Public Key Cryptographic Techniques Research Articles

Compact and Low-Latency FPGA-Based Number Theoretic Transform Architecture for CRYSTALS Kyber Postquantum Cryptography Scheme

In the modern era of the Internet of Things (IoT), especially with the rapid development of quantum computers, the implementation of postquantum cryptography algorithms in numerous terminals allows them to defend against potential future quantum attack threats. Lattice-based cryptography can withstand quantum computing attacks, making it a viable substitute for the currently prevalent classical public-key cryptography technique. However, the algorithm’s significant time complexity places a substantial computational burden on the already resource-limited chip in the IoT terminal. In lattice-based cryptography algorithms, the polynomial multiplication on the finite field is well known as the most time-consuming process. Therefore, investigations into efficient methods for calculating polynomial multiplication are essential for adopting these quantum-resistant lattice-based algorithms on a low-profile IoT terminal. Number theoretic transform (NTT), a variant of fast Fourier transform (FFT), is a technique widely employed to accelerate polynomial multiplication on the finite field to achieve a subquadratic time complexity. This study presents an efficient FPGA-based implementation of number theoretic transform for the CRYSTAL Kyber, a lattice-based public-key cryptography algorithm. Our hybrid design, which supports both forward and inverse NTT, is able run at high frequencies up to 417 MHz on a low-profile Artix7-XC7A100T and achieve a low latency of 1.10μs while achieving state-of-the-art hardware efficiency, consuming only 541-LUTs, 680 FFs, and four 18 Kb BRAMs. This is made possible thanks to the newly proposed multilevel pipeline butterfly unit architecture in combination with employing an effective coefficient accessing pattern.

Polynomial equation in algebraic attack on NTRU-HPS and NTRU-HRSS

NTRU is a lattice-based public-key cryptosystem designed by Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman in 1996. NTRU published on Algorithmic Number Theory Symposium (ANTS) in 1998. The ANTS’98 NTRU became the IEEE standard for public key cryptographic techniques based on hard problems over lattices in 2008. NTRU was later redeveloped by NTRU Inc. since 2018 and became one of the finalists in round 3 of the PQC (Post-Quantum Cryptography) standardization process organized by NIST in 2020. There are two types of NTRU algorithms proposed by NTRU Inc., which are classified based on parameter determination, NTRU-HPS (Hoffstein, Pipher, Silverman) and NTRU-HRSS (Hulsing, Rijnveld, Schanck, Schwabe). Algebraic attacks on ANTS’98 NTRU had previously been carried out in 2009 and 2012. In this paper, algebraic attack is performed on the renewed NTRU submitted to the third round of NIST PQC standardization in 2020. This study aims to obtain system of polynomial equations representing plaintext bits of NTRU-HPS and NTRU-HRSS which can be used to find the private key in the next study. As a result, some polynomial equations with unknown variables were obtained.

ALGEBRAIC CRYPTANALYSIS ON NTRU-HPS AND NTRU-HRSS

NTRU is a lattice-based public-key cryptosystem designed by Hoffstein, Pipher, and Silverman in 1996. NTRU published on Algorithmic Number Theory Symposium (ANTS) in 1998. The ANTS’98 NTRU became the IEEE standard for public key cryptographic techniques based on hard problems over lattices in 2008. NTRU was later redeveloped by NTRU Inc. in 2018 and became one of the finalists in round 3 of the PQC (Post-Quantum Cryptography) standardization process organized by NIST in 2020. There are two types of NTRU algorithms proposed by NTRU Inc., which are classified based on parameter determination, NTRU-HPS (Hoffstein, Pipher, Silverman) and NTRU-HRSS (Hulsing, Rijnveld, Schanck, Schwabe). Algebraic cryptanalysis on ANTS’98 NTRU had previously been carried out in 2009 and 2012. In this paper, algebraic cryptanalysis is performed on NTRU-HPS with q=2048, n=509 (ntruhps2048509) and NTRU-HRSS with n=701 (ntruhrss701). This research aims to evaluate the resistance of NTRU-HPS and NTRU-HRSS algorithms against algebraic cryptanalysis by reconstructing the private key value. As a result, NTRU-HPS and NTRU-HRSS resistance to algebraic cryptanalysis.

A Novel and Secure Fake-Modulus Based Rabin-Ӡ Cryptosystem

Electronic commerce (E-commerce) transactions require secure communication to protect sensitive information such as credit card numbers, personal identification, and financial data from unauthorized access and fraud. Encryption using public key cryptography is essential to ensure secure electronic commerce transactions. RSA and Rabin cryptosystem algorithms are widely used public key cryptography techniques, and their security is based on the assumption that it is computationally infeasible to factorize the product of two large prime numbers into its constituent primes. However, existing variants of RSA and Rabin cryptosystems suffer from issues like high computational complexity, low speed, and vulnerability to factorization attacks. To overcome the issue, this article proposes a new method that introduces the concept of fake-modulus during encryption. The proposed method aims to increase the security of the Rabin cryptosystem by introducing a fake-modulus during encryption, which is used to confuse attackers who attempt to factorize the public key. The fake-modulus is added to the original modulus during encryption, and the attacker is unable to distinguish between the two. As a result, the attacker is unable to factorize the public key and cannot access the sensitive information transmitted during electronic commerce transactions. The proposed method’s performance is evaluated using qualitative and quantitative measures. Qualitative measures such as visual analysis and histogram analysis are used to evaluate the proposed system’s quality. To quantify the performance of the proposed method, the entropy of a number of occurrences for the pixels of cipher text and differential analysis of plaintext and cipher text is used. When the proposed method’s complexity is compared to a recent variant of the Rabin cryptosystem, it can be seen that it is more complex to break the proposed method—represented as O(ɲ× τ) which is higher than Rabin-P (O(ɲ)) algorithms.

Data transmission using secure hybrid techniques for smart energy metering devices

Data transfer between components, continuous device monitoring, and other features are possible with an IoT-based energy management system. Due to its lightweight, compact, and expandable characteristics, the Message Queuing Telemetry Transport protocol (MQTT) has recently played an important role in IoT. Since the MQTT protocol cannot provide security between the publishing house and the subscription service, cryptographic techniques can be enforced. This work implements a public-key encryption system-based Elliptic Curve Cryptography (ECC) technique to secure data from Publisher's end to the Subscriber's end. The data from the Raspberry plane is sent to the MQTT publisher with elliptical curve encryption built-in feature. The message/text is converted into cipher text and conveyed through the topic within the MQTT protocol to the subscribed Broker. The subscriber decrypts the cipher text using the elliptical curve cryptography technique with the secret key. This protects data, personal privacy, and safety in a more efficient and convenient way. ECC and MQTT protocols implemented in this work proved to be worthy for both burst mode and continuous data transmissions when compared to the conventional cryptographic techniques.

Performance Comparison between RSA and El-Gamal Algorithms for Speech Data Encryption and Decryption

This article presents a performance comparison of two known public key cryptography techniques namely RSA (Rivest–Shamir–Adleman) and El-Gamal algorithms to encrypt/decrypt the speech signals during transferring over open networks. Specifically, this work is divided into two stages. The first stage is enciphering-deciphering the input speech file by employing the RSA method. The second stage is enciphering-deciphering the same input speech file by employing the El-Gamal method. Then, a comparative analysis is performed to test the performance of both cryptosystems using diverse experimental and statistical analyses for the ciphering and deciphering procedures like some known speech quality measures: histogram, spectrogram, correlation, differential, speed performance and noise effect analyses. The analyses outcomes reveal that the RSA and El-Gamal approaches are efficient and adequate for providing high degree of security, confidentiality and reliability. Additionally, the outcomes indicate that the RSA speech cryptosystem outperforms its counterpart the El-Gamal speech cryptosystem in most of ciphering/deciphering speech performance metrics.

A Comprehensive Survey on Certificate-Less Authentication Schemes for Vehicular Ad hoc Networks in Intelligent Transportation Systems.

Data transmission in intelligent transportation systems is being challenged by a variety of factors, such as open wireless communication channels, that pose problems related to security, anonymity, and privacy. To achieve secure data transmission, several authentication schemes are proposed by various researchers. The most predominant schemes are based on identity-based and public-key cryptography techniques. Due to limitations such as key escrow in identity-based cryptography and certificate management in public-key cryptography, certificate-less authentication schemes arrived to counter these challenges. This paper presents a comprehensive survey on the classification of various types of certificate-less authentication schemes and their features. The schemes are classified based on their type of authentication, the techniques used, the attacks they address, and their security requirements. This survey highlights the performance comparison of various authentication schemes and presents the gaps in them, thereby providing insights for the realization of intelligent transportation systems.

A SURVEY ON EFFICIENT AUDITING SCHEME FOR SECURE DATA STORAGE IN FOG-TO-CLOUD COMPUTING

With the rise of the Internet of Things, fog-to-cloud computing has emerged as a new cutting-edge approach (IoT). Except for the cloud service provider, fog-to-cloud computing necessitates the participation of additional entities, such as mobile sinks and fog nodes (CSP). As a result, fog-to-cloud storage integrity audits will differ from standard cloud storage auditing. Tian et al. has completed the first stage in developing a public auditing system for fog-to-cloud computing. However, because they employ complex public key cryptography techniques like bilinear mapping and proof of knowledge, their system becomes inefficient. We offer a more broad and efficient auditing system based on MAC and HMAC, two prominent private key cryptography algorithms in this study. By implementing MAC and HMAC, we give a real instantiation of our auditing system. Finally, theoretical analysis and actual findings show that our suggested system has lower communication and computing costs.

Secure and Compact Elliptic Curve Scalar Multiplication with Optimized Inversion

Abstract Elliptic curve cryptography (ECC) is a typical public key cryptography technique that can ensure equivalent security with considerably smaller key sizes than Rivest-Shamir-Adleman (RSA). Hence, various implementations based on ECC are recommended for block chain and Internet of Things (IoT) devices. Because elliptic curve scalar multiplication (ECSM) is a fundamental computation in ECC, enhancing the security and efficiency of ECSM is important. ECSM specifies a scalar multiplication algorithm and elliptic curve addition formulae. Elliptic curve addition formulae on affine coordinates are compact from a memory cost perspective but weak against side channel attacks. Elliptic curve complete addition (CA) formulae can achieve secure ECSMs but are inefficient. A newly proposed secure ECSM, which uses a right-to-left (RL) scalar multiplication algorithm and (extended) affine coordinates, takes advantage of elliptic curve addition formulae on affine coordinates. However, it can only scan the input scalars from right to left. We propose new ECSMs, which can scan the input scalars from left to right (LR) based on (extended) affine coordinates. We also prove that our LR ECSMs satisfy secure generality without requiring exceptional computations. We enhance the efficiency of both LR and RL ECSMs with optimized inversion. Our LR ECSM with a memory of 12 field elements reduces that of the Montgomery ladder and Joye’s LR with CA formulae by 36.84% and that of 2-ary RL with (extended) affine coordinates by 14.29%, respectively. Our compact ECSMs are fit for applications on IoT devices and block chain, with a critical memory requirement.

Comparison between RSA and CAST-128 with Adaptive Key for Video Frames Encryption with Highest Average Entropy

Encryption of data is translating data to another shape or symbol which enables people only with an access to the secret key or a password that can read it. The data which are encrypted are generally referred to as cipher text, while data which are unencrypted are known plain text. Entropy can be used as a measure which gives the number of bits that are needed for coding the data of an image. As the values of pixel within an image are dispensed through further gray-levels, the entropy increases. The aim of this research is to compare between CAST-128 with proposed adaptive key and RSA encryption methods for video frames to determine the more accurate method with highest entropy. The first method is achieved by applying the "CAST-128" and the second is achieved by applying the "RSA ". CAST-128 utilizes a pair of sub-keys for each round as a quantum of five bits that was utilized as a key of rotation for each round and a quantum of 32 (bits) was utilized as a key of masking into a round . The proposed adaptive 128-bits key can be extracted from the main diagonal of each frame before encryption. RSA is a public-key cryptographic technique which can be known as (asymmetric) cryptography. An asymmetry of a key depends on factoring a product of two big prime values. A comparison was applied on several videos and the results showed that CAST-128 method proved the highest degree of entropy even if the frames have lots of distorted data or unclear image pixels. For example, the entropy value of a sample of a girl video is 2581.921 when using CAST-128, while it is 2271.329 when using the RSA; also the entropy value of a sample of a scooter video is 2569.814 when using the CAST-128, while it is 2282.844 when using RSA.

An Outsourced Decryption ABE Model using ECC in Internet of Things

Internet of Things (IoT) is a modern technology that is applicable almost everywhere nowadays. Everything is connected to the Internet in the modern digital era. IoT is a collection of things that are interconnected to share information. Devices connected to IoT networks have some limitations in performing heavy computational tasks because of the availability of less computational and battery power. Attribute Based Encryption (ABE) is a modern public-key cryptographic technique that provides privacy with access control. The bilinear map is an expensive operation that is used in most of the ABE schemes. Elliptic Curve Cryptography (ECC) is an alternative for bilinear pairing to reduce the computation of encryption and decryption in ABE schemes. The process of encryption and decryption of ABE is a heavy computational task for resource-constrained devices. In this paper, an outsourcing-based decryption of ABE using ECC is proposed to reduce the decryption overhead of devices that have limited computational resources. Our scheme divides the computation of the decryption of ABE into two stages: first, the partial decryption of ciphertext in the cloud server, and second, the final decryption of partially decrypted ciphertext by the data user to retrieve the original message. This scheme is secure against the malicious cloud server by adding a blinding factor into the secret to be shared. The blinding factor is shared with intended users through attribute authority. The experimental results demonstrate that our scheme can reduce the decryption complexity and save the computational time of devices, compared to the existing schemes. Thus the proposed scheme is applicable for lightweight devices used in IoT.

A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications

With the expansion of smartphone and financial technologies (FinTech), mobile money emerged to improve financial inclusion in many developing nations. The majority of the mobile money schemes used in these nations implement two-factor authentication (2FA) as the only means of verifying mobile money users. These 2FA schemes are vulnerable to numerous security attacks because they only use a personal identification number (PIN) and subscriber identity module (SIM). This study aims to develop a secure and efficient multi-factor authentication algorithm for mobile money applications. It uses a novel approach combining PIN, a one-time password (OTP), and a biometric fingerprint to enforce extra security during mobile money authentication. It also uses a biometric fingerprint and quick response (QR) code to confirm mobile money withdrawal. The security of the PIN and OTP is enforced by using secure hashing algorithm-256 (SHA-256), a biometric fingerprint by Fast IDentity Online (FIDO) that uses a standard public key cryptography technique (RSA), and Fernet encryption to secure a QR code and the records in the databases. The evolutionary prototyping model was adopted when developing the native mobile money application prototypes to prove that the algorithm is feasible and provides a higher degree of security. The developed applications were tested, and a detailed security analysis was conducted. The results show that the proposed algorithm is secure, efficient, and highly effective against the various threat models. It also offers secure and efficient authentication and ensures data confidentiality, integrity, non-repudiation, user anonymity, and privacy. The performance analysis indicates that it achieves better overall performance compared with the existing mobile money systems.

A novel blockchain-based privacy-preserving framework for online social networks

ABSTRACT Online social networks (OSNs) are nowadays an important field of applications thanks to the recent surge in online interaction. However, the illegal disclosure of user's private data can cause damaging consequences and even threaten the safety of users' life. The privacy issues of OSNs have become a matter of great concern for many people. In recent years, there are some research works to address this privacy issue, yet they do not always focus on providing the normal social network services for users, such as data sharing, data retrieval and data access services. Therefore, it is a challenge to ensure the security of sensitive data while providing efficient and privacy-preserving social network services for users. In this paper, we propose a novel blockchain-based privacy-preserving framework for online social networks, called BPP. Combined blockchain and public-key cryptography technique, the BPP framework can achieve secure data sharing, data retrieving, and data accessing with fairness and without worrying about potential damage to users' interest. Specifically, based on blockchain and public key encryption with keyword search technique, a secure, fair and efficient keyword search algorithm is proposed, with which the BBP framework realises privacy preservation of user's query and then obtain accurate query results with assurance and without needing for any further verification operation in online social network. Finally, we implement a prototype of our framework and deploy it to a locally simulated network. The extensive experiments and security analysis demonstrate the security, efficacy and efficiency of our proposed framework.

A new provable hierarchical anonymous certificateless authentication protocol with aggregate verification in ADS-B systems

Automatic Dependent Surveillance-Broadcast (ADS-B) technology is a new solution for communication among aircraft and ground controller stations. In this new surveillance technology, critical messages (e.g., the location of aircraft) are achieved by navigation satellites, and then an on-board equipment multicasts the unencrypted messages twice per second to the others. The former ADS-B protocols suffer from weak authentication protocols with a few security vulnerabilities and privacy issues including key-escrow problem, user profiling, time consuming verification processes, and difficulties with certificate management. In this paper, we propose a new hierarchical authentication protocol used Certificateless Public Key Cryptography (CL-PKC) technique to avoid using Public Key Infrastructure (PKI) certificate management and solve the key-escrow concern in Identity-based Public Key Cryptography (ID-PKC). Further, unlike many of certificateless schemes, our proposed scheme is secure against malicious-but-passive Key Generation Center (KGC). We prove that our scheme preserves conditional privacy, which means that distinct identities map to varied pseudonyms. The security and privacy features of our scheme are provably modeled under the widely-accepted random oracle model by computational Diffie-Hellman (CDH) assumption against adaptive chosen-message attack. Finally, we show that the time needed to aggregate verification of 50 messages reduced by 84% and 48% compared to those of Yang et al.’s and He et al.’s schemes respectively.

FPGA Design of Elliptic Curve Cryptosystem (ECC) for Isomorphic Transformation and EC ElGamal Encryption

Attacking or tampering with sensitive data continues to increase risks to economic processes or human activities. These risks are significant key factors to improve the development and implementation of security systems. Therefore, improving cryptography is essentially needed to enhance the security of critical data. For example, elliptic curve cryptography (ECC) over the Galois field GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">163</sup> ) is one of the public-key (asymmetric) cryptographic techniques, in which demands mapping a message (163-bit) to a point in the prime subgroup of the elliptic curve. To the best of our knowledge, mapping methods are not yet available on Field-Programmable Gate Arrays (FPGAs). Also, asymmetric encryption schemes often do not consider encrypting/decrypting data packets because of their computation complexity and performance limitations. In this letter, we propose and develop a concurrent reconfigurable cryptosystem to encrypt and decrypt stream of data using ECC on FPGA. First, we present hardware design and implementation to map a plain message on the elliptic curve based on isomorphic transformation, then second, we architect the elliptic curve ElGamal public-key encryption method by using point addition and multiplication on Koblitz elliptic curve on FPGA. Our proposed cryptosystem is synthesized and implemented on Intel Cyclone 10 GX and Xilinx Kintex-7 FPGAs to evaluate throughput, and it achieves 25.73-57.1 Mbps.

Efficient Auditing Scheme for Secure Data Storage in Fog-to-Cloud Computing

Fog-to-cloud computing has now become a new cutting-edge technique along with the rapid popularity of Internet of Things (IoT). Unlike traditional cloud computing, fog-to-cloud computing needs more entities to participate in, including mobile sinks and fog nodes except for cloud service provider (CSP). Hence, the integrity auditing in fog-to-cloud storage will also be different from that of traditional cloud storage. In the recent work of Tian et al., they took the first step to design public auditing system for fog-to-cloud computing. However, their scheme becomes very inefficient since they uses intricate public key cryptographic techniques, including bilinear mapping, proof of knowledge etc. In this paper, we design a general and more efficient auditing system based on MAC and HMAC, both of which are popular private key cryptographic techniques. By implementing MAC and HMAC, we give a concrete instantiation of our auditing system. Finally, the theoretical analysis and experiment results show that our proposed system has more efficiency in terms of communication and computational costs.

An Efficient Privacy-Preserving Multi-Keyword Query Scheme in Location Based Services

With the proliferation of location-aware mobile devices and the prevalence of wireless communications, location-based services (LBS) have attracted much particular attention in recent years. For flexibility and cost savings, the LBS provider outsources the LBS data to the cloud in order to serve the increasing number of mobile users. To guarantee users’ privacy and data confidentiality, some excellent works have been proposed which focus on secure query over the location server. However, these existing works have two limitations. On the one hand, they cannot preserve users’ location and query content privacy simultaneously. On the other hand, they fail to support multi-keyword queries. In this article, aiming at a multi-keywords query in LBS, we propose a novel efficient and privacy-preserving multi-keyword query scheme (PPMQ) over the outsourced cloud, which satisfies the requirements of the location and query content privacy protection, query efficiency, the confidentiality of LBS data and scalability regarding the data users. To improve the efficiency of our proposed scheme, we utilize the linear quad-tree technique to build a grid system to represent the location information in the query condition as well as a searchable index. To protect the location privacy, we combine decimal Morton code and public-key cryptography techniques to build a searchable index or to generate a trapdoor. To enable the cloud server to perform a secure multi-keyword query, we systematically construct a privacy-preserving query scheme with bilinear pairing-based cryptography. In particular, our proposed scheme is scalable and very suitable for multi-user environments due to the flexible user registration and revocation mechanisms. Furthermore, a detailed security analysis shows that the proposed scheme can ensure the confidentiality of LBS data, and protect the location and query content privacy. Extensive experiments are conducted on a real LBS dataset, and the simulation results confirm the security and efficiency of our scheme.

A Rainbow-Based Authentical Scheme for Securing Smart Connected Health Systems.

Smart Connected Health Systems (SCHSs) belong to health systems that provide services of health care remotely. They provide the doctors with access to electronic medical records with the aid of medical sensors, smart wearable devices and smart medical instruments. Although SCHSs have many applications in the area of health care, securing massive amount of valuable and sensitive data of the patients and preserving the privacy are challenging. User authentication based on public key cryptographic techniques is playing a crucial role in SCHSs for protecting the privacy of patients. However, quantum computers will break such techniques. Rainbow signature is one of the candidates of the next generation of cryptographic algorithms which can resist attacks on quantum computers. However, it is vulnerable to Differential Power Analysis (DPA) attacks, which is based on information gained from the cryptographic implementations. We present techniques to exploit the countermeasures to protect Rainbow against DPA attacks. We propose a variant of Rainbow with resistance to DPA attacks. First, we take a random vector to randomize the power consumption of private keys during computing the first affine transformation; Second, random variables are adopted during computing central map transformation; Third, we take two random vectors during computing the second affine transformation to randomize the power consumption of private keys. We analyze the efficiency and implement the scheme on hardware. Compared with the related implementations, our scheme is efficient and suitable for signature generations on hardware. Besides, we propose a secure authentical scheme based on the implementation for protecting record of patients in SCHSs.

Partial and Fully Homomorphic Encryption Schemes for Privacy Preserving

Nowadays security and authentication of user’s data is a major concern over cloud environment. Unauthorized users try to attack outsourced data over the cloud. Different researchers proposed various algorithms based upon data security. Authentication technique such as homomorphic encryption is the latest advancement in privacy preserving. Homomorphic encryption operations are applied to cipher text which provides the similar results that would have been derived from original text. Homomorphic public key cryptography technique preserves user’s data security. This paper focuses on various partial and fully homomorphic encryption schemes and gives a comparative analysis.

E-Kitap Ödünç Alma Yönetim Sistemi İçin Yeni Model

In today's information-age world, most libraries use traditional borrowing methods. These conventional methods have some disadvantages such as torn and loss of books, and no access to books at that moment. In this paper, to overcome such disadvantages, we propose a novel e-book borrowing mechanism considering digital rights management. By combining the techniques given in this paper, e-books are protected against copying, distributing, printing and unauthorized use while borrowing and using. An infrastructure is designed for users to access books through electronic devices. In this structure, e-books are user-specific encrypted. Even if the e-book files are copied by unauthorized users, the key cannot be accessed by the copied device since the target platform doesn’t have this key. Thus, the borrowed book is prevented from being used by an unauthorized user. Then, the borrowed books can be checked via cloud system technologies by sharing resources between devices. Moreover, even if the books are copied and distributed, the malicious user can be found via watermarking. The main difference to the previous studies is that QR code authentication, which is generated by public key cryptographic techniques, enables the use of books on different devices.