Key Wrapping Research Articles

QKPT: Securing Your Private Keys in Cloud With Performance, Scalability and Transparency

Private key (e.g., RSA key) protection is a significant issue for cloud but existing keyless or keyguard solutions suffer from performance, elasticity or applicability limitations. Recently, represented by Intel KPT, a novel keyguard architecture emerges to combine trusted platform module and crypto accelerator for achieving both security and performance. However, the straight use of KPT for private key protection may not be a good fit in cloud as it incurs challenges on protection capacity, key provisioning latency and transparency. Based on KPT-like hardware, we propose QKPT, a comprehensive key management system to bring your own private keys (BYOPK) into multi-tenant clouds. QKPT introduces a carefully-designed key wrapping layer to overcome these challenges. A small symmetric wrapping key (SWK) is generated for each tenant as the master key to resolve the former two challenges, while a special private key wrapping scheme is adopted to resolve the transparency limitation. Additionally, QKPT incorporates certificate trust to enhance the security of the SWK lifecycle and provides a hardened key server solution without expensive HSM. The evaluation shows that QKPT has a low runtime overhead ( <inline-formula><tex-math notation="LaTeX">$\leq$</tex-math></inline-formula> 1.2% for SSL/TLS handshakes) and still greatly outperforms the software baseline (3.5x-17x) owing to the crypto offloading.

Secured Electronic Voting System Using RSA Key Encapsulation Mechanism

A secured process whereas enumerating and casting of votes with the electronic aids with aim of improving the performance of electoral system is called E-voting (Electronic voting). Present e-voting mechanisms are faced with challenges such as confidentiality, integrity, verifiability, transparency, non-repudiation, and authenticity. In e-voting system, blockchain cryptography exists to protect voter’s records. Encryption as well as decryption prevents forgery and other electoral malpractices by confirming voter’s coherence and confidentiality. Rivest, Shamir, Adleman (RSA) is a crooked algorithm with trapdoor functionality which makes it difficult to factor a huge prime whole number as the product of multiplication into its component primes. RSA – Key Encapsulation Mechanism describes a hybrid encryption that makes use of unrelated keys for decryption and encryption along with a key derivation function. In this paper, a secured voting system using RSA Key Encapsulation Mechanism with two layers-Symmetric and Public key Layers was presented. RSA consist of three functions such as key generation, encryption, and decryption. In RSA-KEM, KDF3 built upon SHA-256, induction function is mainly for key generation. AES key wrap (Advanced-Encryption-Standard) provides key-wrapping functionality.

Deterministic Authenticated Encryption Scheme for Memory Constrained Devices

A technique of authenticated encryption for memory constrained devices called sp-AELM was proposed by Agrawal et al. at ACISP 2015. The sp-ALEM construction utilizes a sponge-based primitive to support online encryption and decryption functionalities. Online encryption in the construction is achieved in the standard manner by processing plaintext blocks as they arrive to produce ciphertext blocks. However, decryption is achieved by storing only one intermediate state and releasing it to the user upon correct verification. This intermediate state allows a legitimate user to generate the plaintext herself. However, the scheme is nonce-respecting, i.e., the scheme is insecure if the nonce is repeated. Implementation of a nonce is non-trivial in practice, and reuse of a nonce in an AE scheme is often devastating. In this paper, we propose a new AE scheme called dAELM, which stands for deterministic authenticated encryption (DAE) scheme for low memory devices. DAE is used in domains such as the key wrap, where the available message entropy omits the overhead of a nonce. For limiting memory usage, our idea is to use a session key to encrypt a message and share the session key with the user depending upon the verification of a tag. We provide the security proof of the proposed construction in the ideal cipher model.

Improving security of lightweith SHA-3 against preimage attacks

In this article we describe the SHA-3 algorithm and its internal permutation in which potential weaknesses are hidden. The hash algorithm can be used for different purposes, such as pseudo-random bit sequences generator, key wrapping or one pass authentication, especially in weak devices (WSN, IoT, etc.). Analysis of the function showed that successful preimage attacks are possible for low round hashes, protection from which only works with increasing the number of rounds inside the function. When the hash function is used for building lightweight applications, it is necessary to apply a small number of rounds, which requires additional security measures. This article proposes a variant improved hash function protecting against preimage attacks, which occur on SHA-3. We suggest using an additional external randomness sources obtained from a lightweight PRNG or from application of the source data permutation.

Secret Common Randomness From Routing Metadata in Ad Hoc Networks

Establishing secret common randomness between two or multiple devices in a network resides at the root of communication security. In its most frequent form of key establishment, the problem is traditionally decomposed into a randomness generation stage (randomness purity is subject to employing often costly true random number generators) and an information-exchange agreement stage, which relies either on public-key infrastructure or on symmetric encryption (key wrapping). In this paper, we propose a secret-common-randomness establishment algorithm for ad hoc networks, which works by harvesting randomness directly from the network routing metadata, thus achieving both pure randomness generation and (implicitly) secret-key agreement. Our algorithm relies on the route discovery phase of an ad hoc network employing the dynamic source routing protocol, is lightweight, and requires relatively little communication overhead. The algorithm is evaluated for various network parameters in an OPNET ad hoc network simulator. Our results show that, in just 10 min, thousands of secret random bits can be generated network-wide, between different pairs in a network of 50 users.

Cryptographic Key Protection in a Cryptoprocessor

Key management encompasses protocols related to generation, distribution, establishment and revocation of keys and subsequent protection of keys during storage and while in use. Hardware Security Module (HSM) is used for this purpose which adheres to standards such as FIPS 140-2 or IBM Common Criteria. Hardware tokens primarily serve to transport the keys to an unprotected environment. In this paper we introduce challenges to key management and propose approaches for key management in a cryptoprocessor. Advanced Encryption Standard Key Wrap algorithm which is one of the most widely used method for key protection in field programmable gate arrays (FPGAs) is also considered.

English

Mobile Ad Hoc Networks (MANETs) using anonymous routing protocols hidden node identity and external routes having anonymity protection. Anonymous routing protocols use either hop-by-by hop encryption or redundant traffic, which generates more cost or without providing full anonymity protection to the data source and destination. It has more cost and increase for naturally resource constraint problem in MANETs particularly in multimedia wireless applications. High anonymity protection at a lower cost, we propose an unsigned Location-based competent Routing protocol. It dynamically partitions the network field into different zones and randomly chooses nodes in various zones as intermediate relay nodes, it also non traceable. It's based on counter intersection and timing attacks. It performs better route anonymity. It has self configuring infrastructure less networks. In future, the Random forwarder node replication attack will be also eliminated. To consider this attack, set up server will assign the key for each random forwarder node is generated by using the polynomial bivariate key generation scheme. The key wrapping algorithm used to protect the key from the adversary. In this paper, one way hash chain algorithm is used for key wrapping.

Cryptographic Applications of the Duplex Construction

Assured security is the desirable feature of modern cryptography. Most of moderncryptography primitives have no provably secure constructions. Their safety is defined on the basis ofwell-known in the given time cryptanalytic attacks. The duplex construction equipped with one idealpermutation and appropriate security parameters is suitable for building provably secure cryptographicprimitives. The constructions can be used for unclassified information of different sensitivity levelsprotection. Some of them can secure classified information up to the TOP SECRET level. Theapplications based on the duplex construction can be used for key wrapping, authenticated encryptionand can work as a pseudo-random bit sequence generator. They are not covered by any knownintellectual property.

Cryptographic Applications of the Duplex Construction

Assured security is the desirable feature of modern cryptography. Most of moderncryptography primitives have no provably secure constructions. Their safety is defined on the basis ofwell-known in the given time cryptanalytic attacks. The duplex construction equipped with one idealpermutation and appropriate security parameters is suitable for building provably secure cryptographicprimitives. The constructions can be used for unclassified information of different sensitivity levelsprotection. Some of them can secure classified information up to the TOP SECRET level. Theapplications based on the duplex construction can be used for key wrapping, authenticated encryptionand can work as a pseudo-random bit sequence generator. They are not covered by any knownintellectual property.

Encrypting Keys Securely

Encryption keys are sometimes encrypted themselves; doing that properly requires special care. Although it might look like an oversight at first, the broadly accepted formal security definitions for cryptosystems don't allow encryption of key-dependent messages. Furthermore, key-management systems frequently use key encryption or wrapping, which might create dependencies among keys that lead to problems with simple access-control checks. Security professionals should be aware of this risk and take appropriate measures. Novel cryptosystems offer protection for key-dependent messages and should be considered for practical use. Through enhanced access control in key-management systems, you can prevent security-interface attacks.