Decisional Diffie Research Articles

Provably secure group key agreement protocol based on ECDH with integrated signature

This paper proposes a new two round authenticated contributory group key agreement (ACGKA) protocol based on elliptic curve Diffie–Hellman (ECDH) with integrated signature. In this technique, one node is picked up as the group controller, and this node runs an authenticated ECDH with the rest of the nodes to generate an authenticated shared key per each two-party. It then merges these keys in another round in such a way that every member obtains the identical authenticated group key. Further, ACGKA is extended to dynamic ACGKA protocol. The dynamic ACGKA, being elliptic curve decisional Diffie Hellman-based, is less expensive and well suited for resource constrained networks such as mobile ad-hoc networks, and wireless sensor network. Also, we demonstrate that all the protocols proposed in this paper are provably secure in the standard model under ECDDH assumption and moreover secure against most of the active and passive attacks. Finally, the proposed protocol is compared with other prevalent ECDH and Diffie Hellman based group key agreement protocols, and results are found to be satisfactory. Copyright © 2015 John Wiley & Sons, Ltd

Attribute-based versions of Schnorr and ElGamal

We design in this paper the first attribute-based cryptosystems that work in the classical discrete logarithm, pairing-free, setting. The attribute-based signature scheme can be seen as an extension of Schnorr signatures, with adaptive security relying on the discrete logarithm assumption, in the random oracle model. The attribute-based encryption schemes can be seen as extensions of ElGamal cryptosystem, with adaptive security relying on the decisional Diffie---Hellman assumption, in the standard model. The proposed schemes are secure only in a bounded model: the systems admit L secret keys, at most, for a bound L that must be fixed in the setup of the systems. The efficiency of the cryptosystems, later, depends on this bound L. Although this is an important drawback that can limit the applicability of the proposed schemes in some real-life applications, it turns out that the bounded security of our key-policy attribute-based encryption scheme (in particular, with $$L=1$$L=1) is enough to implement the generic transformation of Parno, Raykova and Vaikuntanathan at TCC'2012. As a direct result, we obtain a protocol for the verifiable delegation of computation of boolean functions, which does not employ pairings or lattices, and whose adaptive security relies on the decisional Diffie---Hellman assumption.

Fast Cut-and-Choose-Based Protocols for Malicious and Covert Adversaries

In the setting of secure two-party computation, two parties wish to securely compute a joint function of their private inputs, while revealing only the output. One of the primary techniques for achieving efficient secure two-party computation is that of Yao's garbled circuits (FOCS 1986). In the semi-honest model, where just one garbled circuit is constructed and evaluated, Yao's protocol has proven itself to be very efficient. However, a malicious adversary who constructs the garbled circuit may construct a garbling of a different circuit computing a different function, and this cannot be detected (due to the garbling). In order to solve this problem, many circuits are sent and some of them are opened to check that they are correct while the others are evaluated. This methodology, called cut-and-choose, introduces significant overhead, both in computation and in communication, and is mainly due to the number of circuits that must be used in order to prevent cheating. In this paper, we present a cut-and-choose protocol for secure computation based on garbled circuits, with security in the presence of malicious adversaries, that vastly improves on all previous protocols of this type. Concretely, for a cheating probability of at most $$2^{-40}$$2-40, the best previous works send between 125 and 128 circuits. In contrast, in our protocol 40 circuits alone suffice (with some additional overhead). Asymptotically, we achieve a cheating probability of $$2^{-s}$$2-s where $$s$$s is the number of garbled circuits, in contrast to the previous best of $$2^{-0.32s}$$2-0.32s. We achieve this by introducing a new cut-and-choose methodology with the property that in order to cheat, all of the evaluated circuits must be incorrect, and not just the majority as in previous works. The security of our protocol relies on the decisional Diffie---Hellman assumption.

Encoding Functions with Constant Online Rate, or How to Compress Garbled Circuit Keys

Randomized encodings of functions can be used to replace a “complex” function $f(x)$ by a “simpler” randomized mapping $\hat{f}(x;r)$ whose output distribution on an input $x$ encodes the value of $f(x)$ and hides any other information about $x$. One desirable feature of randomized encodings is low online complexity. That is, the goal is to obtain a randomized encoding $\hat{f}$ of $f$ in which most of the output can be precomputed and published before seeing the input $x$. When the input $x$ is available, it remains to publish only a short string $\hat{x}$, where the online complexity of computing $\hat{x}$ is independent of (and is typically much smaller than) the complexity of computing $f$. Yao's garbled circuit construction gives rise to such randomized encodings in which the online part $\hat{x}$ consists of $n$ encryption keys of length $\kappa$ each, where $n=|x|$ and $\kappa$ is a security parameter. Thus, the online rate $|\hat{x}|/|x|$ of this encoding is proportional to the security parameter $\kappa$. In this paper, we show that the online rate can be dramatically improved. Specifically, we show how to encode any polynomial-time computable function $f:\{0,1\}^n\to\{0,1\}^{m(n)}$ with online rate of $1+o(1)$ and with nearly linear online computation. More concretely, the online part $\hat{x}$ consists of an $n$-bit string and a single encryption key. These constructions can be based on the decisional Diffie--Hellman (DDH) assumption, the learning with errors (LWE) assumption, or the RSA assumption. We also present a variant of this result which applies to arithmetic formulas, where the encoding only makes use of arithmetic operations, as well as several negative results which complement our positive results. Our positive results can lead to efficiency improvements in most contexts where randomized encodings of functions are used. We demonstrate this by presenting several concrete applications. These include protocols for secure multiparty computation and for noninteractive verifiable computation in the preprocessing model which achieve, for the first time, an optimal online communication complexity, as well as noninteractive zero-knowledge proofs which simultaneously minimize the online communication and the prover's online computation.

Directly revocable key-policy attribute-based encryption with verifiable ciphertext delegation

Attribute-based encryption (ABE) enables an access control mechanism by specifying access control policies among decryption keys and ciphertexts. In this paper, we propose a novel ABE variant, dubbed directly revocable key-policyABEwith verifiable ciphertext delegation (drvuKPABE), which supports direct revocation and verifiable ciphertext delegation. The drvuKPABE offers the following features which are promising in the data sharing applications: (1) it allows the trusted authority to revoke users by solely updating the revocation list while mitigating the interaction with non-revoked users, which is unlikely to indirectly revokable ABE; (2) it allows the third party to update ciphertexts with public information so that those non-revoked users cannot decrypt them; and (3) it enables any auditor (authorized by data owners) to verify whether the untrusted third party updated ciphertexts correctly or not. We formalize the syntax and security properties for drvuKPABE, and propose the construction based on the multilinear maps. Our solution attains the security properties under the (d+3)-Multilinear Decisional Diffie–Hellman assumption in the random oracle model.

A practical strongly secure one‐round authenticated key exchange protocol without random oracles

AbstractMost recently, a variant of extended Canetti–Krawczyk model called as eCKw is introduced to provide stronger security than previous eCK models. Namely eCKw models formulate a stronger notion regarding weak perfect forward secrecy than other eCK models. In particular, any eCKw secure protocols can be generally transformed to achieve full provide perfect forward secrecy without requiring additional round. So far, there is no protocol which has been proven secure in the eCKw model without random oracles. In this paper, we study the open problem on constructing eCKw secure AKE protocol in the standard model. A new one‐round AKE protocol is introduced relying on standard cryptographic primitives and a variant of bilinear decisional Diffie–Hellman assumption. The main advantage of our proposal is its high efficiency in key exchange in contrast to the previous eCK secure protocols without random oracles and under post‐specified peer setting. Copyright © 2014 John Wiley & Sons, Ltd.

Practical key‐dependent message chosen‐ciphertext security based on decisional composite residuosity and quadratic residuosity assumptions

AbstractAn encryption scheme is key‐dependent message chosen plaintext attack (KDM‐CPA) secure if it is secure even against an attacker who has access to encryptions of messages that depend on the secret key. Such situations naturally occur in some scenarios such as formal calculus, hard‐disk encryption, or multi‐party protocols. However, up to now, there are not many schemes that achieve KDM‐CPA security, let alone KDM chosen ciphertext attack (KDM‐CCA) security. The constructions proposed by Camenisch, Chandran, and Shoup (Eurocrypt 2009), and Hofheinz (Eurocrypt 2013) are the only two general constructions that can be proved to be KDM‐CCA secure in the standard model. Besides, Qin, Liu, and Huang (ACISP 2013) also presented another concrete implementation. In particular, they showed how to obtain KDM‐CCA security from the classic Cramer–Shoup cryptosystem (based on the decisional Diffie–Hellman assumption) w.r.t. a new ensemble of functions (we call QLH ensemble). Since the Cramer–Shoup scheme has short ciphertext size and higher computational efficiency, they obtain practical KDM‐CCA security w.r.t. a reasonably large ensemble.In this paper, we study the KDM‐CCA security of other cryptosystems proposed by Cramer and Shoup (Eurocrypt 2002). In particular, we prove that the schemes, based on decisional composite residuosity (DCR) and quadratic residuosity (QR) assumptions, respectively, also achieve KDM‐CCA security w.r.t. the QLH ensemble. On the one hand, because the DCR‐based and QR‐based schemes of Cramer et al. are fairly practical, we also obtain practical KDM‐CCA security based on DCR and QR assumptions, respectively. On the other hand, compared with the result of Qin et al., we need not tailor the original schemes of Cramer et al. because themselves have natural “compatibility” for the message space and the secret key space. Copyright © 2014 John Wiley & Sons, Ltd.

An efficient strongly secure authenticated key exchange protocol without random oracles

AbstractSince the introduction of extended Canetti–Krawczyk (eCK) security model for two‐party key exchange, many protocols have been proposed to provide eCK security. However, most of those protocols are provably secure in the random oracle model or rely on special design technique, which is well known as the NAXOS trick. In contrast to previous schemes, we present an eCK secure protocol in the standard model, without NAXOS trick and without knowledge of secret key assumption for public key registration. The security proof of our scheme is based on standard pairing assumption, collision‐resistant hash functions, Bilinear Decision Diffie–Hellman and Decision Linear Diffie–Hellman assumptions, and pseudo‐random functions with pairwise independent random source. Although our proposed protocol is based on bilinear groups, it does not require any pairing operation during key exchange procedure. Copyright © 2014 John Wiley & Sons, Ltd.

Provably secure three-party key agreement protocol using Chebyshev chaotic maps in the standard model

Recently, several key agreement protocols based on Chebyshev chaotic maps have been proposed in the literature. However, they can normally achieve “heuristic” security, that is, once drawbacks are found in these protocols, they are either modified to resist the new attacks, or are discarded. Under these circumstances, it is necessary and significant to define standard security models that can precisely characterize the capabilities of the participants and a potent adversary. Hence, we propose to use public key encryption based on enhanced Chebyshev chaotic maps and pseudo-random function ensembles to construct an efficient three-party key agreement protocol under the standard model, in which the adversary is able to make a wider range of queries and have more freedom than the other proposed schemes. In the design of our protocol, we follow the ideas in the recent key agreement protocol of Yang and Cao’s. The proposed protocol is shown to be provably secure if decisional Diffie–Hellman problem, which is based on Chebyshev chaotic maps, is computationally infeasible. To the best of our knowledge, our protocol is the first provably secure 3PAKE protocol using Chebyshev chaotic maps under the standard model.

An efficient and provably secure three-party password-based authenticated key exchange protocol based on Chebyshev chaotic maps

Three-party password-based authenticated key exchange (3PAKE) protocols allow two clients to establish a secure session key through a server over an insecure channel. Recently, the 3PAKE protocols have been developed based on Chebyshev chaotic maps, in which the clients utilize smart cards to login into the server and employ server’s public key to ensure the identity of the server or symmetric cryptosystems to encrypt the messages. However, this paper describes an efficient chaos-based 3PAKE protocol without smart cards, which requires neither server’s public key nor symmetric cryptosystems. The security of the proposed 3PAKE protocol is proved in the random oracle model using the chaos-based decisional Diffie–Hellman assumption. In comparison with the existing chaos-based 3PAKE protocols, our protocol individually provides better performance in terms of communication, computation, and security aspects, and is supported by the formal proof in the random oracle model.

One‐move convertible nominative signature in the standard model

AbstractA nominative signature (NS) is a non‐self‐authenticating signature that is jointly generated by a signer (or a nominator) and a user (or a nominee), but once generated, its validity can only be determined by the user. No one else including the signer can tell the signature's validity unless the user confirms or disavows so, whereas the user cannot cheat either. One‐move NS is an efficient type of NS that requires the signer to send only one message to the user during the signature generation stage. Currently, there exists only one one‐move NS scheme that is proven secure in the standard model, and is convertible, that is, the user can transform a nominative signature to a publicly verifiable standard signature without the signer's aid. However, the number of elements in the keys of both signer and user grows linearly with the value of the security parameter. In this paper, we propose a new one‐move NS which is convertible, can be proven secure in the standard model, and also has a constant number of elements in the keys of both the signer and the user. We apply the Boneh–Boyen short standard signature in a novel way to build this nominative signature scheme. We show that this new scheme achieves the best performance among all the schemes proven secure in the standard model, and its security relies only on the standard q‐strong Diffie–Hellman and decisional Diffie–Hellman assumptions. Finally, we will present a generic construction by utilizing a secure standard signature scheme and a secure encryption scheme. Copyright © 2013 John Wiley & Sons, Ltd.

Constant-Size Dynamic $k$-Times Anonymous Authentication

Dynamic <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> -times anonymous authentication ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> -TAA) schemes allow members of a group to be authenticated anonymously by application providers for a bounded number of times, where application providers can independently and dynamically grant or revoke access right to members in their own group. In this paper, we construct a dynamic <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> -TAA scheme with space and time complexities of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i> (log( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> )) and a variant, in which the authentication protocol only requires constant time and space complexities at the cost of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i> ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> ) -sized public key. We also describe some tradeoff issues between different system characteristics. We detail all the zero-knowledge proof-of-knowledge protocols involved and show that our construction is secure in the random oracle model under the <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i> -strong Diffie-Hellman assumption and <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i> -decisional Diffie-Hellman inversion assumption. We provide a proof-of-concept implementation, experiment on its performance, and show that our scheme is practical.

Public‐key encryption scheme with selective opening chosen‐ciphertext security based on the Decisional Diffie–Hellman assumption

SUMMARYChosen‐ciphertext security has been well‐accepted as a standard security notion for public‐key encryption. But in a multi‐user surrounding, it may not be sufficient, because the adversary may corrupt some users to obtain the random coins as well as the plaintexts used to generate ciphertexts. The attack is named ‘selective opening attack’. We study how to achieve full‐fledged chosen‐ciphertext security in selective opening setting directly from the Decisional Diffie–Hellman assumption. Our construction is actually a tag‐based public‐key encryption scheme free of chameleon hashing and has a tight security reduction to the Decisional Diffie–Hellman assumption and the collision‐resistant assumption of hash functions. The tag for each ciphertext is generated in a flexible way to serve the chosen‐ciphertext security proof in selective opening settings. Copyright © 2013 John Wiley &amp; Sons, Ltd.

On Strong Simulation and Composable Point Obfuscation

The Virtual Black Box (VBB) property for program obfuscators provides a strong guarantee: anything computable by an efficient adversary, given the obfuscated program, can also be computed by an efficient simulator, with only oracle access to the program. However, we know how to achieve this notion only for very restricted classes of programs. This work studies a simple relaxation of VBB: allow the simulator unbounded computation time, while still allowing only polynomially many queries to the oracle. We demonstrate the viability of this relaxed notion, which we call Virtual Grey Box (VGB), in the context of composable obfuscators for point programs: it is known that, with respect to VBB, if such obfuscators exist, then there exist multi-bit point obfuscators (also known as “digital lockers”) and subsequently also very strong variants of encryption that are resilient to various attacks, such as key leakage and key-dependent-messages. However, no composable VBB-obfuscators for point programs have been shown. We show composable VGB-obfuscators for point programs under a strong variant of the Decision Diffie–Hellman assumption. We show that VGB (instead of VBB) obfuscation still suffices for the above applications, as well as for new applications. This includes extensions to the public key setting and to encryption schemes with resistance to certain related key attacks (RKA).

Better Security for Deterministic Public-Key Encryption: The Auxiliary-Input Setting

Deterministic public-key encryption, introduced by Bellare, Boldyreva, and O’Neill (CRYPTO ’07), provides an alternative to randomized public-key encryption in various scenarios where the latter exhibits inherent drawbacks. A deterministic encryption algorithm, however, cannot satisfy any meaningful notion of security when the plaintext is distributed over a small set. Bellare et al. addressed this difficulty by requiring semantic security to hold only when the plaintext has high min-entropy from the adversary’s point of view.In many applications, however, an adversary may obtain auxiliary information that is related to the plaintext. Specifically, when deterministic encryption is used as a building block of a larger system, it is rather likely that plaintexts do not have high min-entropy from the adversary’s point of view. In such cases, the framework of Bellare et al. might fall short from providing robust security guarantees.We formalize a framework for studying the security of deterministic public-key encryption schemes with respect to auxiliary inputs. Given the trivial requirement that the plaintext should not be efficiently recoverable from the auxiliary input, we focus on hard-to-invert auxiliary inputs. Within this framework, we propose two schemes: the first is based on the d-linear assumption for any d≥1 (including, in particular, the decisional Diffie–Hellman assumption), and the second is based on a rather general class of subgroup indistinguishability assumptions (including, in particular, the quadratic residuosity assumption and Paillier’s composite residuosity assumption). Our schemes are secure with respect to any auxiliary input that is subexponentially hard to invert (assuming the standard hardness of the underlying computational assumptions).In addition, our first scheme is secure even in the multi-user setting where related plaintexts may be encrypted under multiple public keys. Constructing a scheme that is secure in the multi-user setting (even without considering auxiliary inputs) was identified by Bellare et al. as an important open problem.

Simple Three-Party Password-Based Key Exchange Protocol with Provable Security

Three-party password-based authenticated key exchange (3PAKE) protocols allow two users (clients) to establish a session key with the help of an authenticated server over an insecure channel. Owning to the significance in building a secure communication channel, a number of approaches have been suggested over the years. However, the lack of formal security proof is a major issue in the related literature. In this paper, we propose a simple 3PAKE protocol based upon elliptic curve cryptography along with formal security proof under the decisional Diffie–Hellman assumption. Experimental results by using the automated validation of Internet security protocols and applications tool also show that the proposed protocol is secure against various malicious attacks. Compared with previous work, the proposed protocol has lower computation costs and lighter communication loads.

Public key exchange using matrices over group rings

We offer a public key exchange protocol in the spirit of Diffie–Hellman, but we use (small) matrices over a group ring of a (small) symmetric group as the platform. This “nested structure” of the platform makes computation very efficient for legitimate parties. We discuss security of this scheme by addressing the Decision Diffie–Hellman (DDH) and Computational Diffie–Hellman (CDH) problems for our platform.

기밀문서유통을 위한 Weil Pairing IBE 개선 연구

PKI에 기반을 둔 공개키 방식은 인증성과 비밀성에서 뛰어난 반면 적용된 시스템에서 인증서와 키 관리는 큰 부담이다. 또한 암복호 복잡도(complexity)가 크기 때문에 WSN(Wireless Sensor Network)의 제한된 컴퓨팅 장치에서는 사용하기가 어렵다. 이에 키관리 부담을 없앤 IBE(ID Based Encryption) 방식에서 Bilinear Pairing 방식은 수행속도가 뛰어나고 충분히 안전한 DDH(Decisional Diffie Hellman) 알고리즘으로 인/검증을 처리하는 차세대 암호방식이다. Bilinear Pairing의 이론을 구현한 Elliptic Curve Weil Pairing의 알고리즘은 단순하고 CCA(공격)에 IND/NM의 강력한 보안조건을 만족한다. 동작측면에서 Random Oracle Model을 가정한 IBE PKG는 단일 기밀문서 파일서버로 작동하는 우리의 목적 시스템의 구조에 적합하다. 따라서 본 논문는 Weil Pairing Based IBE 방식을 폐쇄적 기밀문서 유통망[2]에 적합하도록 암복호 및 인검증 알고리즘을 개선하고 본 유통망에 적용된 효율적 프로토콜을 제안한다. 본 논문은 먼저 암호화, 무결성 그리고 사용자 인증을 O(DES) 수준으로 수행하는 개선된 알고리즘을 제안하며 한 번의 암호화 처리에서 비밀성, 무결성과 인증성을 달성하는 정보를 암호문에 포함된다. 둘째 PKI 인증서의 효과를 가진 공개 식별자를 적용하여 키 노출의 위험을 줄인 개선된 IBE 방식을 제안한다. PKI-based public key scheme is outstanding in terms of authenticity and privacy. Nevertheless its application brings big burden due to the certificate/key management. It is difficult to apply it to limited computing devices in WSN because of its high encryption complexity. The Bilinear Pairing emerged from the original IBE to eliminate the certificate, is a future significant cryptosystem as based on the DDH(Decisional DH) algorithm which is significant in terms of computation and secure enough for authentication, as well as secure and faster. The practical EC Weil Pairing presents that its encryption algorithm is simple and it satisfies IND/NM security constraints against CCA. The Random Oracle Model based IBE PKG is appropriate to the structure of our target system with one secret file server in the operational perspective. Our work proposes modification of the Weil Pairing as proper to the closed network for secret file distribution[2]. First we proposed the improved one computing both encryption and message/user authentication as fast as O(DES) level, in which our scheme satisfies privacy, authenticity and integrity. Secondly as using the public key ID as effective as PKI, our improved IBE variant reduces the key exposure risk.

Public key encryption without random oracle made truly practical

In this paper, we report our success in identifying an efficient public key encryption scheme whose formal security proof does not require a random oracle. Specifically, we focus our attention on a universal hash based public key encryption scheme proposed by Zheng and Seberry at Crypto’92. Although Zheng and Seberry’s encryption scheme is very simple and efficient, its reductionist security proof has not been provided. We show how to tweak the Zheng–Seberry scheme so that the resultant scheme not only preserves the efficiency of the original scheme but also admits provable security against adaptive chosen ciphertext attack without random oracle. For the security proof, our first attempt is based on a strong assumption called the oracle Diffie–Hellman+ assumption. This is followed by a more challenging proof that employs a weaker assumption called the adaptive decisional Diffie–Hellman assumption, which is in alignment with adaptively secure assumptions advocated by Pandey, Pass and Vaikuntanathan.

Cryptanalysis on an Improved Version of ElGamal-Like Public-Key Encryption Scheme for Encrypting Large Messages

Hwang et al. proposed an ElGamal-like scheme for encrypting large messages, which is more efficient than its predecessor in terms of computational complexity and the amount of data transformation. They declared that the resulting scheme is semantically secure against chosen-plaintext attacks under the assumptions that the decision Diffie–Hellman problem is intractable. Later, Wang et al. pointed out that the security level of Hwang et al.'s ElGamal-like scheme is not equivalent to the original ElGamal scheme and brings about the disadvantage of possible unsuccessful decryption. At the same time, they proposed an improvement on Hwang et al.'s ElGamal-like scheme to repair the weakness and reduce the probability of unsuccessful decryption. However, in this paper, we show that their improved scheme is still insecure against chosen-plaintext attacks whether the system is operated in the quadratic residue modulus or not. Furthermore, we propose a new ElGamal-like scheme to withstand the adaptive chosen-ciphertext attacks. The security of the proposed scheme is based solely on the decision Diffie–Hellman problem in the random oracle model.