RSA Signature Research Articles

Cryptanalysis of Server-Aided RSA Protocols with Private-Key Splitting

We analyze the security and the efficiency of interactive protocols where a client wants to delegate the computation of an RSA signature given a public key, a public message and the secret signing exponent. We consider several protocols where the secret exponent is splitted using some algebraic decomposition. We first provide an exhaustive analysis of the delegation protocols in which the client outsources a single RSA exponentiation to the server. We then revisit the security of the protocols RSA-S1 and RSA-S2 that were proposed by Matsumoto, Kato and Imai in 1988. We present an improved lattice-based attack on RSA-S1 and we propose a simple variant of this protocol that provides better efficiency for the same security level. Eventually, we present the first attacks on the protocol RSA-S2 that employs the Chinese Remainder Theorem to speed up the client's computation. The efficiency of our (heuristic) attacks has been validated experimentally.

ISDSR+: Improving the Security and Availability of Secure Routing Protocol

In ad hoc networks that allow devices to dynamically configure networks via wireless communication, a secure routing protocol is a technology that guarantees the validity of routing with the use of cryptographic authentication. The secure DSR with ID-based sequential aggregate signatures (ISDSR) is a recently introduced secure routing protocol with “cryptographically compact chain,” where each device signs both the routing information and signatures generated by the previous device without increasing the size of signatures and the ID information propagated via packets can be utilized as a public key. However, ISDSR requires communication with a centralized key generation center (KGC), and thus a new device may experience difficulties in joining the protocol. Moreover, the implementation results of ISDSR have not been presented. In this work, we present ISDSR+, a new secure routing protocol without a centralized KGC that uses distributed key generation and the conventional features of ISDSR. ISDSR+ relies on a novel signature scheme where any node can receive a secret key as long as the number of available KGCs is more than a certain threshold. In other words, even if several KGCs are unavailable, the remaining available KGCs can still provide secret keys. We furthermore show promising results of ISDSR+ via a prototype implementation on Raspberry Pis. The results show the computational time of 0.1 s for both the secret key generation and the round trip time (RTT) of routing information under reasonable settings. The RTT of ISDSR+ is better than that of a naive secure routing protocol with RSA signatures.

A Secure and Efficient Data Integrity Verification Scheme for Cloud-IoT Based on Short Signature

The Internet of Things (IoT) is also known as the Internet of everything. As an important part of the new generation of intelligent information technology, the IoT has attracted the attention both of researchers and engineers all over the world. Considering the limited capacity of smart products, the IoT mainly uses cloud computing to expand computing and storage resources. The massive data collected by the sensor are stored in the cloud storage server, also the cloud vulnerability will directly threaten the security and reliability of the IoT. In order to ensure data integrity and availability in the cloud and IoT storage system, users need to verify the integrity of remote data. However, the existing remote data integrity verification schemes are mostly based on the RSA and BLS signature mechanisms. The RSA-based scheme has too much computational overhead. The BLS signature-based scheme needs to adopt a specific hash function, and the batch signature efficiency in the big data environment is low. Therefore, for the computational overhead and signature efficiency issues of these two signature mechanisms, we propose a scheme of data integrity verification based on a short signature algorithm (ZSS signature), which supports privacy protection and public auditing by introducing a trusted third party (TPA). The computational overhead is effectively reduced by reducing hash function overhead in the signature process. Under the assumption of CDH difficult problem, it can resist adaptive chosen-message attacks. The analysis shows that the scheme has a higher efficiency and safety.

Side-channel security analysis of UOV signature for cloud-based Internet of Things

Among Internet of Things (IoTs), cloud-based IoTs help retain the confidentiality of both device-to-cloud and cloud-to-device messages by setting up individual identities and credentials for each IoT devices. As recently been emphasized by two American institutes, National Institute of Standards and Technology (NIST) and National Security Agency (NSA), cloud-based IoTs that use RSA and ECC signatures are insecure under quantum computer attacks. To ensure the security in the cloud-based IoTs under quantum computer attacks, there is a critical need for implementations of new quantum-resistance signature systems, such as Unbalanced Oil and Vinegar (UOV), for making the cloud-based IoTs more secure and reliable. In order to analyze the security of UOV for cloud-based IoTs, we present an efficient algorithm based on side channel analysis of UOV, which combines inducing faults and Hamming distance power analysis. We implement UOV signature schemes on Sakura-G FPGA board via using Verilog-HDL code and Xilinx ISE software, where the power collection uses a 350 MHz Keysights oscilloscope. Based on the experimental results, we successfully recover all the secret keys of UOV signature, which shows that we should protect UOV and related signatures against side channel attacks when they are adopted in cloud-based IoTs.

Towards data storage in cryptographic systems: an efficient hardware architecture based on multivariate scheme for secure storage applications

Secure storage devices are a good example of the Internet of Things (IoTs), which require secure access control mechanisms via using the prominent pubic key cryptographic systems, e.g. RSA, ECC and related systems. However, quantum computer is in a position to attack RSA, ECC and other signature algorithms adopted by many storage devices. Therefore, storage security is facing severe threats. In this paper, an efficient hardware architecture based on multivariate scheme for storage devices is proposed. Multivariate scheme belongs to multivariate public key cryptography (MPKC), which uses affine transformations and central map transformations during cryptographic operations. The advantage of adopting multivariate scheme is that multivariate scheme is immune to quantum computer attack. The efficient hardware architecture is composed of processor module, cryptographic module, storage module, display module, power module, keyboard module, export module and terminal module (off-chip). We implement the hardware architecture on the methodology of TSMC-0.18 μm standard cell CMOS Application Specific Integrated Circuit. The implementation results show that the architecture based on multivariate scheme is very efficient and well suit for storage devices.

FPGA-based Accelerator for Post-Quantum Signature Scheme SPHINCS-256

In recent years, a substantial amount of research has been conducted and progress made in the area of quantum computers. Small functional prototypes have already been reported. If they scale as expected, they will eventually be able to break current public-key cryptosystems. The goal of post-quantum cryptography is to develop cryptographic systems that are secure against attacks originating from both quantum and classical computers. Frequently referred post-quantum signature schemes are based on the security of hash functions. A promising candidate in this group is SPHINCS-256. This paper presents the first FPGA-based hardware accelerator for SPHINCS-256. It can be implemented on an entry-level FPGA, occupying roughly 19,000 LUTs, 38,000 FFs and 36 BRAMs. On a Kintex-7 Xilinx FPGA, signing takes 1.53 milliseconds, and verification needs only 65 microseconds. Area and throughput of the accelerator are in a range that outperform today’s widely used RSA signature scheme. The performance can even keep up with ECDSA accelerators. Hence, SPHINCS-256 is a hot candidate to replace RSA and ECDSA in a post-quantum world.

A Study on a Secure Single Sign-On for User Authentication Information Privacy in Distributed Computing Environment

Difficulties exist in managing password tapping in communication and each server in the existing password authentication scheme. The concept of single sign-on (SSO), which allows one to use linked computing resources and services following only a single authentication, as in general web-based services, was introduced in the distributed computing environment. The major security vulnerabilities for SSO authentication systems are authentication and replay attack. When a user's authentication information is intercepted by an attacker, a normal session can be acquired through a simple replay attack. Accordingly, various studies are being carried out, domestically and internationally, on SSO authentication techniques. For example, some studies use various digital signature methods such as the symmetric key-based algorithm, the RSA signature algorithm, and the Schnorr signature algorithm. Accordingly, this paper proposes a token-based, and NIZK verification-based SSO authentication techniques that provide privac...

Server-Aided Public Key Encryption With Keyword Search

Public key encryption with keyword search (PEKS) is a well-known cryptographic primitive for secure searchable data encryption in cloud storage. Unfortunately, it is inherently subject to the (inside) offline keyword guessing attack (KGA), which is against the data privacy of users. Existing countermeasures for dealing with this security issue mainly suffer from low efficiency and are impractical for real applications. In this paper, we provide a practical and applicable treatment on this security vulnerability by formalizing a new PEKS system named server-aided public key encryption with keyword search (SA-PEKS). In SA-PEKS, to generate the keyword ciphertext/trapdoor, the user needs to query a semitrusted third-party called keyword server (KS) by running an authentication protocol, and hence, security against the offline KGA can be obtained. We then introduce a universal transformation from any PEKS scheme to a secure SA-PEKS scheme using the deterministic blind signature. To illustrate its feasibility, we present the first instantiation of SA-PEKS scheme by utilizing the Full Domain Hash RSA signature and the PEKS scheme proposed by Boneh et al. in Eurocrypt 2004. Finally, we describe how to securely implement the client-KS protocol with a rate-limiting mechanism against online KGA and evaluate the performance of our solutions in experiments.

Efficient Signature Schemes from R-LWE

Compared to the classical cryptography, lattice-based cryptography is more secure, flexible and simple, and it is believed to be secure against quantum computers. In this paper, an efficient signature scheme is proposed from the ring learning with errors (R-LWE), which avoids sampling from discrete Gaussians and has the characteristics of the much simpler description etc. Then, the scheme is implemented in C/C++ and makes a comparison with the RSA signature scheme in detail. Additionally, a linearly homomorphic signature scheme without trapdoor is proposed from the R-LWE assumption. The security of the above two schemes are reducible to the worst-case hardness of shortest vectors on ideal lattices. The security analyses indicate the proposed schemes are unforgeable under chosen message attack model, and the efficiency analyses also show that the above schemes are much more efficient than other correlative signature schemes.

A new universal designated verifier transitive signature scheme for big graph data

We propose a new design of universal designated verifier transitive signatures, to authenticate dynamically growing big graph data. The scheme is built on the classical RSA signature and possesses several desirable properties. It supports edge-signature composition as transitive signatures, i.e., with the signatures of two adjacent edges (i,j) and (j,k), one can obtain a valid signature of the edge (i,k). Additionally, a signature holder can convince only one designated verifier about the existence of an edge. Our design can efficiently achieve a tradeoff between data authenticity (when publishing dynamically growing big graph data) and data privacy (when disseminating big graph data).

Design and Performance Evaluation of Two Approaches to Obtain Anonymity in Transferable Electronic Ticketing Schemes

Electronic tickets demonstrate, without the use of paper, the possession of the right to access or use of a service. In this scenario, the security and privacy achieved in the paper-based system must be preserved in the electronic ticketing systems. In addition to these requirements, the transferability of a ticket from one user to another (without involving a third party) is very useful but also generates other issues to be solved in terms of security and privacy. For example, the users that transfer the same ticket twice must be identified (it is a fraud), but the rest of users have to preserve their privacy (anonymity). In this article we present two proposals of an electronic ticketing system with anonymity and transferability, based on the use of RSA signatures or group signatures, respectively, thus presenting different levels of complexity and anonymity. Moreover, we have implemented both proposals and its performance has been evaluated. The results of this evaluation are useful in order to prove the viability of the proposals even when complex cryptography is used. The strength of the anonymity and the execution costs are the parameters to take into account to choose the more adequate proposal for a specific application.

Cloud data integrity checking with an identity-based auditing mechanism from RSA

Cloud data auditing is extremely essential for securing cloud storage since it enables cloud users to verify the integrity of their outsourced data efficiently. The computation overheads on both the cloud server and the verifier can be significantly reduced by making use of data auditing because there is no necessity to retrieve the entire file but rather just use a spot checking technique. A number of cloud data auditing schemes have been proposed recently, but a majority of the proposals are based on Public Key Infrastructure (PKI). There are some drawbacks in these protocols: (1) It is mandatory to verify the validity of public key certificates before using any public key, which makes the verifier incur expensive computation cost. (2) Complex certificate management makes the whole protocol inefficient. To address the key management issues in cloud data auditing, in this paper, we propose ID-CDIC, an identity-based cloud data integrity checking protocol which can eliminate the complex certificate management in traditional cloud data integrity checking protocols. The proposed concrete construction from RSA signature can support variable-sized file blocks and public auditing. In addition, we provide a formal security model for ID-CDIC and prove the security of our construction under the RSA assumption with large public exponents in the random oracle model. We demonstrate the performance of our proposal by developing a prototype of the protocol. Implementation results show that the proposed ID-CDIC protocol is very practical and adoptable in real life.

Third Party Public Auditing Scheme for Cloud Storage

Cloud storage is one of the service provided by Cloud computing in which data is maintained, managed, backed up remotely and made available to users over a network (typically the Internet). The user is concerned about the integrity of data stored in the cloud as the user's data can be attacked or modified by outside attacker. Therefore, a new concept called data auditing is introduced which check the integrity of data with the help of an entity called Third Party Auditor (TPA). The purpose of this work is to develop an auditing scheme which is secure, efficient to use and possess the capabilities such as privacy preserving, public auditing, maintaining the data integrity along with confidentiality. Thus the new auditing scheme has been developed by considering all these requirements. It consist of three entities: data owner, TPA and cloud server. The data owner performs various operations such as splitting the file to blocks, encrypting them, generating a hash value for each, concatenating it and generating a signature on it. The TPA performs the main role of data integrity check. It performs activities like generating hash value for encrypted blocks received from cloud server, concatenating them and generates signature on it. It later compares both the signatures to verify whether the data stored on cloud is tampered or not. It verifies the integrity of data on demand of the users. The cloud server is used only to save the encrypted blocks of data. This proposed auditing scheme make use of AES algorithm for encryption, SHA-2 for integrity check and RSA signature for digital signature calculation.

Double Counting in <inline-formula> <tex-math notation="LaTeX">$2^{t}$ </tex-math></inline-formula>-ary RSA Precomputation Reveals the Secret Exponent

A new fault attack, double counting attack (DCA), on the precomputation of $2^t$-ary modular exponentiation for a classical RSA digital signature (i.e., RSA without the Chinese remainder theorem) is proposed. The $2^t$-ary method is the most popular and widely used algorithm to speed up the RSA signature process. Developers can realize the fastest signature process by choosing optimum $t$. For example, $t=6$ is optimum for a 1536-bit classical RSA implementation. The $2^t$-ary method requires precomputation to generate small exponentials of message. Conventional fault attack research has paid little attention to precomputation, even though precomputation could be a target of a fault attack. The proposed DCA induces faults in precomputation by using instruction skip technique, which is equivalent to replacing an instruction with a no operation in assembly language. This paper also presents a useful "position checker" tool to determine the position of the $2^t$-ary coefficients of the secret exponent from signatures based on faulted precomputations. The DCA is demonstrated to be an effective attack method for some widely used parameters. DCA can reconstruct an entire secret exponent using the position checker with $63(=2^6-1)$ faulted signatures in a short time for a 1536-bit RSA implementation using the $2^6$-ary method. The DCA process can be accelerated for a small public exponent (e.g., 65537). The the best of our knowledge, the proposed DCA is the first fault attack against classical RSA precomputation.

Provable multiple replication data possession with full dynamics for secure cloud storage

SummaryCloud storage has been gaining tremendous popularity among individuals and corporations because of its low maintenance cost and on‐demand services for the clients. To improve the availability and the reliability of critical data, storing multiple replicas on multiple servers is a commonly used strategy. Currently, several provable data possession (PDP) protocols for multiple replicas of dynamic data have been proposed to ensure the integrity of outsourced multi‐copy data, but the efficiency of these protocols on verifying multiple replicas one by one is not satisfactory. In this paper, we propose a provable multiple replication data possession protocol with full dynamics, named MR‐DPDP. In MR‐DPDP, we utilize a novel authenticated data structure called Merkle hash tree with rank to support both full dynamic data updates and efficient integrity verification. In addition, our construction with RSA signature can support both variable‐sized file blocks and public verification. Through security proof and performance evaluation, we demonstrate that MR‐DPDP not only is sound but also incurs less communication overhead when updating data blocks as well as verifying a proof of the integrity of multiple replicas. Copyright © 2015 John Wiley & Sons, Ltd.

Practical Cryptanalysis of ISO 9796-2 and EMV Signatures

At Crypto 1999, Coron, Naccache and Stern described an existential signature forgery against two popular RSA signature standards, ISO 9796-1 and ISO 9796-2. Following this attack, ISO 9796-1 was wi...

A Survey on Elliptic Curve Cryptography

Elliptic curve cryptography (ECC) is the most efficient public key encryption scheme based onelliptic curve concepts that can be used to create faster, smaller, and efficient cryptographic keys. ECCgenerates keys through the properties of the elliptic curve equation instead of the conventional method ofkey generation. This scheme can be used with public key encryption methods, such as RSA, Diffie-Hellman keyexchange and Digital Signature. Review of the four protocols which applies ECC namely Bitcoin, secureshell (SSH), transport layer security (TLS), and the Austrian e-ID Card describes the high security by usingelliptic curve cryptography.

Mediated Encryption: Analysis and Design

Boneh, Ding and Tsudik presented identity-based mediated RSA encryption and signature systems in which the users are not allowed to decrypt/sign messages without the authorisation of a security mediator.We show that ID-MRSA is not secure and we present a secure modified version of it which is as e

An Efficient Synchronized Aggregate Signature Scheme From Standard RSA Assumption

An aggregate is a digital signature that supports aggregation where any one given n signatures on n distinct messages from n different users can aggregate all these signatures into a single one. We proposed an efficient synchronized aggregate signature scheme from the standard RSA assumption. Our construction is based on the Hohenburger and Waters RSA signature (Crypto 09). This scheme can be proved existentially unforgeable against adaptive chosen-message attacks without random oracles.

Confidence Analysis of a Solo Sign-On Device for Distributed Computer Networks

Solo sign-on (SSO) is a new authentication mechanism that enables a legal user with a single credential to be authenticated by multiple service providers in a distributed computer network. Recently, a SSO scheme proposed and claimed its security by providing well organized security arguments. But their scheme is actually insecure as it fails to meet credential privacy and soundness of authentication. Specifically, we present two impersonation attacks i.e., credential recovering attack and impersonation attack without credentials. So we propose a more authentication scheme that overcomes these attacks and flaws by make use of efficient verifiable encryption of RSA signatures. We promote the formal study of the soundness of authentication as one open problem.