Pairing-based Cryptosystems Research Articles

Trilinear pairing-based cryptosystem authentication: for electronic health record security in healthcare system

Trilinear pairing-based cryptosystem authentication: for electronic health record security in healthcare system

Trilinear Pairing-Based Cryptosystem Authentication: For Electronic Health Record Security in Healthcare System

Trilinear Pairing-Based Cryptosystem Authentication: For Electronic Health Record Security in Healthcare System

Achieving fuzzy matching data sharing for secure cloud-edge communication

In this paper, we propose a novel fuzzy matching data sharing scheme named FADS for cloud-edge communications. FADS allows users to specify their access policies, and enables receivers to obtain the data transmitted by the senders if and only if the two sides meet their defined certain policies simultaneously. Specifically, we first formalize the definition and security models of fuzzy matching data sharing in cloud-edge environments. Then, we construct a concrete instantiation by pairing-based cryptosystem and the privacy-preserving set intersection on attribute sets from both sides to construct a concurrent matching over the policies. If the matching succeeds, the data can be decrypted. Otherwise, nothing will be revealed. In addition, FADS allows users to dynamically specify the policy for each time, which is an urgent demand in practice. A thorough security analysis demonstrates that FADS is of provable security under indistinguishable chosen ciphertext attack (IND-CCA) in random oracle model against probabilistic polynomial-time (PPT) adversary, and the desirable security properties of privacy and authenticity are achieved. Extensive experiments provide evidence that FADS is with acceptable efficiency.

Refined analysis to the extended tower number field sieve

The hardness of discrete logarithm problem over finite fields is the security foundation of many cryptographic protocols. When the characteristic of the finite field is medium or large, the state-of-art algorithms for solving the corresponding problem are the number field sieve and its variants. In 2016, Kim and Barbulescu presented the extended tower number field sieve, which achieves a new complexity in the medium prime case and imposes a new estimation of the security of concrete parameters in certain cryptosystems such as pairing-based cryptosystems. In this paper, a refined analysis to this algorithm is given as follows.–Firstly, a uniform formula is given for the total complexity of the extended tower number field sieve. For a given polynomial selection method, this formula can directly give the complexity in this case.–Then, a method is proposed to improve the computation in the smoothing phase by exploring subfield structures when the extension degree is composite.–At last, the complexity of the descent phase is analyzed when sieving over degree-one polynomials and high-degree polynomials respectively and it is shown still negligible compared to the improved smoothing phase.

Converting pairing-based cryptosystems from composite to prime order setting – A comparative analysis

Abstract Composite order pairing setting has been used to achieve cryptographic functionalities beyond what is attainable in prime order groups. However, such pairings are known to be significantly slower than their prime order counterparts. Thus emerged a new line of research – developing frameworks to convert cryptosystems from composite to prime order pairing setting. In this work, we analyse the intricacies of efficient prime order instantiation of cryptosystems that can be converted using existing frameworks. To compare the relative efficacy of these frameworks we mainly focus on some representative schemes: the Boneh–Goh–Nissim (BGN) homomorphic encryption scheme, ring and group signatures as well as a blind signature scheme. Our concrete analyses lead to several interesting observations. We show that even after a considerable amount of research, the projecting framework implicit in the very first work of Groth–Sahai still remains the best choice for instantiating the BGN cryptosystem. Protocols like the ring signature and group signature which use both projecting and cancelling setting in composite order can be most efficiently instantiated in the Freeman prime-order projecting only setting. In contrast, while the Freeman projecting setting is sufficient for the security reduction of the blind signature scheme, the simultaneous projecting and cancelling setting does provide some efficiency advantage.

An Improved Signed Digit Representation of Integers

This research modifies the GNAF (Generalized NAF), which is one of the signed-digit representations that have been used to speed up point multiplication in pairing-based cryptosystems. The hamming weight of MGNAF (Modified Generalized Non-Adjacent Form), which is proposed in this paper, is less than GNAF for radixes higher than 2 (in cost of a bigger digit set). Moreover, in radix 2 the hamming weight of MGNAF is as low as GNAF and the well-known NAF (Non-Adjacent Form) with the same digit set. Keywords: Cryptography, Digit Set, Generalized NAF, Hamming Weight, Non-Adjacent Form, Radix-r Representation

Low‐latency digit‐serial dual basis multiplier for lightweight cryptosystems

Various cryptosystems, such as elliptic curve and pairing-based cryptosystems, in resource-constrained security applications rely on finite field multiplication. For applications such as these, a digit-serial multiplier has the potential features to achieve a trade-off between space and time complexities. The authors propose an efficient decomposition of the multiplication into four independent sub-multiplication units to facilitate parallel processing, which is additionally facilitated by the systolic structures of the sub-multiplication units. The proposed architecture uses a four-bit scheme to construct a novel processing element, instead of using only one bit as is currently used in similar multipliers. The results of the synthesis show that the proposed digit-serial dual basis multiplier eliminates up to 96% of the critical path delay.

Improvement of FPPR method to solve ECDLP

Solving the elliptic curve discrete logarithm problem (ECDLP) by using Grobner basis has recently appeared as a new threat to the security of elliptic curve cryptography and pairing-based cryptosystems. At Eurocrypt 2012, Faugere, Perret, Petit and Renault proposed a new method (FPPR method) using a multivariable polynomial system to solve ECDLP over finite fields of characteristic 2. At Asiacrypt 2012, Petit and Quisquater showed that this method may beat generic algorithms for extension degrees larger than about 2000. In this paper, we propose a variant of FPPR method that practically reduces the computation time and memory required. Our variant is based on the idea of symmetrization. This idea already provided practical improvements in several previous works for composite-degree extension fields, but its application to prime-degree extension fields has been more challenging. To exploit symmetries in an efficient way in that case, we specialize the definition of factor basis used in FPPR method to replace the original polynomial system by a new and simpler one. We provide theoretical and experimental evidence that our method is faster and requires less memory than FPPR method when the extension degree is large enough.

Low-complexity digit-serial systolic Gaussian normal basis multiplier for curve-based cryptosystems

Finite field multiplication over GF(2m) is one of the most important arithmetic operations for curve-based cryptosystems, such as elliptic curve cryptosystems and pairing-based cryptosystems. Gaussian normal basis (GNB) multiplier is very suitable for realizing finite field multiplication in curve-based cryptosystems because GNB multiplier is highly efficient in performing square operations of multiplicative inversion, squaring, and exponentiation operations. Therefore, this study will present a digit-serial GNB multiplier with unidirectional systolic array which is suitable for fault-tolerant design and very large scale integrated circuits implementation. The proposed digit-serial GNB multiplier can save about 22% space complexity and requires almost the same time complexity when compared with the existing similar multipliers.

Improved Miller’s Algorithm for Computing Pairings on Edwards Curves

Since Edwards curves were introduced to elliptic curve cryptography by Bernstein and Lange in 2007, they have received a lot of attention due to their very fast group law operation. Pairing computation on such curves is slightly slower than on Weierstrass curves. However, in some pairing-based cryptosystems, they might require a number of scalar multiplications which is time-consuming operation and this can be advantageous to use Edwards in this scenario. In this paper, we present a variant of Miller’s algorithm for pairing computation on Edwards curves. Our approach is generic, it is able to compute both Weil and Tate pairings on pairing-friendly Edwards curves of any embedding degree. Our analysis shows that the new algorithm is faster than the previous algorithms for odd embedding degree and as fast as for even embedding degree. Hence, the new algorithm is suitable for computing optimal pairings and in situations where the denominators elimination technique is not possible.

Key Length Estimation of Pairing-Based Cryptosystems Using <i>η<sub>T</sub></i> Pairing over <i>GF</i>(3<i><sup>n</sup></i>)

The security of pairing-based cryptosystems is determined by the difficulty of solving the discrete logarithm problem (DLP) over certain types of finite fields. One of the most efficient algorithms for computing a pairing is the ηT pairing over supersingular curves on finite fields of characteristic 3. Indeed many high-speed implementations of this pairing have been reported, and it is an attractive candidate for practical deployment of pairing-based cryptosystems. Since the embedding degree of the ηT pairing is 6, we deal with the difficulty of solving a DLP over the finite field GF(36n), where the function field sieve (FFS) is known as the asymptotically fastest algorithm of solving it. Moreover, several efficient algorithms are employed for implementation of the FFS, such as the large prime variation. In this paper, we estimate the time complexity of solving the DLP for the extension degrees n=97, 163, 193, 239, 313, 353, and 509, when we use the improved FFS. To accomplish our aim, we present several new computable estimation formulas to compute the explicit number of special polynomials used in the improved FFS. Our estimation contributes to the evaluation for the key length of pairing-based cryptosystems using the ηT pairing.

“Security-Aware and Data Intensive Low-Cost Mobile Systems” Editorial

We are witnessing a paradigm shift in the way mobile devices are being used and operated. What was once a voice network is now predominantly a data network. As a consequence, end-users are now using mobile systems for applications that fall under the data intensive paradigm, such as Skyline queries, streaming information relays, and crowd sourced disaster management. However, this paradigm shift has opened new research directions, such as: (a) Security, as the system now has numerous distributed entry points and the behavior of a malicious entity does not really correlate with any previously known phenomenon (e.g., Internet virus attacks, DOS attacks, etc.). (b) Data interoperability that must cater to the fundamental issue that mobile devices are required to work seamlessly with Internet data, thus requiring revision of protocols, data exchange frameworks to improve data sharing among mobile devices and with the Internet. (c) Sustainable software development that entails the development of software models for mobile devices that have a longer life-cycle and require fewer updates. This also effectively translates into an economically viable mobile system. Privacy and security aspects need to be covered at all layers of mobile networks, from mobile users’ devices, to privacy-respecting credentials and mobile identity management. All of the above mentioned research domains are complex on their own, which makes it a very attractive research area for academia and industry. The eventual goal is to make the mobile systems seamless integrate with Inter and Intranet devices without a measurable performance degradation. Is is arguably required to investigate novel methods and techniques to enable secure access to data, network nodes and services, flexible communication, efficient scheduling, self-adaptation, decentralization, and self-organization. This special issue herewith presents six research papers with novel concepts in the analysis, implementation, and evaluation of the next generation of intelligent scalable techniques for data intensive processing and security related problems in modern mobile environments. The first three papers span the fields of key management, power modeling and mobility modeling, but all share a relevance to security aspects. Cryptographic and key management systems in mobile networks must be computationally low-cost because of the limitations of computational and data storage capacities and battery life of most of the network nodes. Wu and Lin present non-interactive authenticated key agreement (NIAKA) protocols based on the idea of bilinear pairingbased cryptosystem model and Elliptic Curve Encryption (ECE) scheme. The ECE allows the encryption of message multiple times with different keys that can be decrypted in J. Kolodziej (*) Institute of Computer Science, Cracow University of Technology, Warszawska 24, 31-155 Cracow, Poland e-mail: jokolodziej@pk.edu.pl

Server-aided signatures verification secure against collusion attack

Wireless handheld devices are increasingly popular. The authenticity of the information or a program to be downloaded is important, especially for business uses. In server-aided verification (SAV), a substantial part of the verification computation can be offloaded to an untrusted server. This allows resource-constrained devices to enjoy the security guarantees provided by cryptographic schemes, such as pairing-based signatures, which may be too heavyweight to verify otherwise.To gain unfair advantage, an adversary may bribe (or collude with) the server either to convince that an invalid signature is a valid one or to claim that a valid signature is invalid (say for providing repudiable information/commitment, or spoiling an opponent's offer). However, these concerns are not properly captured by existing models.In this paper, we infer the meaning behind and point out the subtleties in existing models; and propose a new model to capture the collusion attack. We also show that two existing schemes are insecure in their own model. Finally, we provide a generic pairing-based SAV protocol. Compared with the protocol of Girault–Lefranc in Asiacrypt '05, ours provides a higher level of security yet applicable to a much wider class of pairing-based cryptosystems. In particular, it suggests SAV protocols for short signatures in the standard model and aggregate signatures which have not been studied before.

Linear threshold verifiable secret sharing in bilinear groups

In many pairing-based cryptosystems, the secret keys are elements of bilinear groups. For safeguarding such secret keys or decrypting or signing in a threshold manner, Verifiable Secret Sharing VSS in bilinear groups is required. In this paper, we show a method of verifiably sharing a random secret in a bilinear group. Our method is simple and practical. It can be regarded as a generalisation of threshold linear VSS in finite fields to the case when the secrets are in bilinear groups. We present a general scheme for verifiably sharing secrets in bilinear groups. A modified version of our general scheme with improved efficiency is also introduced.

Refinements of Miller's Algorithm over Weierstrass Curves Revisited

In 1986, Victor Miller described an algorithm for computing the Weil pairing in his unpublished manuscript. This algorithm has then become the core of all pairing-based cryptosystems. Many improvements of the algorithm have been presented. Most of them involve a choice of elliptic curves of a special form to exploit a possible twist during Tate pairing computation. Other improvements involve a reduction of the number of iterations in the Miller's algorithm. For the generic case, Blake, Murty and Xu proposed three refinements to Miller's algorithm over Weierstrass curves. Though their refinements, which only reduce the total number of vertical lines in Miller's algorithm, did not give an efficient computation as other optimizations, they can be applied for computing both Weil and Tate pairings on all pairing-friendly elliptic curves. In this paper, we extend the Blake–Murty–Xu's method and show how to perform an elimination of all vertical lines in Miller's algorithm during computation of Weil/Tate pairings, on general elliptic curves. Experimental results show that our algorithm is faster by ~25% in comparison with the original Miller's algorithm.

Faster MapToPoint on Supersingular Elliptic Curves in Characteristic 3

Pairing-based cryptosystems are generally constructed using many functions such as pairing computation, arithmetic in finite fields, and arithmetic on elliptic curves. MapToPoint, which is a hashing algorithm onto an elliptic curve point, is one of the functions for constructing pairing-based cryptosystems. There are two MapToPoint algorithms on supersingular elliptic curves in characteristic three, which is used by ηT pairing. The first is computed by using a square root computation in F3m, and the computational cost of this algorithm is O(log m) multiplications in F3m. The second is computed by using an (m-1)×(m-1) matrix over F3. It can be computed by O(1) multiplications in F3m. However, this algorithm needs the off-line memory to store about m F3m-elements. In this paper, we propose an efficient MapToPoint algorithm on the supersingular elliptic curves in characteristic three by using 1/3-trace over F3m. We propose 1/3-trace over F3m, which can compute solution x of x3-x=c by using no multiplication in F3m. The proposed algorithm is computed by O(1) multiplications in F3m, and it requires less than m F3-elements to be stored in the off-line memory to efficiently compute trace over F3m. Moreover, in our software implementation of F3509, the proposed MapToPoint algorithm is approximately 35% faster than the conventional MapToPoint algorithm using the square root computation on an AMD Opteron processor (2.2GHz).

New Concrete Relation between Trace, Definition Field, and Embedding Degree

A pairing over an elliptic curve E/Fpm to an extension field of Fpmk has begun to be attractive in cryptosystems, from the practical and theoretical point of view. From the practical point of view, many cryptosystems using a pairing, called the pairing-based cryptosystems, have been proposed and, thus, a pairing is a necessary tool for cryptosystems. From the theoretical point of view, the so-called embedding degree k is an indicator of a relationship between the elliptic curve Discrete Logarithm Problem (ECDLP) and the Discrete Logarithm Problem (DLP), where ECDLP over E(Fpm) is reduced to DLP over Fpmk by using the pairing. An elliptic curve is determined by mathematical parameters such as the j-invariant or order of an elliptic curve, however, explicit conditions between these mathematical parameters and an embedding degree have been described only in a few degrees. In this paper, we focus on the theoretical view of a pairing and investigate a new condition of the existence of elliptic curves with pre-determined embedding degrees. We also present some examples of elliptic curves over 160-bit, 192-bit and 224-bit Fpm with embedding degrees k < (log p)2 such as k = 10,12,14,20,22,24,28.

Constructing Elliptic Curve Including Subgroup with Low Hamming Order

In practical applications of pairing-based cryptosystems, the efficiency of pairing computation is a crucial factor. Recently, there have been many improvements for the computation of Tate pairing, which focuses on the arithmetical operations under given elliptic curve. Based to the characteristics that Miller’s algorithm will be improved tremendous if there are subgroups with order of low hamming prime above the elliptic curve, an algorithm of generating primes of low hamming with weight 3 is given in this paper. Then, we present an effective generation method of elliptic curve, which enable it feasible that there is certain some subgroup of low hamming prime order. The improvement of paring computation is marked above the elliptic curve generating by our method.

A new bit-serial multiplier over GF(pm) using irreducible trinomials

Pairing-based schemes, such as identity-based cryptosystem, are widely used for future computing environments. Hence the work of hardware architectures for G F ( p m ) has been brought to public attention for the past few years since most of the pairing-based schemes are implemented using arithmetic operations over G F ( p m ) defined by irreducible trinomials. This paper proposes a new most significant elements (MSE)-first serial multiplier for G F ( p m ) , where p > 2 , which is more efficient than least significant elements (LSE)-first multipliers from the point of view of both the time delay and the size of registers. In particular, the proposed multiplier has an advantage when the extension degree of finite fields m is large and the characteristic of finite fields p is small like G F ( 3 m ) , G F ( 5 m ) , and G F ( 7 m ) used in pairing-based cryptosystems.

Adaptively Secure Threshold Signature Scheme in the Standard Model

We propose a distributed key generation protocol for pairing-based cryptosystems which is adaptively secure in the erasure-free and secure channel model, and at the same time completely avoids the use of interactive zero-knowledge proofs. Utilizing it as the threshold key generation protocol, we present a secure (t,n) threshold signature scheme based on the Waters' signature scheme. We prove that our scheme is unforgeable and robust against any adaptive adversary who can choose players for corruption at any time during the run of the protocols and make adaptive chosen-message attacks. And the security proof of ours is in the standard model (without random oracles). In addition our scheme achieves optimal resilience, that is, the adversary can corrupt any t<n/2 players.