RSA Signature Research Articles

Verifiable visually meaningful image encryption algorithm based on compressive sensing and (t, n)-threshold secret sharing

Abstract A verifiable visually meaningful image encryption algorithm based on compressive sensing and (t, n)-threshold secret sharing is proposed. Firstly, the plain image is compressed and encrypted by 2D block compressive sensing to obtain the pre-encrypted image. During this process, the enhanced logistic map and the enhanced tent map are used to generate the measurement matrix and the permutation sequence, respectively. Secondly, multiple shadow images of the pre-encrypted image are generated by using the (t, n)-threshold secret sharing scheme, and then each shadow image is further encrypted by using the encryption matrix generated by the chaotic system. Meanwhile, the signatures of the shadow images are obtained by using RSA signature algorithm. Finally, the shadow images and their corresponding signatures are embedded into the carrier image to generate the cipher image with high visual quality by using the LSB method. Additionally, the present algorithm can resist known-plaintext and chosen-plaintext attacks by incorporating the hash value of the plain image as part of the key. Meanwhile, the use of 2D block compressive sensing significantly reduces the reconstruction time. Simulation results demonstrate that the proposed algorithm achieves excellent decryption quality and operational efficiency.

A GROUP MANAGEMENT SCHEME OF VEHICLE NETWORKING BASED ON HIERARCHICAL DISTRIBUTION

We introduce and implement a new centralized distribution algorithm and apply it to the vehicle networking environment, reconstruct the principle structure of the one-way function binary tree based on the Chinese remainder theorem, and generate the final group key from the bottom up. The analysis shows that the final data distribution can be reduced to the logarithmic level of the traditional centralized distribution data. In the aspect of authentication, we use the elliptic curve signature algorithm (ECDSA), which is more lightweight than RSA and DSA signature algorithm, which makes it more able to adapt to the fast-moving vehicle network environment, faster and more convenient to authenticate and manage the vehicles in the coverage area. Experiments show that our model can be applied to mobile and large number of node environments, and can achieve anonymity, traceability, non-repudiation and backward security in terms of security.

AN OVERVIEW OF FAST VARIANTS OF THE RSA CRYPTOSYSTEM FOR MODERN CRYPTOGRAPHY APPLICATIONS

RSA is a robust and widely utilized public-key scheme to ensure the confidentiality and authenticity of digital communication and data transmission over the Internet, including online banking, e-commerce, e-mail, and blockchain-based apps. The RSA decryption and signature generation algorithms are computationally expensive, particularly for resource-constrained devices. RSA algorithms have been the subject of numerous research studies to improve their speed over the past few decades. This research has focused on developing various optimizations and alternative algorithms to reduce the computational complexity of RSA processes while ensuring an acceptable security level. This paper surveys four RSA variants created to speed up RSA decryption and signing generation. Using the window exponentiation method, the implementation outcomes show that the RSA scheme gets fast decryption and signing generation processes when using a secure multi-prime modulus and CRT to decrypt and sign.

TEGRAS: An Efficient Tegra Embedded GPU-Based RSA Acceleration Server

Industrial Internet of Things (IIoT) has strict requirements on the performance and security of devices. Public-key cryptography, as a kind of computing resource-consuming algorithm, is widely used in the digital signature, key exchange, and so on. The embedded graphics processing units (GPUs) are now rapidly achieving extraordinary computing power, such as NVIDIA Tegra K1/X1/X2/Xavier, which are also treated as edge computing devices. They are widely used in IIoT environments, such as intelligent manufacturing, smart cities, and vehicle-mounted systems. The performance advantages endow embedded GPUs with the possibility of accelerating cryptography that also requires high-density computing. This article implements an efficient Tegra-based embedded GPU RSA acceleration server-oriented IIoT, named TEGRAS. Various optimization methods are employed to promote efficiency, including multithreaded Montgomery multiplication and Chinese Remainder Theorem implementation on the resource-constricted embedded GPUs. With about 40–50 W of power consumption, TEGRAS can deliver 34 kops/s of RSA2048 signature generation and 1007 kops/s of RSA signature verification, which outperforms implementations in the desktop GPUs and embedded CPUs in the perspective of performance-to-power ratio. To evaluate TEGRAS in real-world scenarios, we additionally build a network stack to deliver digital signature services, which can provide more than 34 and 978 kops of signature generation and signature verification, respectively. In a word, based on the embedded GPU, we provide a high-throughput, low-latency, and ready-to-use RSA accelerator-oriented IIoT.

METODE ONE TIME PASSWORD MODIFIED SEBAGAI SISTEM KEAMANAN MONITORING IOT

Monitoring is an activity carried out to find out the process of running a program or system that has been designed, whether it runs well as expected or not, find out the obstacles that occur and how to overcome these obstacles. The cryptographic scheme to secure communication protocols is one of the most effective defenses against a variety of attacks, including eavesdropping and simple routing attacks, at the communication layer. One of the techniques studied in cryptography is encryption-description. This study aims to apply a one time password (OTP) modified algorithm into an IoT based temperature and humidity monitoring system using a Raspberry PI microcontroller device and a DHT 11 sensor. . The encryption process begins with hashing using the SHA method on the plaintext, followed by producing a private key and public key for RSA Signature encryption, the hashing results will be encrypted using the RSA Signature algorithm, the RSA Signature encryption results will be combined with the RSA Signature public key and plaintext, followed by producing an OTP that will be used as an AES key. Next the AES encryption process is executed, the OTP key will be encrypted RSA, the results of the RSA ciphertext and the AES ciphertext are combined and encoded with the Base64 method. The implementation of this security system gets the test results of the average duration for data encryption process is 435,163ms, and the data transmission with encryption process is 123,705ms

Third Party Public Auditing Scheme for Cloud Storage

Abstract: Thus the new auditing scheme has been developed by considering all these requirements. It consist of three entities: data owner, TPA and cloud server. The data owner performs various operations such as splitting the file to blocks, encrypting them, generating a hash value for each, concatenating it and generating a signature on it. The TPA performs the main role of data integrity check. It performs activities like generating hash value for encrypted blocks received from cloud server, concatenating them and generates signature on it. It later compares both the signatures to verify whether the data stored on cloud is tampered or not. It verifies the integrity of data on demand of the users. The cloud server is used only to save the encrypted blocks of data. This proposed auditing scheme make use of AES algorithm for encryption, SHA-2 for integrity check and RSA signature for digital signature calculation. In this philosophy, users of cloud storage services no longer physically maintain direct control over their data, which makes data security one of the major concerns of using cloud. Existing research work already allows data integrity to be verified without possession of the actual data file. When the verification is done by a trusted third party, this verification process is also called data auditing, and this third party is called an auditor. As a result, every small update will cause re-computation and updating of the authenticator for an entire file block, which in turn causes higher storage and communication overheads. In this paper, we provide a formal analysis for possible types of fine-grained data updates and propose a scheme that can fully support authorized auditing and fine-grained update requests. Basedon our scheme, we also propose an enhancement that can dramatically reduce communication overheads for verifying small updates Keywords: Cloud computing, big data, data security, authorized auditing, fine-grained dynamic data update

Analysis of security of post-quantum algorithm of Rainbow electronic signature against potential attacks

Multidimensional public key cryptography is a candidate for post-quantum cryptography, and it makes it possible to generate particularly short signatures and quick verification. The Rainbow signature scheme proposed by J. Dean and D. Schmidt is such a multidimensional cryptosystem and it is considered to be protected against all known attacks. The need for research on Rainbow ES is justified by the fact that there is a need to develop and adopt a post-quantum national securities standard, and that in the process of the US NIST competition on the mathematical basis of cryptographic transformation method Rainbow, promising results. Therefore, it is considered important to take them into account and use them in Ukraine. The Rainbow signature scheme can be implemented simply and efficiently using linear algebra methods over a small finite field and, in particular, creates shorter signatures than those used in RSA and other post-quantum signatures [1]. In the 2nd round of NIST PQC, protected sets of Rainbow parameters are offered and several attacks on them are analyzed [1]. When comparing ES, preference is given to ES algorithms that have been selected according to unconditional criteria, as well as those that have better indicators for integral conditional criteria, because such a technique is more rational. In particular, the Rainbow-Band-Separation (RBS) attack [2] is the best known Rainbow attack with a certain set of parameters and is important. The Rainbow-Band-Separation attack restores the Rainbow secret key by solving certain systems of quadratic equations, and its complexity is measured by a well-known measure called the degree of regularity. However, as a rule, the degree of regularity is greater than the degree of solution in experiments, and it is impossible to obtain an accurate estimate. The paper proposes a new indicator of the complexity of the Rainbow-Band-Separation attack using F4 algorithm, which gives a more accurate estimate compared to the indicator that uses the degree of regularity.
 The aim of the work is a comparative analysis of ES based on MQ-transformations on the criterion of stability-complexity and an attempt to understand the security of Rainbow against RBS attack using F4.

Lightweight fog‐centric auditing scheme to verify integrity of IoT healthcare data in the cloud environment

SummaryIoT healthcare applications have become very popular among medical societies. At regular intervals, the healthcare IoT devices collect the patient's health information and transfer it to cloud storage. Storing the health records in the cloud environment increases the vulnerability. Integrity verification performed at regular intervals ensures the safety and security of the healthcare data stored in the cloud. Existing schemes use RSA and BLS signatures to verify the authenticity. However, the size of the signature is too large in RSA and BLS schemes. Using large signatures for proving the authenticity increases the computation overhead. IoT devices have minimal resource capacity, hence performing heavily weighted integrity schemes will create an unbearable workload. Likewise, private auditing increases the communication overhead between IoT devices and cloud storage. To overcome these issues, a fog‐centric auditing scheme is proposed based on the Cramer–Shoup cryptosystem. The proposed scheme allows the fog nodes to perform integrity verification without compromising security. It reduces the communication overhead by 55%–60%. The size of the CS signature used in the scheme is far lesser than the existing signatures. Moreover, performing the inline deduplication on the fog layer improves the efficiency of cloud storage by 30%.

Secure and efficient wireless multicast communication using trust-based key management

In the present time, wireless correspondence assumes a noteworthy job in a particular correspondence condition. System frameworks are unpreventable in all groups of our general public, from electronic democratic machine to online shopping. These days web is developing with colossal speed where the system dangers and issues are expanding. Data security assumes an indispensable job in giving information classification, accessibility, respectability and security where the sender and recipient need to guarantee secure transmission of information among source and goal hubs utilizing encryption and decoding methods. In this paper, key appropriation RSA technique is utilized in a multi throwing condition, portable specially appointed system (MANET) is a remote correspondence organize, which doesn’t depend on any brought together administration or a prior framework. Different key administration experts dispersed over the system, each with an occasionally refreshed portion of the discharge key, is typically received. Along these lines, numerous endeavors have been made to adjust key administration specialist’s undertakings to the dynamic situations of MANETs and disperse the assignments among MANET hubs. At present different cryptographic methods are being conveyed to meet the regularly evolving needs, which constrains to gadget exceptional security component for MANET, empowering individual and corporate elements to ensure the transmission of information with no interruption by unlawful methods. Cryptographic systems could be both of symmetric key cryptography and asymmetric key cryptography additionally with hash capacities. Symmetric cryptosystem requires the presence of normal shared mystery key between two imparting hubs though deviated cryptosystem keeps up novel key pair between any two conveying hubs (peers). An unbalanced cryptosystem is increasingly effective in a given assignment situated key usage process. In this system, the private key should be stayed quiet with one substance however the realness of the comparing open key for a similar element must be ensured some way or another by a confided in outsider. In this paper, a novel common confirmation and key administration (understanding) convention has been produced for one jump correspondence in versatile specially appointed systems. The convention has a few notable highlights like shared verification, privacy, honesty and key understanding. The convention uses RSA signature age and confirmation.

Outsourcing Proofs of Retrievability

Proofs of Retrievability (POR) are cryptographic proofs that enable a cloud provider to prove that a user can retrieve his file in its entirety. POR need to be frequently executed by the user to ensure that their files stored in the cloud can be fully retrieved at any point in time. To conduct and verify POR, users need to be equipped with devices that have network access, and that can tolerate the (non-negligible) computational overhead incurred by the verification process. This clearly hinders the large-scale adoption of POR by cloud users, since many users increasingly rely on portable devices that have limited computational capacity, or might not always have network access. In this paper, we introduce the notion of outsourced proofs of retrievability (OPOR), in which users can task an external auditor to perform and verify POR with the cloud provider. We argue that the OPOR setting is subject to security risks that have not been covered by existing POR security models. To remedy that, we propose a formal framework and a security model for OPOR. We then propose a generic procedure for transforming a public POR into an OPOR and we show the security of the resulting OPOR in our proposed security model. We demonstrate the transformation on two different instantiations of public POR schemes due to Shacham and Waters (Asiacrypt'08)-one based on BLS signatures and one using RSA signatures. A shortcoming of this transformation is that the generated OPOR inherits the high computational overhead from the underlying public key cryptography. Consequently, we propose afterwards an OPOR that is build from a private POR by Shacham and Waters. We implement a prototype based on our solutions, and evaluate their performance in a realistic cloud setting. Our evaluation results show that our proposals minimize user effort, and incur negligible overhead on the auditor.

Managing a Secure JSON Web Token Implementation By Handling Cryptographic Key Management for JWT Signature in REST API: : A survey

JSON Web Token (JWT) is a compact and self-contained mechanism, digitally authenticated and trusted, for transmitting data between various parties. They are mainly used for implementing stateless authentication mechanisms. The Open Authorization (OAuth 2.0) implementations are using JWTs for their access tokens. OAuth 2.0 and JWT are used token frameworks or standards for authorizing access to REST APIs because of their statelessness and the signature implementation. The most important cryptographic algorithms were tested namely a symmetric algorithm HS256 (HMAC with SHA-256) and an asymmetric algorithm RS256 (RSA Signature with SHA-256) used to construct JWT for signing token based on several parameters of the speed of generating tokens, the size of tokens, time data transfer tokens and security of tokens against attacks.In this research,we propose an approach used for handling cryptographic key management for signing RS256 tokens to ensure the security of the application's architecture. JWT offer a variety of options to manage keys, the server always needs to verify the validity of the key before trusting it for verify that a JWT implementation is secure.The experimental results show It's better to use the RS256 signature method for handling cryptographic key management for signing tokens to manage a secure JWT Implementation

Speeding-up verification of digital signatures

In 2003, Fischlin introduced the concept of progressive verification in cryptography to relate the error probability of a cryptographic verification procedure to its running time. It ensures that the verifier confidence in the validity of a verification procedure grows with the work it invests in the computation. Le, Kelkar and Kate recently revisited this approach for digital signatures and proposed a similar framework under the name of flexible signatures. We propose efficient probabilistic verification procedures for popular signature schemes in which the error probability of a verifier decreases exponentially with the verifier running time. We propose theoretical schemes for the RSA and ECDSA signatures based on some elegant idea proposed by Bernstein in 2000 and some additional tricks. We also present a general practical method, that makes use of efficient error-correcting codes, for signature schemes for which verification involves a matrix/vector multiplication.

Practical and Provably Secure Distributed Aggregation: Verifiable Additive Homomorphic Secret Sharing

Often clients (e.g., sensors, organizations) need to outsource joint computations that are based on some joint inputs to external untrusted servers. These computations often rely on the aggregation of data collected from multiple clients, while the clients want to guarantee that the results are correct and, thus, an output that can be publicly verified is required. However, important security and privacy challenges are raised, since clients may hold sensitive information. In this paper, we propose an approach, called verifiable additive homomorphic secret sharing (VAHSS), to achieve practical and provably secure aggregation of data, while allowing for the clients to protect their secret data and providing public verifiability i.e., everyone should be able to verify the correctness of the computed result. We propose three VAHSS constructions by combining an additive homomorphic secret sharing (HSS) scheme, for computing the sum of the clients’ secret inputs, and three different methods for achieving public verifiability, namely: (i) homomorphic collision-resistant hash functions; (ii) linear homomorphic signatures; as well as (iii) a threshold RSA signature scheme. In all three constructions, we provide a detailed correctness, security, and verifiability analysis and detailed experimental evaluations. Our results demonstrate the efficiency of our proposed constructions, especially from the client side.

JackHammer: Efficient Rowhammer on Heterogeneous FPGA-CPU Platforms

After years of development, FPGAs are finally making an appearance on multi-tenant cloud servers. Heterogeneous FPGA-CPU microarchitectures require reassessment of common assumptions about isolation and security boundaries, as they introduce new attack vectors and vulnerabilities. In this work, we analyze the memory and cache subsystem and study Rowhammer and cache attacks enabled by two proposed heterogeneous FPGA-CPU platforms from Intel: the Arria 10 GX with an integrated FPGA-CPU platform, and the Arria 10 GX PAC expansion card which connects the FPGA to the CPU via the PCIe interface. We demonstrate JackHammer, a novel, efficient, and stealthy Rowhammer from the FPGA to the host’s main memory. Our results indicate that a malicious FPGA can perform twice as fast as a typical Rowhammer from the CPU on the same system and causes around four times as many bit flips as the CPU attack. We demonstrate the efficacy of JackHammer from the FPGA through a realistic fault attack on the WolfSSL RSA signing implementation that reliably causes a fault after an average of fifty-eight RSA signatures, 25% faster than a CPU Rowhammer. In some scenarios our JackHammer attack produces faulty signatures more than three times more often and almost three times faster than a conventional CPU Rowhammer. Finally, we systematically analyze new cache attacks in these environments following demonstration of a cache covert channel across FPGA and CPU.

Fast rebalanced RSA signature scheme with typical prime generation

In RSA, private exponent is usually obtained from the preselected public exponent by extended Euclid algorithm and is roughly the same bit size as a modulus number. If the private exponent is preselected as in rebalanced RSA, then the public exponent obtained by extended Euclid algorithm is roughly the same bit size as a modulus number. Hence, it is not easy to reduce both public exponent and private exponent (or CRT private exponents) in RSA key generation.In order to reduce both public exponent and CRT private exponents, the methods to search the modulus number after selecting proper public exponent and private exponent have been proposed in recent researches. However, these methods all have complicated key generation because prime generation module developed for RSA cannot be used.In this paper, we present a method to reduce both public exponent and CRT private exponents after selecting the prime numbers and propose a fast rebalanced RSA signature scheme with small public exponent.Our scheme is advantageous than other schemes in the aspect of using typical prime generation. That is, key generation is not complicated in our scheme.

Implementation of RSA Signatures on GPU and CPU Architectures

This paper reports a constant-time CPU and GPU software implementation of the RSA exponentiation by using algorithms that offer a first-line defense against timing and cache attacks. In the case of GPU platforms the modular arithmetic layer was implemented using the Residue Number System (RNS) representation. We also present a CPU implementation of an RNS-based arithmetic that takes advantage of the parallelism provided by the Advanced Vector Extensions 2 (AVX2) instructions. Moreover, we carefully analyze the performance of two popular RNS modular reduction algorithms when implemented on many- and multi-core platforms. In the case of CPU platforms we also report that a combination of the schoolbook and Karatsuba algorithms for integer multiplication along with Montgomery reduction, yields our fastest modular multiplication procedure. In comparison with previous literature, our software library achieves faster timings for the computation of the RSA exponentiation using 1024-, 2048- and 3072-bit private keys.

A Blockchain-Assisted Trust Access Authentication System for Solid

The Solid (Social Linked Data) project focuses on data sharing and privacy security and aims to build a decentralized ecosystem that radically changes the way web applications work today. Our goal is to introduce a “trust access authentication system” to achieve secure authentication and fine-grained access control, thereby promoting the implementation of Solid. Blockchain, equipped with multiple security properties and authentication functions, is a crucial technology. In this paper, we present a blockchain-assisted system for secure authentication in Solid and for implementation of fine-grained access control policies. Specifically, we explore to integrate threshold RSA signatures in a permissioned blockchain system to enable a fault-tolerant distributed signature scheme, thereby enhancing the resilience and robustness of authentication system. Moreover, we utilize smart contract to control transaction flows and manage access control policies automatically. Experimental results show that our proposed trust access authentication system enhances security, scales well, and is efficient and economically feasible.

A Secure Data Sharing Platform Using Blockchain and Interplanetary File System

In a research community, data sharing is an essential step to gain maximum knowledge from the prior work. Existing data sharing platforms depend on trusted third party (TTP). Due to the involvement of TTP, such systems lack trust, transparency, security, and immutability. To overcome these issues, this paper proposed a blockchain-based secure data sharing platform by leveraging the benefits of interplanetary file system (IPFS). A meta data is uploaded to IPFS server by owner and then divided into n secret shares. The proposed scheme achieves security and access control by executing the access roles written in smart contract by owner. Users are first authenticated through RSA signatures and then submit the requested amount as a price of digital content. After the successful delivery of data, the user is encouraged to register the reviews about data. These reviews are validated through Watson analyzer to filter out the fake reviews. The customers registering valid reviews are given incentives. In this way, maximum reviews are submitted against every file. In this scenario, decentralized storage, Ethereum blockchain, encryption, and incentive mechanism are combined. To implement the proposed scenario, smart contracts are written in solidity and deployed on local Ethereum test network. The proposed scheme achieves transparency, security, access control, authenticity of owner, and quality of data. In simulation results, an analysis is performed on gas consumption and actual cost required in terms of USD, so that a good price estimate can be done while deploying the implemented scenario in real set-up. Moreover, computational time for different encryption schemes are plotted to represent the performance of implemented scheme, which is shamir secret sharing (SSS). Results show that SSS shows the least computational time as compared to advanced encryption standard (AES) 128 and 256.

Blind multi-signature scheme based on factoring and discrete logarithm problem

One of the important objectives of information security systems is providing authentication of the electronic documents and messages. In that, blind signature schemes are an important solution to protect the privacy of users in security electronic transactions by highlighting the anonymity of participating parties. Many studies have focused on blind signature schemes, however, most of the studied schemes are based on single computationally difficult problem. Also digital signature schemes from two difficult problems were proposed but the fact is that only finding solution to single hard problem then these digital signature schemes are breakable. In this paper, we propose a new signature schemes base on the combination of the RSA and Schnorr signature schemes which are based on two hard problems: IFP and DLP. Then expanding to propose a single blind signature scheme, a blind multi-signature scheme, which are based on new baseline schemes.

Efficient digital signatures from RSA without random oracles

Improving efficiency of digital signature scheme is important since digital signature scheme is a core building block for many privacy protocols. There are some proposals regarding efficient digital signatures whose security arguments are guaranteed by the standard assumption such as RSA assumption. Although several RSA-based digital signature schemes achieve a short signature size, many of them essentially rely on random oracle heuristics. In 2009, Hohenberger and Water proposed an excellent approach to the design of a short RSA-based signature scheme without random oracles (CRYPTO 2009). However, their scheme requires signers to execute an expensive prime-number generation several times, and leaves the reduction in signing and verifying costs as important open problems.In this paper, we propose an efficient digital signature scheme from the above category. That is, we propose a short RSA signature scheme in the standard model, which requires less prime-number generations than those in the previous best scheme of Böhl, Hofheinz, Jager, Koch, and Striecks (Journal of Cryptology 2015). More precisely, the BHJKS scheme requires signers to generate O(log λ) prime-numbers for each signature; however, our scheme requires almost a constant time (e.g., log log λ) of prime-number generation in the signing algorithm, where λ is the security parameter.