combines blockchain, smart contract, encryption, and digital authentication techniques for service trading. In addition, a dual-chain architecture, which contains two types of blockchains, namely TraChain and SerChain, and a hierarchical encryption scheme of the data on the chain, are proposed to ensure the integrity of transaction data and fine-grained privacy protection of users. Furthermore, we describe a new set of smart contracts to ensure safe transactions for the entire service trading. Security analysis and simulation results confirm that the proposed STEB can achieve more efficient contract execution and enhance service transaction privacy.