Pairing Computation Research Articles

Attribute-Based Authenticated Group Key Transfer Protocol without Pairing

Group key establishment protocol is the primary requirement of several group-ware applications, like secure conferences, pay per view, collaborative work space that needs to establish a secure session among a group of participants. However, some of the applications often need to establish a secure session among the participants without knowing their actual identities. In such cases, the legitimacy of participants is decided based up on a descriptive set of attributes usually called as access structure. The participants should have sufficient set of attributes to satisfy the access structure, which are to consider as authenticated and eligible for the group conversation. This paper introducing an attribute based authenticated group key transfer protocol without using bilinear pairing. Group key management based on attributes gives fine-grained access control over the group of members that are authenticated by the set of attributes. The proposed protocol uses, Shamir Secret Sharing and elliptic curve arithmetic instead of bilinear pairing computations. The members are authenticated based on the access structure defined by the session initiator. The group key is securely transferred to only those participants, who are authenticated by their attributes. The authentication process of proposed protocol is information theoretically secure, while the key confidentiality relies on the intractability of Elliptic Curve Discrete Logarithm Problem.

Constructive Analysis of Eigenvalue Problems in Control under Numerical Uncertainty

The eigenvalue problem plays a central role in linear algebra and its applications in control and optimization methods. In particular, many matrix decompositions rely upon computation of eigenvalue-eigenvector pairs, such as diagonal or Jordan normal forms. Perturbation theory and various regularization techniques help address some numerical difficulties of computation eigenvectors, but often rely on per se uncomputable quantities, such as a minimal gap between eigenvalues. In this note, the eigenvalue problem is revisited within constructive analysis allowing to explicitly consider numerical uncertainty. Exact eigenvectors are substituted by approximate ones in a suitable format. Examples showing influence of computation precision are provided.

Cocks–Pinch curves of embedding degrees five to eight and optimal ate pairing computation

Recent algorithmic improvements of discrete logarithm computation in special extension fields threaten the security of pairing-friendly curves used in practice. A possible answer to this delicate situation is to propose alternative curves that are immune to these attacks, without compromising the efficiency of the pairing computation too much. We follow this direction, and focus on embedding degrees 5 to 8; we extend the Cocks–Pinch algorithm to obtain pairing-friendly curves with an efficient ate pairing. We carefully select our curve parameters so as to thwart possible attacks by “special” or “tower” Number Field Sieve algorithms. We target a 128-bit security level, and back this security claim by time estimates for the DLP computation. We also compare the efficiency of the optimal ate pairing computation on these curves to $$k=12$$ curves (Barreto–Naehrig, Barreto–Lynn–Scott), $$k=16$$ curves (Kachisa–Schaefer–Scott) and $$k=1$$ curves (Chatterjee–Menezes–Rodriguez-Henriquez).

Problematic configurations and choice-join pairs on Mono-T-Semiflow nets: towards the characterization of behavior-structural properties

This work is concerned with the computation of problematic configurations and problematic choice-join pairs in timed continuous Petri nets under the infinite server semantics; those net structural objects explain possible bad/counter-intuitive behaviors of systems, such as non-monotonicities and discontinuities of the equilibrium throughput. The calculation of problematic configurations is a computationally complex task since their number grows exponentially with the input cardinality of join transitions. In order to alleviate this inconvenience, four type of reduction rules preserving the set of problematic configurations are addressed. Reduction rules are weighted versions of the macroplace, macrotransition, and fusion of transitions rules, the elimination of implicit places rule is also provided. Reduced nets are useful to better understand the net substructures leading to unexpected behaviors in the equilibrium throughput. They help to highlight that the structural objects named problematic choice-join pairs, defined in this work, are the actual responsible of these counter-intuitive throughput behaviors. The great advantage over the set of problematic configurations is that the set of problematic choice-join pairs grows polynomially in the size of the net.

Computing the optimal ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Computing the optimal Ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Fast Hashing to $${\mathbb {G}}_{2}$$ on Aurifeuillean Pairing-Friendly Elliptic Curves

In pairing-based cryptography, the computation of asymmetric pairings $$e: {\mathbb {G}}_{1}\times {\mathbb {G}}_{2}\longrightarrow {\mathbb {G}}_{T}$$ requires input points of prime order r. The process of getting those r-torsion point is known as hashing into $${\mathbb {G}}_{1}$$ or $${\mathbb {G}}_{2}$$ and is in general costly. Few recent works have considered the Scott et al.’s method and Fuentes et al.’s method for hashing on specific families of pairing-friendly curves. In this work, we apply those two methods on the recently discovered Scott–Guillevic Aurifeuillean curves with embedding degree $$k=6,9,15,18,27$$ and 54. The results obtained show that the Fuentes et al.’s method is at least twice faster than the Scott et al.’s method in terms of group operations. In addition, the computational cost of hashing into $${\mathbb {G}}_{2}$$ studied in this work is higher compared to the previous work done with BN curves, KSS curves and BLS curves at comparable embedding degrees.

A Provably Secure and Lightweight Identity-Based Two-Party Authenticated Key Agreement Protocol for Vehicular Ad Hoc Networks

As an important part of smart cities, vehicle ad hoc networks (VANETs) have attracted much attention from both industry and academia. In a VANET, generating a secure session key to facilitate subsequent data-in-transit transfer between two or more vehicles is crucial, which can be achieved by using an authenticated key agreement protocol. However, most of the existing identity-based two-party authenticated key agreement protocols have significant computational requirements or are known to be insecure. Thus, in this paper, a secure and efficient identity-based two-party authenticated key agreement protocol is presented by us. This protocol does not involve complex bilinear pairing computations and can generate a valid session key in two rounds. The security of the proposed protocol is proved in the eCK model which has better capability to describe a protocol’s security than the famous CK model, and it has been widely used in the security proof of ID-based key agreement protocols currently. Additionally, we also evaluate its performance for potential utility in a VANET.

Scalar Multiplication via Elliptic Net using Generalized Equivalent Sequences

Chord and tangent is a classical method to calculate the elliptic curve scalar multiplication. Alternatively, the scalar multiplication can be calculated by dividing polynomials over certain finite fields and the first elliptic net scalar multiplication was implemented on a short Weierstrass curve. The net was originated from non-linear recurrence sequences, namely as elliptic divisibility sequence. It is well known that the linear recurrence sequences have been applied in the cryptosystem as a cipher in the encryption and decryption process. From the perspective of cryptographic application, the elliptic divisibility sequence is used generally for integer factorization, solving elliptic curve discrete logarithm problem and computation of pairing or scalar multiplication. But there is a lack of contribution of these non-linear recurrence sequences in scalar multiplication. Therefore, this paper aims to discuss a generalization of the equivalent sequence of elliptic divisibility for computing scalar multiplication. The experimental results of scalar multiplication via the net and its coding in computer programming are presented. The future direction of scalar multiplication via the elliptic net is also discussed.

Efficient traceable ring signature scheme without pairings

Although currently several traceable (or linkable) ring signature schemes have been proposed, most of them are constructed on pairings. In this paper, we present an efficient traceable ring signature (TRS) scheme without pairings, which is based on the modified EDL signature (first proposed by D.Chaum et al. in Crypto 92). Compared with other ring signature schemes, the proposed scheme does not employ pairing computation and has some computational advantages, whose security can be reduced to the computational Diffie-Hellman (CDH) and decisional Diffie-Hellman (DDH) assumptions in the random oracle model. Also, the proposed scheme is similar to certificateless signature scheme, where user and key generating center make interaction to generate ring key. We give a formal security model for ring signature and prove that the proposed scheme has the properties of traceability and anonymity.

An efficient public key functional encryption for inner product evaluations

As many services have changed from offline to online, a lot of personal information including user private data has been collected by and exchanged with various service providers. An issue raised in this process is that personal information can be exploited by multiple unwanted entities without the data owner’s knowledge. To solve this problem, functional encryption was proposed. It is suitable for data protection because even if a third-party uses the owner’s secret key for a function f, it cannot retrieve the original message x from the ciphertext. This means that information about x cannot be published, but is exposed only as f(x), the result of the function f. However, previous pairing-based public key functional encryption schemes for inner product evaluations (FE-IPE) cannot be practical solutions yet because they require too much computation, communication and storage overheads. In this paper, we propose an efficient pairing-based public key FE-IPE that requires only n (i.e., the dimension of vectors for function and message) exponentiation plus two pairing computations for decryption with smaller sized public parameters, secret keys and ciphertexts. And this scheme supports fully collusion resistance. The proposed scheme is proven selectively secure against chosen-plaintext attacks in the standard model under the external Diffie–Hellman assumption.

Improvement of ID-based proxy re-signature scheme with pairing-free

As an all-important cryptographical technique, proxy re-signature (PRS) is broadly applied to distributed computation, copyright transfer and hidden path transfer because it permits a proxy to translate an entity’s signature into another entity’s signature on the identical message. Most existing PRS schemes make use of time-consuming pairing computation. Recently, to discard time-consuming pairing operator and complicated certificate-management, Wang et al. proposed two efficient pairing-free ID-based PRS schemes, and declared that their schemes were provably secure in the ROM. Very unluckily, in this investigation, we point out that Wang et al.’s schemes suffer from attacks of universal forgery by analyzing their security, i.e., any one can fabricate a signature on arbitrary data. After the relevant attacks are shown, the reasons which result in such attacks are analyzed. Finally, to address the above-mentioned attacks, we put forward an improved ID-based PRS scheme. The improved scheme not only preserves all advantages of Wang et al.’s scheme, but also is demonstrated to be provably secure in the ROM. Compared with the other two ID-PRS schemes, our improved ID-PRS scheme offers more advantages in respect of the overall performance and security.

A Distributed Access Control with Outsourced Computation in Fog Computing

With the rapid development of information technology and the Internet of Things Technology (IOT), data security and healthy privacy are getting a lot of attention. In order to store, access, and share electronic health records, storage of this data is transferred to a third-party-cloud server. The security and privacy of electronic health records stored at date center or cloud server are not guaranteed. Before being sent to date center or cloud server, this data should be encrypted. Designing an efficient and secure fine-grained access control strategy for personal health records is facing enormous challenges. Security and privacy for electronic health records are very important because the electronic health data which plays an important role in medical server and treatment is directly associated with a particular patient. Attribute-based encryption (ABE) can effectively achieve fine-grained access control. However, the computation of bilinear pairings requires a large amount of computation overhead in ABE scheme. In order to decrease the computational overhead and ensure the confidentiality of electronic health records, a distributed fine-grained access control scheme with outsourced computation for IOT is proposed in this paper. Little calculation is executed by the receiver and sender in our proposed scheme. Outsourcing computing reduces the computing burden. The analyses of safety and performance show that our proposed scheme is safe and effective compared with previous schemes.

A Secure and Efficient Data Sharing and Searching Scheme in Wireless Sensor Networks.

Wireless sensor networks (WSN) generally utilize cloud computing to store and process sensing data in real time, namely, cloud-assisted WSN. However, the cloud-assisted WSN faces new security challenges, particularly outsourced data confidentiality. Data Encryption is a fundamental approach but it limits target data retrieval in massive encrypted data. Public key encryption with keyword search (PEKS) enables a data receiver to retrieve encrypted data containing some specific keyword in cloud-assisted WSN. However, the traditional PEKS schemes suffer from an inherent problem, namely, the keyword guessing attack (KGA). KGA includes off-line KGA and on-line KGA. To date, the existing literature on PEKS cannot simultaneously resist both off-line KGA and on-line KGA performed by an external adversary and an internal adversary. In this work, we propose a secure and efficient data sharing and searching scheme to address the aforementioned problem such that our scheme is secure against both off-line KGA and on-line KGA performed by external and internal adversaries. We would like to stress that our scheme simultaneously achieves document encryption/decryption and keyword search functions. We also prove our scheme achieves keyword security and document security. Furthermore, our scheme is more efficient than previous schemes by eliminating the pairing computation.

Unrestricted and compact certificateless aggregate signature scheme

A certificateless aggregate signature (CLAS) scheme employing a reduced signature size eliminates the complexity of certificate management in a traditional public key cryptosystem. A compact aggregate signature, where the size does not depend on the aggregate number, is desirable when the objective is to reduce storage cost and bandwidth. However, in conventional compact CLAS schemes, aggregation of signatures is restricted. The state information is meant to be used only once for security; it is generally used to restrict aggregation to signatures generated with the same state information. This paper proposes the first unrestricted and compact CLAS scheme where the signature size is constant and any combination of signatures can be aggregated. Aside from convenient storage and communication costs, our scheme is also equipped with a secure system against realistic adversaries. Moreover, we evaluate the performance of our CLAS scheme and demonstrate its effectiveness. Finally, this paper reveals that it is not possible to construct an unrestricted and compact CLAS scheme for a widely used structure with constant pairing computation.

Implementing Cryptographic Pairings on ARM dual-core Processors

In this paper, we explore the parallelization capabilities of the ARM processing system embedded in a Zynq device for a software implementation of the optimal Ate pairing. First, the use of the NEON coprocessor was evaluated. It was found that on ARM v7 Cortex-A9 processors the computation of the optimal Ate pairing based on NEON does not perform better than an optimized ARM-assembly equivalent implementation. Therefore, we moved to explore the parallelization of pairing computation using a dual-core processing approach. By organizing operations of line evaluation and point arithmetic formulas to have little data dependency, it was possible to schedule independent operations to be perfomed simultaneously in separate cores of an ARM dual-core Cortex-A9 processor. The same principle was applied in the arithmetic procedures of the extension fields. In this way, our software is able to perform 25.6% and 6.6% faster than the best two implementations previously reported on ARM Cortex-A9 processors.

An Efficient and Secure Pairing Free Short ID-Based Signature Scheme over Elliptic Curve

The cost of pairing computation is much more than the cost of computing scalar multiplication over elliptic curve group. Hence, the bilinear pairing based digital signature are less practical in the applications where short signature length as well as fast signature generation and verification are required. For such type of applications, we present a pairing computation free efficient and secure short identity (ID)-based signature scheme over elliptic curve. The proposed signature scheme is unforgeable in ROM against existential forgery on adaptive chosen message and ID attack with the assumption that ECDLP is hard in G. Moreover, the proposed signature scheme uses general cryptographic hash function in spite of costly map-to-point hash function and the comparative performance analysis shows that the proposed scheme is much more efficient, secure and short in signature length from related ID-based signature schemes

Faster fog-aided private set intersectionwith integrity preserving

Private set intersection (PSI) allows two parties to compute the intersection of their private sets while revealing nothing except the intersection. With the development of fog computing, the need has arisen to delegate PSI on outsourced datasets to the fog. However, the existing PSI schemes are based on either fully homomorphic encryption (FHE) or pairing computation. To the best of our knowledge, FHE and pairing operations consume a huge amount of computational resource. It is therefore an untenable scenario for resource-limited clients to carry out these operations. Furthermore, these PSI schemes cannot be applied to fog computing due to some inherent problems such as unacceptable latency and lack of mobility support. To resolve this problem, we first propose a novel primitive called “faster fog-aided private set intersection with integrity preserving”, where the fog conducts delegated intersection operations over encrypted data without the decryption capacity. One of our technical highlights is to reduce the computation cost greatly by eliminating the FHE and pairing computation. Then we present a concrete construction and prove its security required under some cryptographic assumptions. Finally, we make a detailed theoretical analysis and simulation, and compare the results with those of the state-of-the-art schemes in two respects: communication overhead and computation overhead. The theoretical analysis and simulation show that our scheme is more efficient and practical.

Public key encryption with conjunctive keyword search secure against keyword guessing attack from lattices

AbstractPublic key encryption With keyword search (PEKS) enables a cloud server (CS) to get the search trapdoor to identify ciphertext containing the target keyword without decrypting the ciphertext or knowing the target keyword. With the advent of mobile cloud computing, PEKS has ushered in an era of new development opportunities and new challenges. In mobile cloud computing environment, the PEKS schemes demand strict bounded timing response and security. However, traditional PEKS schemes rely on heavy bilinear pairing computations, which causes a delay from the CS to the mobile terminal. Moreover, as computing power increases, PEKS is more vulnerable to suffer from an inherent insecurity known as inside keyword guessing attack, which leaks user data query information. To achieve a secure and efficient searchable encryption scheme in the mobile cloud computing environment, we put forward a lattice‐based searchable encryption scheme that supports conjunctive keyword search. Our scheme achieves higher computational efficiency and is resistant against quantum attacks compared with traditional PEKS schemes. To further enhance security and make our scheme secure against keyword guessing attack, we hide the decryption parameters by outsourcing part of the decryption process to a semitrusted third party called unusual keyword server, so that the CS cannot guess the exact keyword by performing consistency verification.

Highly-parallel hardware implementation of optimal ate pairing over Barreto-Naehrig curves

Bilinear pairing over elliptic curves is the key technology to construct identity based encryption schemes. An appropriate hardware design can significantly speed up pairing computation. In this paper, we present a highly-parallel hardware design for optimal ate pairing over Barreto-Naehrig curves. The proposed design exploits parallelism at different levels of the pairing algorithm, including Fp and Fp2 operations as well as the operations based on Fp2. Especially the proposed architecture of dual Fp2 units at the top level makes the pairing computation more efficient. Finally, we implement a system on chip (SoC) that contains Microblaze CPU, AXI-Lite bus and the pairing computation unit. The design is verified on a Virtex-7 FPGA device with the parameters of pairing chosen according to the Identity-Based Cryptographic Algorithms SM9 enacted by China. The results show that our design computes the optimal ate pairing of 128-bit security within 394,806 cycles, which is about 3.4 ms under the working frequency of 115 MHz, and consumes about 28 k Slices and 128 DSPs.