Public Key Research Articles

Improving the Performance of CPA Attacks for Ciphers Using Parallel Implementation of S-Boxes

Since their introduction in early 2000, CPA (correlation power analysis), as a cryptographic tool, has been widely used in the cryptanalysis of cryptographic algorithms (being applicable to both symmetric key ciphers as well as to public key encryption schemes). An application of the classical CPA method, along with its variants, to cryptographic algorithms that use parallel implementation of its substitution boxes (S-boxes) commonly requires more power traces to extract the secret key compared to the case when serial implementation of S-boxes is employed. To reduce the amount of power traces in this scenario, we propose a modification of the standard CPA approaches and demonstrate practically that our method performs better than the existing ones in this respect. To verify the efficiency of our improved CPA method, we apply it to the public databases of DPA Contest V2. In particular, the experimental results show that only 495 power traces are required to recover the secret key of AES. We also compare the performance of our attack to the relevant methods whose parameters are available at DPA Contest V2. The results show that compared to the best nonprofiling side-channel attack (SCA) attack, our method reduces the number of power traces required to recover the secret key by 6,566. Also, our new method performs almost similarly as the best profiling SCA attack of Benoit Gerard (in terms of the required number of power traces), thus reducing the gap in the performance of profiling and nonprofiling SCA attacks.

Toward Sensor Measurement Reliability in Blockchains.

In this work, a secure architecture to send data from an Internet of Things (IoT) device to a blockchain-based supply chain is presented. As is well known, blockchains can process critical information with high security, but the authenticity and accuracy of the stored and processed information depend primarily on the reliability of the information sources. When this information requires acquisition from uncontrolled environments, as is the normal situation in the real world, it may be, intentionally or unintentionally, erroneous. The entities that provide this external information, called Oracles, are critical to guarantee the quality and veracity of the information generated by them, thus affecting the subsequent blockchain-based applications. In the case of IoT devices, there are no effective single solutions in the literature for achieving a secure implementation of an Oracle that is capable of sending data generated by a sensor to a blockchain. In order to fill this gap, in this paper, we present a holistic solution that enables blockchains to verify a set of security requirements in order to accept information from an IoT Oracle. The proposed solution uses Hardware Security Modules (HSMs) to address the security requirements of integrity and device trustworthiness, as well as a novel Public Key Infrastructure (PKI) based on a blockchain for authenticity, traceability, and data freshness. The solution is then implemented on Ethereum and evaluated regarding the fulfillment of the security requirements and time response. The final design has some flexibility limitations that will be approached in future work.

Online/offline attribute-based searchable encryption revised: Flexibility, security and efficiency

Attribute-based encryption with keyword search (ABKS) is a versatile public-key encryption system that supports access control and ciphertext retrieval. However, it often involves complex computations for ciphertext generation. To overcome this challenge, researchers have proposed several online/offline ABKS (OOABKS) schemes. These schemes optimize online ciphertext generation by pre-generating intermediate ciphertexts in an offline manner.However, we find some limitations of existing OOABKS schemes: (1) Some schemes lack flexibility because the intermediate ciphertext is embedded with an access structure and therefore it cannot be used to generate a final ciphertext encrypted under another access structure. (2) Other schemes fail to achieve the basic security requirement.In this work, we conduct a comprehensive analysis of existing OOABKS schemes. Next, we propose a revised OOABKS scheme that offers provable security based on the well-known Bethencourt et al.’s attribute-based encryption scheme. Our scheme retains the advantages of online/offline ciphertext generation in previous OOAKBS schemes while addressing their limitations. Experiment results show that our revised scheme achieves comparable efficiency to previous OOABKS schemes without sacrificing flexibility or security.

Mobile Sensoring Data Verification via a Pairing-Free Certificateless Signature Secure Approach against Novel Public Key Replacement Attacks

To achieve flexible sensing coverage with low deployment costs, mobile users need to contribute their equipment as sensors. Data integrity is one of the most fundamental security requirements and can be verified by digital signature techniques. In the mobile crowdsensing (MCS) environment, most sensors, such as smartphones, are resource-limited. Therefore, many traditional cryptographic algorithms that require complex computations cannot be efficiently implemented on these sensors. In this paper, we study the security of certificateless signatures, in particular, some constructions without pairing. We notice that there is no secure pairing-free certificateless signature scheme against the super adversary. We also find a potential attack that has not been fully addressed in previous studies. To handle these two issues, we propose a concrete secure construction that can withstand this attack. Our scheme does not rely on pairing operations and can be applied in scenarios where the devices’ resources are limited.

RelCLAS: A Reliable Malicious KGC-Resistant Certificateless Aggregate Signature Protocol for Vehicular Ad Hoc Networks

Vehicular ad hoc network (VANET) enables a more efficient and secure traffic environment by integrating several emerging technologies. The technology of certificateless aggregate signature (CLAS) is widely utilized to guarantee secure communications in VANET. However, the legitimation of vehicles’ public keys cannot be verified effectively in existing CLAS protocols for VANET. Thus, a malicious key generation center (KGC) can masquerade as any vehicle and generate legitimate signatures. In this paper, a reliable malicious KGC-resistant CLAS protocol, called RelCLAS, is proposed to eradicate this problem. RelCLAS solves the key escrow problem owning to the combination of registration-based encryption (RBE) and CLAS. Partial public keys selected by vehicles are stored in a key accumulator to prevent malicious KGC from forging valid signatures. Formal security proof demonstrates that RelCLAS satisfies the fundamental security requirements of VANET. Extensive simulations illustrate that RelCLAS is efficient, reliable, and feasible.

PPT-LBS: Privacy-preserving top-k query scheme for outsourced data of location-based services

Location-based service (LBS) is enjoying a great popularity with the fast growth of mobile Internet. As the volume of data increases dramatically, an increasing number of location service providers (LSPs) are moving LBS data to cloud platforms for benefit of affordability and stability. However, while cloud server provides convenience and stability, it also leads to data security and user privacy leakage. Aiming at the problems of insufficient privacy protection and inefficient query in the existing LBS data outsourcing schemes, this paper presents a novel privacy-preserving top-k query for outsourcing situations. Firstly, to ensure data security of LSP and privacy of the user, the enhanced asymmetric scalar-product preserving encryption and public key searchable encryption have been adopted to encrypt outsourced data and LBS query, which can effectively lower the computational cost and realize the privacy protection search. Secondly, an efficient and secure index structure is constructed by using a coded quadtree and the bloom filter, so that the cloud server can quickly locate the user’s query region to improve retrieval efficiency. Finally, the formal security analysis is given under the random oracle model, and the performance is evaluated by experiments which demonstrates that our scheme is preferable to existing schemes.

Secure Enrollment Token Delivery Mechanism for Zero Trust Networks Using Blockchain

Zero Trust Networking (ZTN) is a security model where no default trust is given to entities in a network infrastructure. The first bastion of security for achieving ZTN is strong identity verification. Several standard methods for assuring a robust identity exist (E.g., OAuth2.0, OpenID Connect). These standards employ JSON Web Tokens (JWT) during the authentication process. However, the use of JWT for One Time Token (OTT) enrollment has a latent security issue. A third party can intercept a JWT, and the payload information can be exposed, revealing the details of the enrollment server. Furthermore, an intercepted JWT could be used for enrollment by an impersonator as long as the JWT remains active. Our proposed mechanism aims to secure the ownership of the OTT by including the JWT as encrypted metadata into a Non-Fungible Token (NFT). The mechanism uses the blockchain Public Key of the intended owner for encrypting the JWT. The blockchain assures the JWT ownership by mapping it to the intended owner's blockchain public address. Our proposed mechanism is applied to an emerging Zero Trust framework (OpenZiti) alongside a permissioned Ethereum blockchain using Hyperledger Besu. The Zero Trust Framework provides enrollment functionality. At the same time, our proposed mechanism based on blockchain and NFT assures the secure distribution of OTTs that is used for the enrollment of identities.

Possibility of decryption speed-up by parallel processing in CCA secure hashed ElGamal.

In order to prove the ElGamal CCA(Chosen Ciphertext Attack) security in the random oracle model, it is necessary to use the group where ICDH(Interactive Computational Diffie Hellman) assumption holds. Until now, only bilinear group with complex algebraic structure has been known as the ICDH group. In this paper, we introduce the ICDH group with simple algebraic structure. In other words, we prove that ICDH assumption holds in the integer group with composite modulus. On the basis of this, we propose the CCA secure hashed ElGamal and its fast variant to speed up decryption by parallel processing. Our parallel scheme has the fastest decryption among all CCA secure PKE(Public Key Encryption) schemes implemented in integer group and gives the possibility that ElGamal protocol could be practical when the big modulus numbers are used to resist the quantum attack.

Securing Health Data in Mobile Cloud Computing by a Modular Encryption Approach

Abstract: In the dynamic field of healthcare informatics, this research review explores health data security in mobile cloud computing, emphasizing modular encryption standards. In this paper, an exploration of advanced security methodologies within the Mobile Cloud Computing landscape is presented. The study examines three distinct encryption strategies – Symmetric Key Encryption, Public Key Infrastructure, and Homomorphic Encryption – each strategically employing the Modular Encryption Standard. The findings underscore the versatility of these methods in fortifying health information security within mobile environments, providing an understanding of their implementation nuances and comparative advantages. The literature critically assesses protocols, authentication methods, and vulnerabilities in healthcare contexts, extending its analysis to incorporate emerging technologies.

A lattice-based designated-server public-key authenticated encryption with keyword search

Public-key Encryption with Keyword Search (PEKS) provides an efficient way to search on encrypted cloud data. However, it cannot resist against off-line Inside Keyword Guessing Attacks (IKGA). To alleviate this issue, Huang and Li proposed the Public-key Authenticated Encryption with Keyword Search (PAEKS), which the keyword is also authenticated. However, they do not provide post-quantum security promises. In this paper, we propose the first lattice-based designated-server PAEKS (dPAEKS). We formally define dPAEKS and its security models, and propose a lattice-based construction. It is quantum-resistant under the assumption of learning with errors and the sender authenticated the keyword so it can resist IKGA. Furthermore, we strengthen the security requirement, so that only the designated tester can search the ciphertext. Finally, we compare our scheme with some related schemes to demonstrate its efficiency.

An Analysis of the Performance and Randomness of Lattice-based Public Key Cryptography Algorithms

An Analysis of the Performance and Randomness of Lattice-based Public Key Cryptography Algorithms

ENTRY-EXIT SYSTEM SCOPE, API/PNR CAPABILITY WEAKNESS

The practical recommendations for the application of Advance Passenger Information and Passenger Name Record System (API / PNR) were described in the article with the aim to use such system as a counteracting cross-border threats tool. Biometrics establishes a strong link between a document and its holder only if all electronic security features (signatures) are reviewed. That is the critical point of all system. Many EU countries don’t have Public key infrastructure in place and can’t use the mentioned security functions. There no joint EU system. Only ICAO has a commercial Public key directory, which provides PKI functions to some countries. Specific digital algorithms know and do many things better, like people, and can make a significant improvement. The order of actions for system implementing is proposed. He will be responsible for Risk assessment, Biometric verification accuracy, and Document verification. It is mandatory to improve data management, mostly to cover all fields and flows of data. Improve legislation related to data management for the mentioned purpose and GDPR. Besides, we have to invest more in automatic border control systems infrastructure. It is mandatory to centralize Public Key Infrastructure and Certificates master list management and validation. All measures will increase public security and save innocent lives from cross border crimes.

Various matching keys for asymmetric topology encryption

With the fast development of quantum computer technology, one has to focus on the security of information running in real networks. Topological coding is a technology of basic topological structure, number theory and algebra has potential application value in asymmetric encryption system. The public key and private key of topological graph encryption system designed by topological coding may be able to resist attacks equipped with artificial intelligence technology and quantum computer. In order to further investigate topology encoding, we propose new techniques for designing public and private keys using graph coloring and labeling.

Blockchain-assisted verifiable certificate-based searchable encryption against untrusted cloud server for Industrial Internet of Things

The Industrial Internet of Things (IIoT) has brought practical application value to many industries, where significant amounts of IIoT data and resources are outsourced to cloud server (CS) via diverse networks for data fusion, monitoring, sharing, and calculation analysis. Considering privacy, there is a need to execute the encryption operation on the data before outsourcing, while how to retrieve the encrypted data from CS becomes a thorny issue. Furthermore, the untrusted CS in charge of storing and searching the ciphertexts may return incorrect or incomplete search results for some interest. Verifiable public key searchable encryption (VPKSE) provides the ability to encrypt data, retrieve ciphertext, and verify search results simultaneously. However, the malicious behavior of CS has not been sufficiently considered in most existing schemes, that is, their verifiability only ensures the correctness of search results, neglecting completeness. In this paper, the verifiability of VPKSE is re-examined, and three verifiability levels are defined detailedly. On this basis, a blockchain-assisted verifiable certificated-based searchable encryption (BVCBSE) scheme for IIoT is put forward. The integration of blockchain and cryptographic accumulator ensures that an untrusted CS must return correct and complete search results, achieving the highest level of verifiability. In addition, security analysis demonstrates that BVCBSE can resist keyword guessing attack. Performance evaluation illustrates that BVCBSE is efficient and practical.

Development of RSA and some attack points

Currently, the relatively popular public key encryption is RSA. It was officially launched in 1978 and given their initials as a name. Different encryption and decryption keys are used in the RSA public-key cryptosystem. Deriving decryption keys from known encryption keys is computationally difficult. Rsa has emerged in various forms since its development. Since the development of RSA, there have been various forms, which means there are various loopholes. Next, we will summarize several interesting attack methods of rsa. It will involve continued fractions and CRT and so on. Through this paper, one can learn a series of knowledge about rsa. As a classic asymmetric password, the value of rsa's existence is relatively high, and exploring its value is something that every password learner should experience. Through this article, one will learn about the most basic attack methods of rsa.

Preservation of Sensitive Data Using Multi-Level Blockchain-based Secured Framework for Edge Network Devices

The proliferation of IoT devices has influenced end users in several aspects. Yottabytes (YB) of information are being produced in the IoT environs because of the ever-increasing utilization capacity of the Internet. Since sensitive information, as well as privacy problems, always seem to be an unsolved problem, even with best-in-class in-formation governance standards, it is difficult to bolster defensive security capabilities. Secure data sharing across disparate systems is made possible by blockchain technology, which operates on a decentralized computing paradigm. In the ever-changing IoT environments, blockchain technology provides irreversibility (immutability) usage across a wide range of services and use cases. Therefore, blockchain technology can be leveraged to securely hold private information, even in the dynamicity context of the IoT. However, as the rate of change in IoT networks accelerates, every potential weak point in the system is exposed, making it more challenging to keep sensitive data se-cure. In this study, we adopted a Multi-level Blockchain-based Secured Framework (M-BSF) to provide multi-level protection for sensitive data in the face of threats to IoT-based networking systems. The envisioned M-BSF framework incorporates edge-level, fog-level, and cloud-level security. At edge- and fog-level security, baby kyber and scaling kyber cryptosystems are applied to ensure data preservation. Kyber is a cryptosystem scheme that adopts public-key encryption and private-key decryption processes. Each block of the blockchain uses the cloud-based Argon-2di hashing method for cloud-level data storage, providing the highest level of confidentiality. Argon-2di is a stable hashing algorithm that uses a hybrid approach to access the memory that relied on dependent and independent memory features. Based on the attack-resistant rate (> 96%), computational cost (in time), and other main metrics, the proposed M-BSF security architecture appears to be an acceptable alternative to the current methodologies.

High Throughput Acceleration of Scabbard Key Exchange and Key Encapsulation Mechanism Using Tensor Core on GPU for IoT Applications

High throughput key encapsulations and decapsulations are needed by IoT applications in order to simultaneously process a multitude of small data in secure communication. In this paper, we present two novel techniques for accelerating the implementation of polynomial convolution on a GPU, utilizing advanced Tensor cores, which benefit the performance of key encapsulations. First, a polynomial re-structuring technique is proposed to allow several polynomials with distinct public keys to be processed in a single communication cycle. This is an improvement compared to the previous work by Lee et al. Next, we observe that polynomial convolution in some key encapsulation mechanisms contains reduction patterns that are not friendly to parallel implementation. We propose separating the multiplication and reduction processes so they can be parallelized independently. To verify the effectiveness of our proposed techniques, we applied it to two key-encapsulation mechanisms from the Scabbard post-quantum key-encapsulation mechanism suite and evaluate their performance. Experimental results show that polynomial convolution using Tensor cores is 1.05× faster (for the Florete scheme) and 3.6× faster (for the Sable scheme) than using CUDA core-based multiplication with conventional cores on a GPU. The Tensor cores based encapsulations and decapsulations are faster than a reference implementation on a CPU supporting AVX2 by more than 5.6× and 6.4×, respectively, for the Florete scheme and 8.3× and 13.3× faster, respectively, for the Sable scheme. This shows that the proposed techniques can achieve significantly higher throughput for key exchange and encapsulation mechanisms, which are important for securing IoT applications.

Quantum-resistant Transport Layer Security

The reliance on asymmetric public key cryptography (PKC) and symmetric encryption for cyber-security in current telecommunication networks is threatened by the emergence of powerful quantum computing technology. This is due to the ability of quantum computers to efficiently solve problems such as factorization or discrete logarithms, which are the basis for classical PKC schemes. Thus, the assumption that communications networks are secure no longer holds true. Quantum Key Distribution (QKD) and post-quantum cryptography (PQC) are the first cyber-security technologies that allow communications to resist the attacks of a quantum computer. To achieve quantum-resistant communications, the aforementioned technologies need to be incorporated into a network security protocol such as Transport Layer Security (TLS). In this paper, we describe and implement two novel, hybrid solutions in which QKD and PQC are combined inside TLS for achieving quantum-resistant authenticated key exchange: Concatenation and Exclusively-OR (XOR). We present the results, in terms of complexity and security enhancement, of integrating state-of-the-art QKD and PQC technologies into a practical, industry-ready TLS implementation. Our findings demonstrate that the adoption of a PQC-only approach enhances the TLS handshake performance by approximately 9% compared to classical methods. Furthermore, our hybrid PQC-QKD quantum-resistant TLS comes at a performance cost of approximately 117% during the key establishment process. In return, we substantially augment the security of the handshake, paving the road for the development of future-proof quantum-resistant communication systems based on QKD and PQC.

On Inverse Protocols of Post Quantum Cryptography Based on Pairs of Noncommutative Multivariate Platforms Used in Tandem


 
 
 Non-commutative cryptography studies cryptographic primitives and systems which are based on algebraic structures like groups, semigroups and noncommutative rings. We continue to investigate inverse protocols of Non-commutative cryptography defined in terms of subsemigroups of Affine Cremona Semigroups over finite fields or arithmetic rings Zm and homomorphic images of these semigroups as possible instruments of Post Quantum Cryptography. This approach allows to construct cryptosystem which are not public keys, when protocol finish correspondents have mutually inverse transformations on affine space Kn or variety (K*)n where K is the field or arithmetic ring.
 The security of such inverse protocol rests on the complexity of word problem to decompose element of Affine Cremona Semigroup given in its standard form into composition of given generators. We discuss the idea of usage combinations of two cryptosystems with cipherspaces(K*)n and Kn to form a new cryptosystem with the plainspace(K*)n, ciphertextKn and nonbijective highly nonlinear encryption map.
 
 

StopGuess: A framework for public-key authenticated encryption with keyword search

Public key encryption with keyword search (PEKS) allows users to search on encrypted data without leaking the keyword information from the ciphertexts. But it does not preserve keyword privacy within the trapdoors, because an adversary (e.g., untrusted server) might launch inside keyword-guessing attacks (IKGA) to guess keywords from the trapdoors. In recent years, public key authenticated encryption with keyword search (PAEKS) has become a promising primitive to counter the IKGA. However, existing PAEKS schemes focus on the concrete construction of PAEKS, making them unable to support modular construction, intuitive proof, or flexible extension. In this paper, our proposal called “StopGuess” is the first elegant framework to achieve the above-mentioned features. StopGuess provides a general solution to eliminate IKGA, and we can construct a bundle of PAEKS schemes from different cryptographic assumptions under the framework. To show its feasibility, we present two generic constructions of PAEKS and their (pairing-based and lattice-based) instantiations in a significantly simpler and more modular manner. Besides, without additional costs, we extend PAEKS to achieve anonymity which preserves the identity of users; we integrate it with symmetric encryption to support data retrieval functionality which makes it practical in resource-constrained applications.