Design Of Cryptographic Protocols Research Articles

Secure Key Exchange in Tropical Cryptography: Leveraging Efficiency with Advanced Block Matrix Protocols

In the quest for robust and efficient digital communication, this paper introduces cutting-edge key exchange protocols leveraging the computational prowess of tropical semirings and the structural resilience of block matrices. Moving away from the conventional use of finite fields, these protocols deliver markedly faster processing speeds and heightened security. We present two implementations of our concept, each utilizing a different platform for the set of commuting matrices: one employing tropical polynomials of matrices and the other employing Linde–de la Puente matrices. The inherent simplicity of tropical semirings leads to a decrease in operational complexity, while using block matrices enhances our protocols’ security profile. The security of these protocols relies on the Matrix Decomposition Problem. In addition, we provide a comparative analysis of our protocols against existing matrix block-based protocols in finite fields. This research marks a significant shift in cryptographic protocol design, is specifically tailored for demanding engineering applications, and sets a new standard in secure and efficient digital communication.

Cryptanalysis of a privacy-preserving authentication scheme based on private set intersection

Abstract Continuous and context-aware authentication mechanisms have been proposed as complementary security mechanisms to password-based authentication for computer devices that are handled directly by humans, such as smart phones. Such authentication mechanisms incur some privacy issues as user-dependent features are revealed to the authentication server, which is assumed to be untrusted. Domingo-Ferrer et al. proposed a privacy-preserving protocol for context-aware user authentication on the basis of private set intersection and Paillier homomorphic encryption. This approach enables user authentication based on establishing the number of similarities between sampled user context data and reference context data, without revealing any plaintext data to either party. The authors claim that their scheme is secure against malicious adversaries. In this article, we show that Domingo-Ferrer et al.’s scheme is insecure by means of two undetectable attacks that reveal all user information despite the encryption. The Paillier encryption primitive has a homomorphic property that we observe not only lacks relevance but, indeed, incurs a vulnerability that is exploited in the proposed cryptanalysis. This means that special care needs to be taken considering homomorphic properties of cryptographic primitives used in cryptographic protocols. Our cryptanalysis may therefore have a general interest regarding the design of cryptographic protocols.

Comments on ‘Chinese Remainder Theorem‐based centralised group key management for secure multicast communication’

AbstractTo ensure private message exchange among the group members, it is desirable to construct secure and efficient group key management schemes. Moreover, these schemes are more versatile if they could support dynamic join or leave of group members. In IET Information Security 2014, Vijayakumar et al. have introduced such a group key management scheme with lightweight overheads in both computation and communication. And this scheme has been used as a building block in many cryptographic protocols afterwards. In this paper, the authors demonstrate that Vijayakumar's scheme suffers some potential security weaknesses. First, after participating in the group communications for some sessions, a group member may still be able to obtain the group key after it leaves the group, and this violates the claimed security property of forward secrecy. Second, some colluding group members may derive another group member's long term secret key, and obviously, this has more serious consequences. One of the main reasons for the existence of these attacks is that the security analyses in Vijayakumar's scheme are informal and they cannot cover the dynamic environment. To address this issue, the authors’ suggestion is that heuristic arguments of security are not adequate in the design of cryptographic protocols, but formal security definitions and proofs are required.

Efficient Cryptographic Protocol Design for Secure Sharing of Personal Health Records in the Cloud

The sharing of Personal Health Records (PHR) in the cloud is the most promising platform to exchange health-related information. However, personal medical and health information storage is outsourced to third parties, potentially exposing patients' privacy to unauthorized individuals or groups. This paper intends to propose a new SSPHR (Secure Sharing PHR) method in the cloud. The proposed SSPHR method can preserve the privacy of PHRs and also ensures patient-centric control on PHRs. The encrypted PHRs are stored on the untrusted cloud servers and it grants selective access to different users on different PHRs portions. In addition, a semi-trusted proxy known as Setup and Re-encryption Server (SRS) is presented to arrange the public/private key pairs and to generate the re-encryption keys. This paper introduces a new Modified El-Gamal encryption for preserving health records and it includes key generation, encryption, and decryption process. Finally, the proposed model performance is compared and proven against other existing methods.

Equivocating Yao: Constant-Round Adaptively Secure Multiparty Computation in the Plain Model

Yao's circuit garbling scheme is one of the basic building blocks of cryptographic protocol design. Originally designed to enable two-message, two-party secure computation, the scheme has been extended in many ways and has innumerable applications. Still, a basic question has remained open throughout the years: Can the scheme be extended to guarantee security in the face of an adversary that corrupts both parties, adaptively, as the computation proceeds? We provide a positive answer to this question. We define a new type of encryption, called functionally equivocal encryption (FEE), and show that when Yao's scheme is implemented with an FEE as the underlying encryption mechanism, it becomes secure against such adaptive adversaries. We then show how to implement FEE from any one way function. Combining our scheme with non-committing encryption, we obtain the first two-message, two-party computation protocol, and the first constant-rounds multiparty computation protocol, in the plain model, that are secure against semi-honest adversaries who can adaptively corrupt all parties. A number of extensions and applications are described within.

MIP* = RE

Note from the Research Highlights Co-Chairs: A Research Highlights paper appearing in Communications is usually peer-reviewed prior to publication. The following paper is unusual in that it is still under review. However, the result has generated enormous excitement in the research community, and came strongly nominated by SIGACT, a nomination seconded by external reviewers. The complexity class NP characterizes the collection of computational problems that have efficiently verifiable solutions. With the goal of classifying computational problems that seem to lie beyond NP, starting in the 1980s complexity theorists have considered extensions of the notion of efficient verification that allow for the use of randomness (the class MA), interaction (the class IP), and the possibility to interact with multiple proofs, or provers (the class MIP). The study of these extensions led to the celebrated PCP theorem and its applications to hardness of approximation and the design of cryptographic protocols. In this work, we study a fourth modification to the notion of efficient verification that originates in the study of quantum entanglement. We prove the surprising result that every problem that is recursively enumerable, including the Halting problem, can be efficiently verified by a classical probabilistic polynomial-time verifier interacting with two all-powerful but noncommunicating provers sharing entanglement. The result resolves long-standing open problems in the foundations of quantum mechanics (Tsirelson's problem) and operator algebras (Connes' embedding problem).

Universally Composable Security

This work presents a general framework for describing cryptographic protocols and analyzing their security. The framework allows specifying the security requirements of practically any cryptographic task in a unified and systematic way. Furthermore, in this framework the security of protocols is preserved under a general composition operation, called universal composition. The proposed framework with its security-preserving composition operation allows for modular design and analysis of complex cryptographic protocols from simpler building blocks. Moreover, within this framework, protocols are guaranteed to maintain their security in any context, even in the presence of an unbounded number of arbitrary protocol sessions that run concurrently in an adversarially controlled manner. This is a useful guarantee, which allows arguing about the security of cryptographic protocols in complex and unpredictable environments such as modern communication networks.

The IITM Model: A Simple and Expressive Model for Universal Composability

The universal composability paradigm allows for the modular design and analysis of cryptographic protocols. It has been widely and successfully used in cryptography. However, devising a coherent yet simple and expressive model for universal composability is, as the history of such models shows, highly non-trivial. For example, several partly severe problems have been pointed out in the literature for the UC model. In this work, we propose a coherent model for universal composability, called the IITM model (“Inexhaustible Interactive Turing Machine”). A main feature of the model is that it is stated without a priori fixing irrelevant details, such as a specific way of addressing of machines by session and party identifiers, a specific modeling of corruption, or a specific protocol hierarchy. In addition, we employ a very general notion of runtime. All reasonable protocols and ideal functionalities should be expressible based on this notion in a direct and natural way, and without tweaks, such as (artificial) padding of messages or (artificially) adding extra messages. Not least because of these features, the model is simple and expressive. Also the general results that we prove, such as composition theorems, hold independently of how such details are fixed for concrete applications. Being inspired by other models for universal composability, in particular the UC model and because of the flexibility and expressivity of the IITM model, conceptually, results formulated in these models directly carry over to the IITM model.

A Universally Composable Key Exchange Protocol for Advanced Metering Infrastructure in the Energy Internet

The increasing adoption of multiway communications in the advanced metering infrastructure (AMI) of the energy Internet, which is known as the Internet-based smart grid, raises a new question about the security of customers' sensitive data and how the data can be protected from growing cyber attacks such as side-channel and false data injection attacks. The dynamic nature of remote connect/disconnect of components in the AMI also brings new types of security threats. To achieve secure multiway communications and remote connect/disconnect of components, the AMI requires a key exchange protocol (KEP) that meets a number of its security requirements such as confidentiality, integrity, availability, identification, authentication, and access control. In this context, in this article we present a KEP that uses an ideal crypto functionality and an ideal AMI key exchange functionality based on universal composability, which allows modular design and analysis of cryptographic protocols. The former functionality enables AMI components or users to perform authenticated cryptographic operations, while the later functionality enables the users to meet the AMI security requirements before generating a shared secret session key, which can be used in an ideal manner. We carry out experiments to validate the performance of our protocol, and the results show that our protocol offers better performance benefits compared to the existing related protocols and is suitable for the Energy Internet. We further demonstrate the usefulness of our ideal functionalities as a security reinforcement for a widely used KEP, namely the Elliptic Curve Diffie-Hellman.

Building Group Key Establishment on Group Theory: A Modular Approach

A group key establishment protocol is presented and proven secure in the common reference string mode. The protocol builds on a group-theoretic assumption, and a concrete example can be obtained with a decision Diffie–Hellman assumption. The protocol is derived from a two-party solution by means of a protocol compiler presented by Abdalla et al. at TCC 2007, evidencing the possibility of meaningfully integrating cryptographic and group-theoretic tools in cryptographic protocol design. This compiler uses a standard ring configuration, where all users behave symmetrically, exchanging keys with their left and right neighbor, which are later combined to yield a shared group key.

Integrating Classical Preprocessing into an Optical Encryption Scheme

Traditionally, cryptographic protocols rely on mathematical assumptions and results to establish security guarantees. Quantum cryptography has demonstrated how physical properties of a communication channel can be leveraged in the design of cryptographic protocols, too. Our starting point is the AlphaEta protocol, which was designed to exploit properties of coherent states of light to transmit data securely over an optical channel. AlphaEta aims to draw security from the uncertainty of any measurement of the transmitted coherent states due to intrinsic quantum noise. We present a technique to combine AlphaEta with classical preprocessing, taking into account error-correction for the optical channel. This enables us to establish strong provable security guarantees. In addition, the type of hybrid encryption we suggest, enables trade-offs between invoking a(n inexpensive) classical communication channel and a (more complex to implement) optical channel, without jeopardizing security. Our design can easily incorporate fast state-of-the-art authenticated encryption, but in this case the security analysis requires heuristic reasoning.

Quantum Random Oracle Model for Quantum Public-Key Encryption

Random oracle model is a general security analysis tool for rigorous security proof and effective cryptographic protocol design. In the quantum world, the attempts of constructing a quantum random oracle (QRO) have been made, such as quantum-accessible random oracle for post-quantum cryptography and quantum random oracle for quantum digital signature. As in the classical circumstance, it is crucial and challenging to design and instantiate the QRO model with an appropriate quantum hash function. In this work, we construct a QRO model for quantum public-key encryption against key-collision attack, due to the near-orthogonality property of the QRO. To explore a feasible instantiation procedure in the quantum setting, we distinctively give two instantiation examples of QRO by means of single-qubit rotation and quantum fingerprinting, and compare the numerical results of their performances under the key-collision attack. As a result, we extend the QRO model to the security analysis of quantum public-key encryption beyond quantum digital signature, and immunity from collision-type attacks.

A light-weight bit commitment protocol based on unpredictable channel noise

Bit commitment is an important tool in the design of many secure cryptographic protocols, such as coin flipping, zero-knowledge proof, and secure computation. In this paper, we present a computationally light-weight bit commitment protocol over a noisy channel. For the security of the proposed protocol, we show that the receiver has almost no information about the committer's secret due to unpredictability of the noises in the communication channel. Hence, the security of our bit commitment protocol does not depend on hard problems; it is information-theoretically secure. Furthermore, the protocol needs only exclusive-or operations. Thus, it is computationally light-weight, and it can be used in the devices whose computing resources are limited.

Probabilistic Properties of the Spatial Bloom Filters and Their Relevance to Cryptographic Protocols

The classical Bloom filter data structure is a crucial component of hundreds of cryptographic protocols. It has been used in privacy preservation and secure computation settings, often in conjunction with the (somewhat) homomorphic properties of ciphers such as Paillier's. In 2014, a new data structure extending and surpassing the capabilities of the classical Bloom filter has been proposed. The new primitive, called spatial Bloom filter (SBF) retains the hash-based membership-query design of the Bloom filter, but applies it to elements from multiple sets. Since its introduction, the SBF has been used in the design of cryptographic protocols for a number of domains, including location privacy and network security. However, due to the complex nature of this probabilistic data structure, its properties had not been fully understood. In this paper, we address this gap in knowledge and we fully explore the probabilistic properties of the SBF. In doing so, we define a number of metrics (such as emersion and safeness) useful in determining the parameters needed to achieve certain characteristics in a filter, including the false positive probability and inter-set error rate. This will in turn enable the design of more efficient cryptographic protocols based on the SBF, opening the way to their practical application in a number of security and privacy settings.

Pulse Propagation Models with Bands of Forbidden Frequencies or Forbidden Wavenumbers: A Consequence of Abandoning the Slowly Varying Envelope Approximation and Taking into Account Higher-Order Dispersion

We study linear and nonlinear pulse propagation models whose linear dispersion relations present bands of forbidden frequencies or forbidden wavenumbers. These bands are due to the interplay between higher-order dispersion and one of the terms (a second-order derivative with respect to the propagation direction) which appears when we abandon the slowly varying envelope approximation. We show that as a consequence of these forbidden bands, narrow pulses radiate in a novel and peculiar way. We also show that the nonlinear equations studied in this paper have exact soliton-like solutions of different forms, some of them being embedded solitons. The solutions obtained (of the linear as well as the nonlinear equations) are interesting since several arguments suggest that the Cauchy problems for these equations are ill-posed, and therefore the specification of the initial conditions is a delicate issue. It is also shown that some of these equations are related to elliptic curves, thus suggesting that these equations might be related to other fields where these curves appear, such as the theory of modular forms and Weierstrass ℘ functions, or the design of cryptographic protocols.

Computational Independence in the Design of Cryptographic Protocols

Computational Independence in the Design of Cryptographic Protocols

Identity-based deniable authenticated encryption and its application to e-mail system

An authenticated (AE) scheme simultaneously achieves two security goals: confidentiality and authenticity. AE can be divided into symmetric AE and asymmetrical (public key) AE. In a symmetric AE scheme, deniability is gained automatically. However, a public key AE scheme can not gain deniability automatically; on the contrary, it provides non-repudiation. In this paper, we address a question on deniability of public key AE. Of course, we can achieve this goal by authentication followed by encryption method. However, such method has the following two weaknesses: (1) the computational cost and communication overhead are the sum of two cryptographic primitives; (2) it is complex to design cryptographic protocols with deniable authentication and confidentiality using two cryptographic primitives. To overcome the two weaknesses, we propose a new concept called deniable authenticated (DAE) that can achieve both the functions of deniable authentication and public key simultaneously, at a cost significantly lower than that required by the authentication followed by encryption method. This single cryptographic primitive can simplify the design of cryptographic protocols with deniable authentication and confidentiality. In particular, we construct an identity-based deniable authenticated (IBDAE) scheme. Our construction uses tag-key encapsulation mechanism (KEM) and data encapsulation mechanism (DEM) hybrid techniques, which is more practical for true applications. We show how to construct an IBDAE scheme using an identity-based deniable authenticated tag-KEM (IBDATK) and a DEM. We also propose an IBDATK scheme and prove its security in the random oracle model. For typical security level, our scheme is at least 50.7 and 22.7 % faster than two straightforward authentication followed by encryption schemes, respectively. The communication overhead is respectively reduced at least 21.3 and 31.1 %. An application of IBDAE to an e-mail system is described.

Secure Comparison Protocols in the Semi-Honest Model

Due to high complexity, comparison protocols with secret inputs have been a bottleneck in the design of privacy-preserving cryptographic protocols. Different solutions based on homomorphic encryption, garbled circuits and secret sharing techniques have been proposed over the last few years, each claiming high efficiency. Unfortunately, a fair comparison of existing protocols in terms of run-time, bandwidth requirement and round complexity has been lacking so far. In this paper, we analyze the state-of-the-art comparison protocols for a two-party setting in the semi-honest security protocol. We analyze their performances in three stages, namely initialization, pre-processing and online computation, by implementing them on a single platform. The results of our experiments provide a clear insight for the research community into the advantages and disadvantages of the various techniques .

Performance evaluation of twisted Edwards‐form elliptic curve cryptography for wireless sensor nodes

AbstractWireless sensor networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic, and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8‐bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields as underlying algebraic structure and supports two different families of elliptic curves, namely, Weierstraß‐form and twisted Edwards‐form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.3·106 clock cycles for a full 160‐bit scalar multiplication on an 8‐bit ATmega128 microcontroller, which is more than three times faster than the widely used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 17.34mJ when using a twisted Edwards curve over a 160‐bit Optimal Prime Field. This result further demonstrates the advantage of special family of elliptic curves for resource‐constrained environments. Copyright © 2015 John Wiley & Sons, Ltd.

An efficient certificateless deniable authentication protocol without pairings

A deniable authentication protocol enables an intended receiver to identify the source of a given message, but the receiver cannot prove the source of a given message to any third party. It is very useful in some particular applications such as electronic voting, online negotiation and online shopping. However, many related protocols are lack of formal security proof which is very important for cryptographic protocol design. In this paper, we present a certificateless deniable authentication protocol. Our protocol is based on certificateless cryptography, which can solve the public key certificate management problem of public key infrastructure PKI-based cryptography and the key escrow problem of identity-based cryptography. Our protocol does not need the pairing operation which is the most time-consuming. In addition, our protocol can admit formal security proof in the random oracle model and resist key compromise impersonation KCI attack. Compared with the existing deniable authentication protocols, our protocol can be well applied in electronic voting system.