Short Public Keys Research Articles

High-Speed Hardware Architectures and FPGA Benchmarking of CRYSTALS-Kyber, NTRU, and Saber

Post-Quantum Cryptography (PQC) has emerged as a response of the cryptographic community to the danger of attacks performed using quantum computers. All PQC schemes can be implemented in software and hardware using conventional (non-quantum) computing systems. PQC is the biggest revolution in cryptography since the invention of public-key schemes in the mid-1970 s. Lattice-based key exchange schemes have emerged as leading candidates in the NIST PQC standardization process due to their relatively short public keys and ciphertexts. This paper presents novel high-speed hardware architectures for four lattice-based Key Encapsulation Mechanisms (KEMs) representing three NIST PQC finalists: NTRU (with two distinct variants, NTRU-HPS and NTRU-HRSS), CRYSTALS-Kyber, and Saber. We benchmark these candidates in terms of their performance and resource utilization in today's FPGAs. Our best architectures outperform the best designs from other groups reported to date in terms of the area-time product by factors ranging from 1.01 to 2.88, depending on the algorithm and security level. Additionally, our study demonstrates that CRYSTALS-Kyber and Saber have very similar hardware performance. Both outperform NTRU in terms of execution time by a factor 36-62 for key generation and 3-7 for decapsulation, assuming the same security level.

Linearly Homomorphic Signatures from Lattices

AbstractLinearly homomorphic signatures (LHSs) allow any entity to linearly combine a set of signatures and to provide authentication service for the corresponding (combined) data. The public key of the current known LHSs from lattices in the standard model requires $O(l)$ matrices and $O(k)$ vectors, where $l$ is the length of file identifier and $k$ is the maximum data set size that linear functions support. In this paper, we construct two lattice-based LHS schemes with provable security in the standard model and both schemes can authenticate vectors defined over finite field. First, we present a basic LHS scheme satisfying selective security, based on the full-rank difference hash functions. Second, we modify the chameleon hash function constructed by (Cash, D., Hofheinz, D., Kiltz, E. and Peikert, C. (2010) Bonsai Trees, or How to Delegate a Lattice Basis. In Proc. EUROCRYPT 10, Monaco/French Riviera, May 30 to June 3, pp. 523–552. Springer, Berlin) to construct a linearly homomorphic chameleon hash function (LHCHF), which can be applied to all transformations from selectively secure LHS scheme that authenticates vectors defined over finite field $\mathbb{F}_{p}$ ($p=poly(n)$) to fully secure one, except for a new one that authenticates vectors defined over a small field. Starting from LHCFH and the basic scheme as above, we obtain a fully secure LHS scheme. Both schemes can be used to sign multiple files and have relatively short public keys consisting of $O(1)$ matrices and $O(k)$ vectors.

Вычисление случайных пар простых чисел, произведение которых лежит в заданном коротком интервале

The paper proposes heuristic algorithms for constructing pairs of random primes, the product of which lies in a given interval $ \left (\Delta, \, \Delta + \delta \right). $ One algorithm refers to the case $ \delta = \sqrt {\Delta }, $ and the second to $ \delta = 30 \Delta^{1/3}. $ They allow in the well-known RSA cryptosystem to choose shorter public keys (twice for the first algorithm and three times for the second).

Cryptanalysis of a rank-based signature with short public keys

Following Schnorr framework for obtaining digital signatures, Song et al. recently proposed a new instantiation of a signature scheme featuring small public keys from coding assumptions in rank metric, which was accepted at PKC’19. Their proposal makes use of rank quasi-cyclic (RQC) codes to reduce the public key size. We show that it is possible to turn a valid, legitimate signature into an efficiently solvable decoding problem, which allows to recover the randomness used for signing and hence the secret key, from a single signature, in about the same amount of time as required for signing.

Privacy-Preserving and Secure Sharing of PHR in the Cloud.

As a new summarized record of an individual's medical data and information, Personal Health Record (PHR) can be accessible online. The owner can control fully his/her PHR files to be shared with different users such as doctors, clinic agents, and friends. However, in an open network environment like in the Cloud, these sensitive privacy information may be gotten by those unauthorized parties and users. In this paper, we consider how to achieve PHR data confidentiality and provide fine-grained access control of PHR files in the public Cloud based on Attribute Based Encryption(ABE). Differing from previous works, we also consider the privacy preserving of the receivers since the attributes of the receivers relate to their identity or medical information, which would make some sensitive data exposed to third services. Anonymous ABE(AABE) not only enforces the security of PHR of the owners but also preserves the privacy of the receivers. But a normal AABE with a single private key generation(PKG) center may not match a PHR system in the hierarchical architecture. Therefore, we discuss not only the construction of the PHR sharing system base on AABE but also how to construct the PHR sharing system based on the hierarchical AABE. The proposed schemes(especially based on hierarchical AABE) have many advantages over the available such as short public keys, constant-size private keys, which overcome the weaknesses in the existing works. In the standard model, the introduced schemes achieve compact security in the prime order groups.

Sequential Aggregate Signatures and Multisignatures in the Plain Public Key Model

At Eurocrypt’06, Lu et al. presented the first Sequential aggregate signature (SAS) provably secure without random oracles. The draw back of their scheme is that users need long public keys and the security model makes the Knowledge of secure key (KOSK) assumption. We present the first SAS scheme, which the user needs short public keys and the security is proven without random oracles, in the plain public key model. We also present the first Multisignature (MS) scheme in the plain public key model, which the security is proven without random oracles.

Sequential aggregate signatures with short public keys without random oracles

The notion of aggregate signature has been motivated by applications and it enables any user to compress different signatures signed by different signers on different messages into a short signature. Sequential aggregate signature, in turn, is a special kind of aggregate signature that only allows a signer to add his signature into an aggregate signature in sequential order. This latter scheme has applications in diversified settings such as in reducing bandwidth of certificate chains and in secure routing protocols. Lu, Ostrovsky, Sahai, Shacham, and Waters (EUROCRYPT 2006) presented the first sequential aggregate signature scheme in the standard model. The size of their public key, however, is quite large (i.e., the number of group elements is proportional to the security parameter), and therefore, they suggested as an open problem the construction of such a scheme with short keys.In this paper, we propose the first sequential aggregate signature schemes with short public keys (i.e., a constant number of group elements) in prime order (asymmetric) bilinear groups that are secure under static assumptions in the standard model. Furthermore, our schemes employ a constant number of pairing operations per message signing and message verification operation. Technically, we start with a public-key signature scheme based on the recent dual system encryption technique of Lewko and Waters (TCC 2010). This technique cannot directly provide an aggregate signature scheme since, as we observed, additional elements should be published in a public key to support aggregation. Thus, our constructions are careful augmentation techniques for the dual system technique to allow it to support sequential aggregate signature schemes. We also propose a multi-signature scheme with short public parameters in the standard model.

Improved Fully Homomorphic Encryption over the Integers with Shorter Public Keys

Fully homomorphic encryption (FHE) is a “holy grail” of cryptography. However, it is not yet adopted in practice because no known scheme is efficient. In this paper, we mainly focus on how to reduce the public key sizes in FHE. Based on Dijk et al.’s FHE scheme (DGHV) and Gentry’s fully homomorhpic technology, we propose two schemes with shorter public keys by encrypting with a combination of the public key elements to replace a linear form in DGHV scheme and a quadratic form in Coron et al.’s scheme. Compared with DGHV scheme and Coron et al.’s scheme, our schemes can greatly reduce the public key sizes, which make our schemes more efficient. Furthermore, we prove the security of our schemes based on difficulties of the approximate greatest common divisor (AGCD) problem and the sparse subset sum problem.

An Improvement for Fully Homomorphic Encryption over Integers with Shorter Public Keys

This paper puts forward a more efficient fully homomorphic encryption scheme with a view to improving the oversized public key based on the Dijk’s scheme.Encrypted with a cubic form in the public key elements instead of quadratic form by adopting Gentry’s fully homomorphic techonology.The results show that the public key size reduce from to compared to the Coron’s scheme.The security of the proposed scheme is based on both the approximate GCD problem and the sparse-subset sum problem.

Compact McEliece keys based on quasi-dyadic Srivastava codes

The McEliece cryptosystem is one of the few systems to be considered secure against attacks by Quantum computers. The original scheme is built upon Goppa codes and produces very large keys, hence recent research has focused mainly on trying to reduce the public key size. Previous proposals tried to replace the class of Goppa codes with other families of codes, but this was revealed to be an insecure choice. In this paper we introduce a construction based on Generalized Srivastava codes, a large class which includes Goppa codes as a special case, that allows relatively short public keys without being vulnerable to known structural attacks.

The Efficient CCA Secure Public-Key Encryption Scheme

The security and efficient public key encryption algorithm is an important technology guarantee for security of information systems.This paper uses an idea of trapdoor commitment function to protect ciphertext integrity,thus presents a provable public-key encryption(PKE) scheme in the standard model,which is secure against adaptive chosen ciphertext attacks(CCA).The new encryption scheme is very efficient: Compared to the previously most famous scheme by Cramer and Shoup(CS98) it has 20% shorter public keys and 80% shorter secret keys;compared to the scheme by BMW05 it has shorter public/secret keys and has tighter and simpler security reduction.The new encryption scheme supports public ciphertext integrity verification,has short public/secret keys,and its security proved reduces to the Gap Hashed Diffie-Hellman(GHDH) assumption tightly.

Self-generated-certificate public key encryption without pairing and its application

Recently, Liu et al. [26] discovered that Certificateless Public Key Encryption (CL-PKE) suffers the Denial-of-Decryption (DoD) attack. Based on CL-PKC, the authors introduced a new paradigm called Self-Generated-Certificate Public Key Cryptography (SGC-PKC) that captured the DoD attack and proposed the first scheme derived from a novel application of Water’s Identity-Based Encryption scheme [43]. In this paper, we propose a new SGC-PKE scheme that does not depend on the bilinear pairings and hence, is more efficient and requires shorter public keys than Liu et al.’s scheme. More importantly, our scheme reaches Girault’s trust level 3 [16] (cf. Girault’s trust level 2 of Liu and Au’s scheme), the same trust level achieved by a traditional PKI. In addition, we also discuss how our scheme can lead to a secure and self-organized key management and authentication system for ad hoc wireless networks with a function of user-controlled key renewal.

New Constructions of Identity-based Broadcast Encryption without Random Oracles

The main challenge in building efficient broadcast systems is to encrypt messages with short ciphertexts. In this paper, we present a new construction based on the identity. Our construction contains the desirable features, such as constant size ciphertexts and private keys, short public keys and not fixing the total number of possible users in the setup. In addition, the proposed scheme achieves the full security which is stronger than the selective-identity security. Furthermore we show that the proof of security does not rely on the random oracles. To the best our knowledge, it is the first efficient scheme that is full security and achieves constant size ciphertexts and private keys which solve the trade-off between the ciphertext size and the private key size.