Key-insulated Signature Scheme Research Articles

An Efficient and Provably Secure SM2 Key-Insulated Signature Scheme for Industrial Internet of Things

An Efficient and Provably Secure SM2 Key-Insulated Signature Scheme for Industrial Internet of Things

Pairing-based strong key-insulated signature scheme

Pairing-based strong key-insulated signature scheme

Pairing-based strong key-insulated signature scheme

Pairing-based strong key-insulated signature scheme

Efficient and secure pairing-free certificateless strong key-insulated signature scheme

Efficient and secure pairing-free certificateless strong key-insulated signature scheme

Efficient and Provably Secure Certificateless Parallel Key-Insulated Signature Without Pairing for IIoT Environments

With the continuous development of the industrial Internet of Things (IIoT), many organizations opt for storing the data collected by smart devices on a cloud server for saving costs. Considering the untrusted nature of the communication channel, how to ensure the authenticity of data is an urgent matter to be solved. Certificateless signatures that can provide an authentication mechanism for the data seem to be a viable option to this problem. Nevertheless, the certificateless signature scheme proposed so far is either easy to be broken or inefficient. In this paper, a pairing-free and provably secure certificateless parallel key-insulated signature (CL-PKIS) scheme is put forward for securing the communication in the IIoT environment. Unlike previous work in this field, our scheme not only uses elliptic curves to maintain higher efficiency, but also implants key-insulated primitive to reduce the risk of key exposures. Besides, our scheme provides a parallel mechanism to make it more suitable for the IIoT environment, which was not available in previous solutions. Finally, the security of our CL-PKIS scheme is proved under the discrete logarithm assumption in the random oracle model.

Efficient and Secure Identity-based Strong Key-Insulated Signature Scheme without Pairings

Public Key Cryptosystem (PKC) completely relies under the assumption that user’s private key is absolutely secure. Exposure of private key may lead to disastrous situations in the communication network. To diminish the damage of private key exposure in PKC, key-insulation mechanism was introduced. In key-insulated cryptosystems, a user can update his private key with the help of a physically secure device from time to time. Identity-based cryptosystem alleviates the heavy certificate management problems in traditional PKC. Recently, many Identity-based key insulated signature schemes have been proposed in literature; however, most of the Identity-based schemes are designed based on the expensive bilinear pairing operation over elliptic curves. Due to the heavy computational cost of a pairing, the pairing based schemes are less efficient in practice. In order to improve the computational and communicational efficiency and to resist the problem of private key exposure in Identity-based signature schemes, we present a pairing-free key insulated signature scheme in identity based setting. We show that this scheme is unforgeable and achieves strong key insulation property with secure key updates, under the hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP). The performance analysis shows that our scheme is more efficient than the existing schemes.

Signature‐policy attribute‐based key‐insulated signature

Attribute-based signature (ABS) schemes play a vital role to accomplish authentication and signer privacy simultaneously. In recent years, cryptographic primitives are deployed on insecure devices such as mobile devices; thereby, secret key exposure seems inevitable. To alleviate the impact of key exposure in ABS scenarios, the authors apply the method of key insulation to ABS and construct the first signature-policy attribute-based key-insulated signature (ABKIS) scheme. The proposed construction supports expressive monotone Boolean functions as signing predicates and preserves signer privacy. Their ABKIS scheme is key-insulated and strong key-insulated secure under computational Diffie–Hellman exponent assumption. To the best of their knowledge, the proposed ABKIS is the first ABS scheme in signature-policy flavour dealing with key exposure problems employing key-insulation mechanism.

Efficient ID-Based Key-Insulated Signature Scheme with Batch Verifications using Bilinear Pairings over Elliptic Curves

Exposure of private keys in cryptographic schemes leads to breakage of security of the scheme as a whole. To avoid the damage caused by key exposure problem, in this paper, we propose an efficient ID-Based Key-insulated Signature (IBKIS) scheme with batch verifications using bilinear pairings over elliptic curves. This scheme updates the signer's private keys from time to time. The proposed scheme is secure in the random oracle model with the assumption that the CDH problem is intractable. We compare the proposed scheme with related schemes.

Attribute-based key-insulated signature for boolean formula

In order to minimize the impact of secret signing key exposure in attribute-based signature scenario, we construct an attribute-based key-insulated signature (ABKIS) scheme for expressive monotone boolean function access structures utilizing only four pairing operations in verification process and making the signature length constant, that is, the number of pairings required for signature verification and the size of signature are independent of the size of attribute set participated in the respective process. The (strong) key-insulated selective security of our ABKIS scheme is reduced to the computational Diffie–Hellman Exponent problem without using any random oracles. The proposed construction attains signer privacy, which is a fundamental requirement of the signature schemes in the attribute-based setting.

A Pairing-free Key-insulated Certificate-based Signature Scheme with Provable Security

Certificate-based signature (CBS) combines the advantages of both public key-based signature and identity-based signature, while saving from the disadvantages of drawbacks in both PKS and IBS. The insecure deployment of CBS under the hostile circumstances usually causes the exposure of signing key to be inescapable. To resist the threat of key leakage, we present a pairing-free key insulated CBS scheme by incorporating the idea of key insulated mechanism and CBS. Our scheme eliminates the costly pairing operations and as a matter of fact outperforms the existing key insulated CBS schemes. It is more suitable for low-power devices. Furthermore, the unforgeability of our scheme has been formally proven to rest on the discrete logarithm assumption in the random oracle model.

An improved certificateless strong key-insulated signature scheme in the standard model

Exposure of secret keys may be the most devastating attack on a public key cryptographic scheme since such that security is entirely lost. The key-insulated security provides a promising approach to deal with this threat since it can effectively mitigate the damage caused by the secret key exposure. To eliminate the cumbersome certificate management in traditional PKI-supported key-insulated signature while overcoming the key escrow problem in identity-based key-insulated signature, two certificateless key-insulated signature schemes without random oracles have been proposed so far. However, both of them suffer from some security drawbacks and do not achieve existential unforgeability. In this paper, we propose a new certificateless strong key-insulated signature scheme that is proven secure in the standard model. Compared with the previous certificateless strong proxy signature scheme, the proposed scheme offers stronger security and enjoys higher computational efficiency and shorter public parameters.

Compact Leakage-Free ID-Based Signature Scheme with Applications to Secret Handshakes

As an important approach to resist the threat of key leakage, key insulated security allows secret keys to be periodically updated by using a physically-secure but computation-limited device. Recently, key insulated mechanism has been introduced into identity based (ID-based) signature to solve the key-leakage problem in ID-based signature scenarios. In this paper, we present two compact ID-based key-insulated signature schemes that try to minimize the total amount of message and signature. Compared with the up-to-date ID-based key-insulated signatures, our schemes enjoy the minimum net bandwidth and computation overhead. We also provide formal security proofs of our schemes under the Computational Diffie---Hellman assumption in the random oracle model. We focus on potential applications of our schemes to secret handshakes, but we believe they will find many other applications as well.

Parallel key-insulated signature scheme without random oracles

To alleviate the damage caused by key exposures, Dodis et al. introduced the notion of key-insulated security where secret keys are periodically updated by using a physically insulated helper key. To decrease the risk of helper key exposures, Hanaoka et al. advocated parallel key-insulated mechanism where distinct helpers are independently used in key updates. In this paper, we propose the first parallel key-insulated signature scheme which is provably secure without resorting to the random oracle methodology. Our scheme not only allows frequent key updating, but also does not increase the risk of helper key exposures.

An efficient threshold key-insulated signature scheme

To tackle the key-exposure problem in signature settings, this paper introduces a new cryptographic primitive named threshold key-insulated signature (TKIS) and proposes a concrete TKIS scheme. For a TKIS system, at least k out of n helpers are needed to update a user’s temporary private key. On the one hand, even if up to k−1 helpers are compromised in addition to the exposure of any of temporary private keys, security of the non-exposed periods is still assured. On the other hand, even if all the n helpers are compromised, we can still ensure the security of all periods as long as none of temporary private keys is exposed. Compared with traditional key-insulated signature (KIS) schemes, the proposed TKIS scheme not only greatly enhances the security of the system, but also provides flexibility and efficiency.

Identity-based key-insulated proxy signature without random oracles

In an identity based proxy signature (IBPS) scheme, a designated proxy signer can generate the signature on behalf of an original signer. Traditional IBPS schemes normally rely on the assumption that private keys are kept perfectly secure. However, due to viruses, worms or other break-ins allowed by operating-system holes, key exposure seems inevitable. To minimize the damage caused by key exposure in IBPS, we propose an identity-based key-insulated proxy signature (IBKIPS) scheme in the standard model, i.e. without random oracles.

Certificateless strong key-insulated signature without random oracles

It is important to ensure the private key secure in cryptosystem. To reduce the underlying danger caused by the private key leakage, Dodis et al. (2003) introduced the notion of key-insulated security. To handle the private key leakage problems in certificateless signature schemes, we propose a new certificateless strong key-insulated signature scheme. Our scheme has two desirable properties. First, its security can be proved without utilizing the random oracle model. Second, it solves the key escrow problems in identity-based key-insulated signatures (IBKISs).

Generic Construction of Identity-Based Strong Key-Insulated Signature

It is worthwhile to deal with the key-exposure problem for identity-based signature. Identity-based key-insulated signature can successfully reduce the damage caused by key-exposure, and thus attracts the researchers' great interest. In this paper, we study the problem of how to generically construct identity-based strong key-insulated signature, and proposed a generic construction of identity-based strong key-insulated signature schemes from two-level hierarchical identity-based signature.

Strong key-insulated signature in the standard model

The only known construction of key-insulated signature (KIS) that can be proven secure in the standard model is based on the approach of using double signing. That is, the scheme requires two signatures: a signature with a master key and a signature with the signer’s secret key. This folklore construction method leads to an inefficient scheme. Therefore it is desirable to devise an efficient KIS scheme. We present the first scheme with such a construction. Our construction derives from some variations of the Waters’ signature scheme. It is computationally efficient and the signatures are short. The scheme is provably secure based on the difficulty of computational Diffie-Hellman (CDH) problem in the standard model.

An Efficient Anonymous Authentication Protocol for Secure Vehicular Communications

As vehicular communications bring the promise of improved road safety and optimized road traffic through cooperative systems applications, it becomes a prerequisite to make vehicular communications secure for the successful deployment of vehicular ad hoc networks. In this paper, we propose an efficient authentication protocol with anonymous public key certificates for secure vehicular communications. The proposed protocol follows a system model to issue on-the-fly anonymous public key certificates to vehicles by road-side units. In order to design an efficient authentication protocol, we consider a key-insulated signature scheme for certifying anonymous public keys of vehicles to the system model. We demonstrate experimental results to confirm that the proposed protocol has better performance than other protocols based on group signature schemes.

Efficient Provider Authentication for Bidirectional Broadcasting Service

Provider authentication is necessary in bidirectional broadcasting services, and a digital signature scheme is often used to prevent an adversary from attempting impersonation. The cost of secure signing key management is extremely high. In addition, the key has to be updated very often, since it is frequently used. The result is that the verification key also has to be updated very often, and its redistribution cost is huge. These costs are real and substantive problems, especially when the number of users is large. In this paper, we propose a system that dramatically reduces these costs. In the system, the signing key is updated, but the corresponding verification key does not have to be updated. This means that the signing key can be updated without any cost for redistributing the verification key and that the system is secure against the threat of signing key leakage, since the key can be frequently updated. Moreover, we propose a new key management method that divides a conventional key management server's role into two. The use of a key-insulated signature (KIS) scheme enables low-cost and more secure key management with two servers. Finally, to make a bidirectional broadcasting service more secure even if the signing key is leaked, we developed a new strong KIS scheme. We performed an experiment that assessed the cost of our strong KIS scheme and found that it is sufficiently low. Accordingly, a provider authentication system employing this scheme would be more efficient and would have lower key redistribution and network costs in comparison with conventional authentication systems.