Certificate-based Cryptography Research Articles

Escrow-free and efficient dynamic anonymous privacy-preserving batch verifiable authentication scheme for VANETs

To enhance road safety, Vehicular Ad-hoc Networks (VANETs) facilitate the exchange of safety-critical messages between smart vehicles and road traffic authorities. However, VANET’s wireless channels are prone to several attacks, such as replay or modification. Therefore, to protect the links, robust authentication and message integrity mechanisms are required. Previously, several robust authentication schemes have been devised. However, those designs often struggle with complex certificate management, the key escrow problem, and the necessity for secure channels to establish user keys. Additionally, prior methods rely on pseudonyms to ensure user privacy. To implement it, several pseudonyms are stored in the vehicle’s device, which burdens the device. To overcome these limitations, this study introduces an efficient and escrow-free dynamic anonymous authentication scheme tailored for VANETs. By utilizing the paradigm of certificate-based cryptography and fuzzy identity generation, the proposed design eliminates the limitations. Through rigorous security analysis, the proposed design’s effectiveness against various threats is demonstrated. Furthermore, a detailed performance analysis, including computational and communication cost comparisons, showcases the scheme’s feasibility for VANET deployment. An NS-3 simulation further confirms the suitability of the proposed scheme for real-world VANET communication scenarios.

A Lightweight Certificate-Based Aggregate Signature Scheme Providing Key Insulation

Recently, with the advancement of Information and Communications Technology (ICT), Internet of Things (IoT) has been connected to the cloud and used in industrial sectors, medical environments, and smart grids. However, if data is transmitted in plain text when collecting data in an IoT-cloud environment, it can be exposed to various security threats such as replay attacks and data forgery. Thus, digital signatures are required. Data integrity is ensured when a user (or a device) transmits data using a signature. In addition, the concept of data aggregation is important to efficiently collect data transmitted from multiple users (or a devices) in an industrial IoT environment. However, signatures based on pairing during aggregation compromise efficiency as the number of signatories increases. Aggregate signature methods (e.g., identity-based and certificateless cryptography) have been studied. Both methods pose key escrow and key distribution problems. In order to solve these problems, the use of aggregate signatures in certificate-based cryptography is being studied, and studies to satisfy the prevention of forgery of signatures and other security problems are being conducted. In this paper, we propose a new lightweight signature scheme that uses a certificate-based aggregate signature and can generate and verify signed messages from IoT devices in an IoT-cloud environment. In this proposed method, by providing key insulation, security threats that occur when keys are exposed due to physical attacks such as side channels can be solved. This can be applied to create an environment in which data is collected safely and efficiently in IoT-cloud is environments.

Efficient Anonymous Certificate-Based Multi- Message and Multi-Receiver Signcryption Scheme for Healthcare Internet of Things

Healthcare Internet of Things (IoT) is an emerging paradigm, which can provide comprehensive and different types of health services and enable various types of medical sensors to monitor patient's health conditions. In the healthcare IoT, patient is deployed with a variety of medical sensors, which continuously monitors and collects patient's sensitive health data that needs specially protection for preventing privacy leakage. To safely send multiple different health data monitored by multiple different medical sensors to multiple corresponding healthcare professionals in one data report, several multi-message and multi-receiver signcryption schemes have been introduced by employing the traditional public key cryptography, identity-based cryptography or certificateless cryptography. However, these schemes suffer from the certificate management, key escrow and key distribution problem. Besides, due to the resource-constraint property of medical sensors, they are unsuitable for healthcare IoT in terms of both performance and privacy requirements. To solve these issues, this paper introduces an efficient anonymous certificate-based multi-message and multi-receiver signcryption scheme for healthcare IoT, where the certificate-based cryptography and elliptic curve cryptography are combined to simplify the certificate management problem, eliminate the key escrow problem, solve the key distribution problem and ensure the privacy-preserving. Furthermore, the security analysis suggests that the proposed scheme is able to achieve the confidentiality, unforgeability, receiver anonymity, sender anonymity and decryption fairness; the performance evaluation indicates that the proposed scheme brings to the lower computation cost and communication cost in comparison to the existing schemes.

Secure Channel Free Certificate-Based Searchable Encryption Withstanding Outside and Inside Keyword Guessing Attacks

Searchable public key encryption (SPKE) is a useful public key cryptographic primitive that allows a user to perform keyword searches over publicly encrypted messages on an untrusted storage server while guaranteeing the privacy of the original messages as well as the search keywords. However, most of the previously proposed SPKE frameworks suffer from the security vulnerability caused by the keyword guessing attack and some other weaknesses. Inspired by the ideas of certificate-based cryptography and signcryption, we present a new SPKE framework called certificate-based searchable encryption. The new framework not only provides resistance to the existing known types of keyword guessing attacks, but also enjoys some appealing merits, such as implicit authentication, no key escrow and no secure channel. Under this new framework, we devise a concrete searchable certificate-based encryption scheme. In the random oracle model, it is proven to meet the keyword ciphertext indistinguishability, the keyword ciphertext unforgeability and the keyword trapdoor indistinguishability under the adaptive chosen-keyword attack. The comparisons indicate that it is secure and practicable.

Efficient Certificate-Based Signature with Short Key and Signature Sizes from Lattices

Certificate-based cryptography (CB-PKC) is an attractive public key setting, which reduces the complexity of public key infrastructure in traditional public key settings and resolves the key escrow problem in ID-based public key settings. In the past, a large number of certificate-based signature and encryption schemes were proposed. Nevertheless, the security assumptions of these schemes are mainly relied on the difficulties of the discrete logarithm and factorization problems. Unfortunately, both problems will be resolved when quantum computers come true in the future. Public key cryptography from lattices is one of the important candidates for post-quantum cryptography. However, there is little work on certificate-based cryptography from lattices. In the paper, we propose a new and efficient certificate-based signature (CBS) scheme from lattices. Under the short integer solution (SIS) assumption from lattices, the proposed CBS scheme is shown to be existential unforgeability against adaptive chosen message attacks. Performance comparisons are made to demonstrate that the proposed CBS scheme from lattices is better than the previous lattice-based CBS scheme in terms of private key size and signature size.

Leakage-Resilient Certificate-Based Signature Resistant to Side-Channel Attacks

Certificate-based cryptography is an attractive public-key setting, and it not only simplifies certificate management in the traditional public-key cryptography but also eliminates the key escrow problem inherent in the identity-based cryptography. Recently, leakage-resilient cryptography resistant to side-channel attacks has received significant attention from cryptographic researchers. By side-channel attacks, adversaries could obtain partial information of secret and private keys involved in cryptographic algorithms by perceiving execution time or energy consumptions of each algorithm invocation. The certificate-based signature (CBS) is a class of important public-key signature. Up to date, there exists no leakage-resilient CBS (LR-CBS) scheme resistant to side-channel attacks. In this paper, the first LR-CBS scheme is proposed and it possesses overall unbounded leakage property, namely, it permits adversaries to continuously obtain partial information of secret or private keys involved in the associated algorithm invocations. The security analysis is given to prove that the proposed LR-CBS scheme is existential unforgeability against adaptive chosen-message attacks for adversaries in the generic bilinear group model.

An Efficient Certificate-Based Authenticated Key Agreement Protocol without Bilinear Pairing

An authenticated key agreement (AKA) protocol is extremely essential to secure communications over insecure public networks. It enables the communication parties to securely set up a shared session key in present of the malicious attackers. Certificate-based cryptography (CBC) is a novel public-key cryptographic primitive that has many attractive merits. It solves the certificate revocation problem in conventional public-key cryptography and the key-escrow problem in identity-based cryptography. Till now, four AKA protocols have been proposed in the setting of CBC. However, all of them adopt the costly bilinear pairings and are not suitable for the devices which have limited computing resources and battery power. So, it is interesting and worthwhile to design a certificate-based AKA protocol without using the bilinear pairings. In this paper, we develop a pairing-free certificate-based AKA protocol. The proposed protocol is proven secure under the classic computational Diffie-Hellman assumption in the random oracle model. Compared with the previous pairing-based certificate-based AKA protocols, the proposed protocol enjoys obvious advantage in the computation efficiency.DOI: http://dx.doi.org/10.5755/j01.itc.46.3.14968

A Certificateless Strong Designated Verifier Signature Scheme with Non-delegatability

The designated verifier signature only enables the designated verifier to check the correctness of the signature, while any third party can not verify whether this signature is valid or not. Most of the previous designated verifier signature schemes depend on certificate-based cryptography or identity-based cryptography, while little attention has been paid to the certificateless designated verifier signature scheme which has much more advantages than the previous constructions. In this paper, we propose the first certificateless strong designated verifier signature scheme with non-delegatability. We show that our scheme satisfies the basic properties of a designated verifier signature scheme and resists the two types of adversaries in certificateless cryptography. In addition, the comparison with other existing certificateless SDVS schemes demonstrates the proposed scheme is provided with a good level of security and performance.

SVC: Secure VANET-Assisted Remote Healthcare Monitoring System in Disaster Area

With the feature of convenience and low cost, remote healthcare monitoring (RHM) has been extensively used in modern disease management to improve the quality of life. Due to the privacy of health data, it is of great importance to implement RHM based on a secure and dependable network. However, the network connectivity of existing RHM systems is unreliable in disaster area because of the unforeseeable damage to the communication infrastructure. To design a secure RHM system in disaster area, this paper presents a Secure VANET-Assisted Remote Healthcare Monitoring System (SVC) by utilizing the unique “store-carry-forward” transmission mode of vehicular ad hoc network (VANET). To improve the network performance, the VANET in SVC is designed to be a two-level network consisting of two kinds of vehicles. Specially, an innovative two-level key management model by mixing certificate-based cryptography and ID-based cryptography is customized to manage the trust of vehicles. In addition, the strong privacy of the health information including context privacy is taken into account in our scheme by combining searchable public-key encryption and broadcast techniques. Finally, comprehensive security and performance analysis demonstrate the scheme is secure and efficient.

Improved certificate‐based signature scheme without random oracles

Certificate-based cryptography is a useful primitive that combines traditional public key cryptography (PKC) and identity-based cryptography (IBC). It not only solves the key escrow problem inherent in IBC, but also simplifies the certificate problem in traditional PKC. So far, several certificate-based signature (CBS) schemes have been proposed in the literature. However, none of them consider the malicious certificate authority (CA) attack. Cryptanalysis shows that two previous CBS schemes without random oracles fail in achieving unforgeability under such attack. To overcome the security weakness in these schemes, the authors propose an improved CBS scheme that can withstand malicious CA attacks. They prove it to be existentially unforgeable against chosen message attacks under the computational Diffie–Hellman assumption in the standard model. Compared with the previous standard-model CBS schemes, the proposed scheme has obvious advantages in both the computation and communication efficiency.

Sharing a Large Secret Image Using Meaningful Shadows Based on VQ and Inpainting

Certificate-based cryptography is a useful public key cryptographic primitive that combines the merits of traditional public key cryptography and identity-based cryptography. It not only solves the key escrow problem inherent in identity-based cryptography, but also simplifies the cumbersome certificate management problem in traditional public key cryptography. In this paper, by giving a concrete attack, we first show that the certificate-based encryption scheme without bilinear pairings proposed by Yao et al. does not achieve either the chosen-ciphertext security or the weaker chosen-plaintext security. To overcome the security weakness in Yao et al.’s scheme, we propose an enhanced certificate-based encryption scheme that does not use the bilinear pairings. In the random oracle model, we formally prove it to be chosen-ciphertext secure under the computational Diffie-Hellman assumption. The experimental results show that the proposed scheme enjoys obvious advantage in the computation efficiency compared with the previous certificate-based encryption schemes. Without costly pairing operations, it is suitable to be employed on the computation-limited or power-constrained devices.

A New Efficient Certificate‐Based Signature Scheme

Certificate-based cryptography is a newkind of public key algorithm, which combines the merits oftraditional Public key infrastructure (PKI) and identitybased cryptography. It removes the inherent key escrowproblem in the identity-based cryptography and eliminatesthe certificate revocation problem and third-party queriesin the traditional PKI. In this paper, we propose an efficient certificate-based signature scheme based on bilinearpairings. Under the strong security model of certificatebased signature scheme, we prove that our scheme is existentially unforgeable against adaptive chosen message andidentity attacks in the random oracle. In our scheme, onlytwo pairing operations are needed in the signing and verification processes. Compared with some certificate-basedsignature schemes from bilinear pairings, our scheme enjoys more advantage in computational cost and communicational cost.

Genetic-IDGKA: Genetic ID-Based Group Key Agreement Protocol for Large MANETs

The Research works on Key Management Schemes in Mobile Ad-Hoc Networks (MANETs) are attracting more and more attention to Researchers. Proving secured communication in MANET is extremely challenging one as it is dynamic in nature and the lack of centralized management. To address these issues, several researchers have proposed Key Management Schemes. In this work, we have identified and thoroughly studied three popular Key Management Schemes namely i. ID-based Multiple Secrets Key Management Scheme ii. RSA Certificate-Based Cryptography and iii. ID-Based Authenticated Group Key Agreement Protocol. We have proposed an efficient Genetic Model to optimize the performances of Key Management Schemes in terms of Key Initialization, Selecting Random Number Generator, Key Updation Timing, Packet Size, Computing Future Session Key and Session Group Key and forming Dynamic Clustering Group. The proposed Genetic Model was successfully implemented with VC++ and integrated with the above mentioned Key Management Schemes. From our experimental results, we revealed that the Genetic Model Based Key Management Schemes achieving higher security level as compared with ordinary Key Management Schemes, particularly the Genetic ID-Based Authenticated Group Key Agreement Protocol outperforms all the other two identified Key management Schemes in terms of Mobility Robustness, Computational and Message Overhead, Strength of Security, Key Exchange Time, Power Consumption and Key Update Time.

Provably Secure Certificate-Based Signcryption Scheme without Pairings

Certificate-based cryptography is a new cryptographic paradigm that provides an interesting balance between identity-based cryptography and traditional public key cryptography. It not only simplifies the complicated certificate management problem in traditional public key cryptography, but also eliminates the key escrow problem in identity-based cryptography. As an extension of the signcryption in certificate-based cryptography, certificate-based signcryption provides the functionalities of certificate-based encryption and certificate-based signature simultaneously. However, to the best of our knowledge, all constructions of certificate-based signcryption in the literature so far have to be based on the costly bilinear pairings. In this paper, we propose a certificate-based signcryption scheme that does not depend on the bilinear pairings. The proposed scheme is provably secure in the random oracle model. Due to avoiding the computationally-heavy paring operations, the proposed scheme significantly reduces the cost of computation and outperforms the previous certificate-based signcryption schemes.

Efficient certificate-based signcryption secure against public key replacement attacks and insider attacks.

Signcryption is a useful cryptographic primitive that achieves confidentiality and authentication in an efficient manner. As an extension of signcryption in certificate-based cryptography, certificate-based signcryption preserves the merits of certificate-based cryptography and signcryption simultaneously. In this paper, we present an improved security model of certificate-based signcryption that covers both public key replacement attack and insider security. We show that an existing certificate-based signcryption scheme is insecure in our model. We also propose a new certificate-based signcryption scheme that achieves security against both public key replacement attacks and insider attacks. We prove in the random oracle model that the proposed scheme is chosen-ciphertext secure and existentially unforgeable. Performance analysis shows that the proposed scheme outperforms all the previous certificate-based signcryption schemes in the literature.

A Forward-Secure Certificate-Based Signature Scheme

Cryptographic computations are often carried out on insecure devices for which the threat of key exposure raises a serious concern. In an effort to address the key exposure problem, the notion of forward security was first presented by Günther in 1990. In a forward-secure scheme, secret keys are updated at regular periods of time; exposure of the secret key corresponding to a given time period does not enable an adversary to ‘break’ the scheme for any prior time period. In this paper, we first introduce forward security into certificate-based cryptography and define the security model of forward-secure certificate-based signatures (CBSs). Then we propose a forward-secure CBS scheme, which is shown to be secure against adaptive chosen message attacks under the computational Diffie–Hellman assumption in the random oracle model. Our result can be viewed as the first step toward solving the key exposure problem in CBSs and thus improving the security of the whole system.

Certificate-Based Encryption Scheme without Pairing

Certificate-based cryptography is a new cryptographic primitive which eliminates the necessity of certificates in the traditional public key cryptography and simultaneously overcomes the inherent key escrow problem suffered in identity-based cryptography. However, to the best of our knowledge, all existed constructions of certificate-based encryption so far have to be based on the bilinear pairings. The pairing calculation is perceived to be expensive compared with normal operations such as modular exponentiations in finite fields. The costly pairing computation prevents it from wide application, especially for the computation limited wireless sensor networks. In order to improve efficiency, we propose a new certificate-based encryption scheme that does not depend on the pairing computation. Based on the decision Diffie-Hellman problem assumption, the schemes security is proved to be against the chosen ciphertext attack in the random oracle. Performance comparisons show that our scheme outperforms the existing schemes.

Provably secure certificate-based signature scheme without pairings

In order to simplify certificate management in traditional public key cryptography and solve the key escrow problem in identity-based cryptography, the notion of certificate-based cryptography was introduced. Recently, Ming and Wang proposed a certificate-based signature scheme without pairings. They claimed that the scheme was existentially unforgeable against adaptive chosen message and identity attacks in the random oracle. In this paper, we show that the scheme is insecure against a malicious certifier under existing security model. We also propose a new efficient certificate-based signature scheme without pairings, which is proven secure in the random oracle model. Compared with the existed certificate-based signature schemes without parings, our scheme enjoys shorter signature length and less operation cost.

A hybrid approach to secure hierarchical mobile IPv6 networks

Establishing secure access and communications in a hierarchical mobile IPv6 (HMIPv6) network, when a mobile node is roaming into a foreign network, is a challenging task and has so far received little attention. Existing solutions are mainly based on public key infrastructure (PKI) or identity-based cryptography (IBC). However, these solutions suffer from either efficiency or scalability problems. In this paper, we leverage the combination of PKI and certificate-based cryptography and propose a hierarchical security architecture for the HMIPv6 roaming service. Under this architecture, we present a mutual authentication protocol based on a novel cross-certificate and certificate-based signature scheme. Mutual authentication is achieved locally during the mobile node?s handover. In addition, we propose a key establishment scheme and integrate it into the authentication protocol which can be utilized to set up a secure channel for subsequent communications after authentication. As far as we know, our approach is the first addressing the security of HMIPv6 networks using such a hybrid approach. In comparison with PKI-based and IBCbased schemes, our solution has better overall performance in terms of authenticated handover latency.

A Certificate-based Signature Scheme for Mobile Ad Hoc Networks

In order to insure the security of communication in mobile Ad hoc networks, we proposed a new signature scheme which is based on bilinear pairing and certificate-based cryptography. The security of the scheme was proved under the Random Oracle Model. The scheme is also efficient, since the signing algorithm does not need the computation of the bilinear pairing and the verification algorithm needs that computation only once. Thus it is particularly useful in Ad hoc networks.