Strong RSA Assumption Research Articles

Session Resumption Protocols and Efficient Forward Security for TLS 1.3 0-RTT

The TLS 1.3 0-RTT mode enables a client reconnecting to a server to send encrypted application-layer data in “0-RTT” (“zero round-trip time”), without the need for a prior interactive handshake. This fundamentally requires the server to reconstruct the previous session’s encryption secrets upon receipt of the client’s first message. The standard techniques to achieve this are session caches or, alternatively, session tickets. The former provides forward security and resistance against replay attacks, but requires a large amount of server-side storage. The latter requires negligible storage, but provides no forward security and is known to be vulnerable to replay attacks. In this paper, we first formally define session resumption protocols as an abstract perspective on mechanisms like session caches and session tickets. We give a new generic construction that provably provides forward security and replay resilience, based on puncturable pseudorandom functions (PPRFs). We show that our construction can immediately be used in TLS 1.3 0-RTT and deployed unilaterally by servers, without requiring any changes to clients or the protocol. To this end, we present a generic composition of our new construction with TLS 1.3 and prove its security. This yields the first construction that achieves forward security for all messages, including the 0-RTT data. We then describe two new constructions of PPRFs, which are particularly suitable for use for forward-secure and replay-resilient session resumption in TLS 1.3. The first construction is based on the strong RSA assumption. Compared to standard session caches, for “128-bit security” it reduces the required server storage by a factor of almost 20, when instantiated in a way such that key derivation and puncturing together are cheaper on average than one full exponentiation in an RSA group. Hence, a 1 GB session cache can be replaced with only about 51 MBs of storage, which significantly reduces the amount of secure memory required. For larger security parameters or in exchange for more expensive computations, even larger storage reductions are achieved. The second construction combines a standard binary tree PPRF with a new “domain extension” technique. For a reasonable choice of parameters, this reduces the required storage by a factor of up to 5 compared to a standard session cache. It employs only symmetric cryptography, is suitable for high-traffic scenarios, and can serve thousands of tickets per second.

Experimenting With Non-Interactive Range Proofs Based on the Strong RSA Assumption

Range proofs are proofs that a committed number $m$ belongs to a range $[a,b]$ for public constants $a,b$ , without leaking any information about the value $m$ . In this work, we evaluate and analyze the performance of existing techniques for range proofs based on the strong RSA assumption while varying the range sizes. We first group the techniques into two classes. Our experiments show that the first class, being built on finding sums of squares (e.g., Groth’s range proof), has sharply decreasing performance trends as the range size increases. Thus, solutions in this class seem to be useful primarily for small ranges. The second class, which relies on a direct proof (e.g., Boudot’s range proof), exposes that the performance degradation slopes are not as steep as the range size grows, compared to solutions in the first group. However, this class’s main drawback is that these methods require considerably more modular arithmetic than the first class. Concretely, the Groth and Boudot protocols achieve the best performance when the range sizes are less than and greater than 1410 bits, respectively. As part of this work, we consider an extension by combining the strong points of existing solutions and examine the result efficiency. Interestingly, however, our experimental results report that this extension outperforms either Groth’s or Boudot’s protocol for certain ranges, but there is no range for which the extension outperforms both.

A Forward-secure Threshold Signature Scheme Based on Multiplicative Secret Sharing and Strong RSA Assumption

A new forward-secure threshold digital signature scheme which based on multiplicative secret sharing and strong RSA assumption is put forward in this paper. The scheme has the following property: It have the property of forward security, even if more than the threshold numbers of players are compromised, it is not possible to forge the signature which is related to the past. This property is achieved while keeping the public key fixed and updating the secret keys at regular intervals. Assuming that factoring is hard, we proved that this scheme is security in the random oracle model.

A Forward-secure Threshold Signature Scheme Based on Multiplicative Secret Sharing and Strong RSA Assumption

A Forward-secure Threshold Signature Scheme Based on Multiplicative Secret Sharing and Strong RSA Assumption

Property-Based Anonymous Attestation in Trusted Cloud Computing

In the remote attestation on Trusted Computer (TC) computing mode TCCP, the trusted computer TC has an excessive burden, and anonymity and platform configuration information security of computing nodes cannot be guaranteed. To overcome these defects, based on the research on and analysis of current schemes, we propose an anonymous proof protocol based on property certificate. The platform configuration information is converted by the matrix algorithm into the property certificate, and the remote attestation is implemented by trusted ring signature scheme based on Strong RSA Assumption. By the trusted ring signature scheme based on property certificate, we achieve the anonymity of computing nodes and prevent the leakage of platform configuration information. By simulation, we obtain the computational efficiency of the scheme. We also expand the protocol and obtain the anonymous attestation based on ECC. By scenario comparison, we obtain the trusted ring signature scheme based on RSA, which has advantages with the growth of the ring numbers.

Security weaknesses of a signature scheme and authenticated key agreement protocols

At ACISP 2012, a novel deterministic identity-based (aggregate) signature scheme was proposed that does not rely on bilinear pairing. The scheme was formally proven to be existentially unforgeable under an adaptive chosen message and identity attack. The security was proven under the strong RSA assumption in the random oracle model. In this paper, unfortunately, we show that the signature scheme is universally forgeable, i.e., an adversary can recover the private key of a user and use it to generate forged signatures on any messages of its choice having on average eight genuine signatures. This means, that realizing a deterministic identity-based signature scheme in composite order groups is still an open problem. In addition, we show that a preliminary version of the authenticated key exchange protocol proposed by Okamoto in his invited talk at ASIACRYPT 2007 is vulnerable to the key-compromise impersonation attack and therefore cannot be secure in the eCK model. We also show that the two-party identity-based key agreement protocol of Hölbl et al. is vulnerable to the unknown key-share attack.

Searchable Public Key Encryption Based on RSA Assumption and Extended to Multi-user Setting

In this paper, we study the problem of keyword searches over asymmetrically encrypted data. Our scheme is based on strong RSA assumption, which provides the high efficient search technique and is proven secure in the standard model. In comparison with previous schemes, our scheme requires only simpler computation without pairing operation, and lower storage overheads on servers and clients. Moreover, most servers are not only about to serve for single user, but to support query and search operations for multiple users. As a result, we extend our scheme to multiuser environment, which provides an efficient search scheme of remote storage for a number of users. Furthermore, we define the secure model for mPEKS scheme and prove the security and availability of our scheme.

A Novel Dynamic One-Way Accumulator based on Strong RSA Assumption

A Novel Dynamic One-Way Accumulator based on Strong RSA Assumption

Enhanced Privacy ID: A Direct Anonymous Attestation Scheme with Enhanced Revocation Capabilities

Direct Anonymous Attestation (DAA) is a scheme that enables the remote authentication of a Trusted Platform Module (TPM) while preserving the user's privacy. A TPM can prove to a remote party that it is a valid TPM without revealing its identity and without linkability. In the DAA scheme, a TPM can be revoked only if the DAA private key in the hardware has been extracted and published widely so that verifiers obtain the corrupted private key. If the unlinkability requirement is relaxed, a TPM suspected of being compromised can be revoked even if the private key is not known. However, with the full unlinkability requirement intact, if a TPM has been compromised but its private key has not been distributed to verifiers, the TPM cannot be revoked. Furthermore, a TPM cannot be revoked from the issuer, if the TPM is found to be compromised after the DAA issuing has occurred. In this paper, we present a new DAA scheme called Enhanced Privacy ID (EPID) scheme that addresses the above limitations. While still providing unlinkability, our scheme provides a method to revoke a TPM even if the TPM private key is unknown. This expanded revocation property makes the scheme useful for other applications such as for driver's license. Our EPID scheme is efficient and provably secure in the same security model as DAA, i.e., in the random oracle model under the strong RSA assumption and the decisional Diffie-Hellman assumption.

Efficient Attributes for Anonymous Credentials

We extend the Camenisch-Lysyanskaya anonymous credential system such that selective disclosure of attributes becomes highly efficient. The resulting system significantly improves upon existing approaches, which suffer from a linear number of modular exponentiations in the total number of attributes. This limitation makes them unfit for many practical applications, such as electronic identity cards. Our novel approach can incorporate a large number of binary and finite-set attributes without significant performance impact. It compresses all such attributes into a single attribute base and, thus, boosts the efficiency of all proofs of possession. The core idea is to encode discrete binary and finite-set values as prime numbers. We then use the divisibility property for efficient proofs of their presence or absence. In addition, we contribute efficient methods for conjunctions and disjunctions. The system builds on the strong RSA assumption. We demonstrate the aptness of our method in realistic application scenarios, notably electronic identity cards, and show its advantages for small devices, such as smartcards and cell phones.

A Multi-Trapdoor Commitment Scheme from the RSA Assumption

Gennaro introduced the notion of multi-trapdoor commitments which is a stronger form of trapdoor commitment schemes at CRYPTO 2004. Multi-trapdoor commitments have several cryptographic applications. For example, Gennaro proposed a conversion that makes a non-interactive multi-trapdoor commitment scheme into a noninteractive and reusable non-malleable commitment scheme and a compiler that transforms any proof of knowledge into concurrently nonmalleable one. Gennaro gave constructions of multi-trapdoor commitments, but they rely on stronger assumptions, such as the strong RSA assumption, the q-strong Diffie-Hellman assumption. In this paper, we propose a non-interactive multi-trapdoor commitment scheme from the standard RSA assumption. Thus, as a corollary of our result, we obtain a non-interactive and reusable non-malleable commitment scheme from the standard RSA assumption. Our scheme is based on theHohenberger-Waters signature scheme proposed at CRYPTO2009. Several non-interactive and reusable non-malleable commitment schemes (in the common reference string model) have been proposed, but all of them rely on stronger assumptions (e.g., strong RSA).

Bilinear Parings in Property-based attestation

One of the objectives of trusted computing is to provide remote attestation method that is able to confirm the status of remote platform or application. Existing property-based attestation is based on the strong-RSA assumption and the required key length is too long. What’s more, a considerable number of RSA-length operations having to be performed which lead to low computational efficiency. Bilinear parings-Based Attestation model, which based on elliptic curve discrete logarithm bilinear paring, can shorten the required key length and reduce bandwidth usage at the same premise of safety performance requirements, as well as ensure platform configurations not to be exposed to the platform while improving operating efficiency. On the other hand, the model includes many trusted computing platform parameters in order to resist replay attacks, and take use of information hiding technology to hide certificates and effectively preventing anyone with a source of certificate misuse of the certificate.

General Multi-Party Protocol for Computing Inverses Over a Shared Secret Modulus

Catalano,Gennaro and Halevi proposed a practical distributed protocol for computing inverses over a shared secret modulus,however they only considered threshold adversary structures.In this paper the authors consider general adversary structures,construct two multi-party inversion protocols using linear integer secret sharing schemes proposed by Damgrd and Thorbek,one for the semi-honest adversary model,and the other for the malicious adversary model.The protocol is secure against semi-honest(resp.malicious) adversaries if the adversary structure is Q2(resp.Q3 as well as the strong RSA assumption).The protocol is a generalization of Catalano et al.'s,and can be used for distributed computation of the private RSA key,as well as for the construction of distributed variants for the secure signature schemes in the standard model proposed by Gennaro-Halevi-Rabin,Cramer-Shoup and Mames-Joye.In addition,the construction method is a useful supplement to the construction of multi-party protocols over rings.

Forward-Secure Group Signatures from Pairings

To reduce the damage of key exposures, forward-secure group signature schemes have been first proposed by Song. In the forward-secure schemes, a secret key of a group member is updated by a one-way function every interval and the previous secret key is erased. Thus, even if a secret key is exposed, the signatures produced by the secret keys of previous intervals remain secure. Since the previous forward-secure group signature schemes are based on the strong RSA assumption, the signatures are longer than pairing-based group signatures. In addition, the complexity of the key update or signing/verification is O(T), where T is the total number of intervals. In this paper, a forward-secure group signature scheme from pairings is proposed. The complexity of our key update and signing/verification is O(log T).

New RSA-Based (Selectively) Convertible Undeniable Signature Schemes

In this paper, we design and analyze some new and practical (selectively) convertible undeniable signature (SCUS) schemes in both random oracle and standard model, which enjoy several merits over existing schemes in the literature. In particular, we design the first practical RSA-based SCUS schemes secure in the standard model. On the path, we also introduce two moduli RSA assumptions, including the strong twin RSA assumption, which is the RSA symmetry of the strong twin Diffie-Hellman assumption (Eurocrypt'08).

Component Property Based Remote Attestation

PDF HTML阅读 XML下载 导出引用 引用提醒 基于组件属性的远程证明 DOI: 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: Supported by the National High-Tech Research and Development Plan of China under Grant No.2007AA01Z412 (国家高技术研究发展计划(863)) Component Property Based Remote Attestation Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:提出了一个组件级的细粒度属性证明方案,用于向远程依赖方证明用户平台满足某种安全属性.与现有的远程证明方案相比,组件属性远程证明具有一定的语义和属性表述性等优势.该方案不但证明粒度细和扩展性强,而且属性证书的颁发、验证和撤销实现简单;本方案以组件承诺的方法保证属性证明的真实性,采用零知识证明实现平台组件的隐私性.基于强RSA假设,在Random Oracle模型下可被证明是安全的.实现的原型系统实验结果表明,组件属性证明是一种灵活、实用、高效的证明,对系统性能没有影响. Abstract:A fine-grained property attestation based on the components is proposed to prove that the user platform satisfies the security property predefined by remote relying party. Compared with other remote attestation schemes, CPBA (component property based attestation) has the advantage of semantic and property expression to some extent. It is not only more fine-grained and extensive, but also easier to implement issuing, verifying and revoking the property certificate. CPBA guarantees the authenticity of attestation by component commitment, and protects the privacy of platform components by zero-knowledge proof. It is proved secure in Random Oracle Model under strong RSA Assumption. The experimental result of its prototype system indicates that CPBA is a flexible, usable, highly efficient attestation, and has no influence on system performance. 参考文献 相似文献 引证文献

On the pseudo-freeness and the CDH assumption

The notion of pseudo-free group was first introduced by Hohenberger (Master’s thesis, EECS Dept., MIT, 2003). Rivest (TCC 2004. LNCS 2951, 505–521, 2004) formalized it and showed that several standard cryptographic assumptions hold on pseudo-free groups, such as the RSA assumption, the strong RSA assumption and the discrete logarithm assumption. Rivest (TCC 2004. LNCS 2951, 505–521, 2004) also proposed some variations of pseudo-free group, and those were formalized by Hirano and Tanaka (Research Reports, Series C: Computer Science, C-239, Tokyo Institute of Technology, 2007). In this paper, we study the relationships among such variations of pseudo-free group. We show that the pseudo-freeness implies the weak pseudo-freeness, and that the pseudo-freeness is equivalent to the pseudo-freeness with generalized exponential expressions. We also show that the computational Diffie-Hellman assumption holds on pseudo-free groups in a slightly varied form.

The RSA Group is Pseudo-Free

We prove, under the strong RSA assumption, that the group of invertible integers modulo the product of two safe primes is pseudo-free. More specifically, no polynomial-time algorithm can output (with non negligible probability) an unsatisfiable system of equations over the free Abelian group generated by the symbols g 1,…,g n , together with a solution modulo the product of two randomly chosen safe primes when g 1,…,g n are instantiated to randomly chosen quadratic residues. Ours is the first provably secure construction of pseudo-free Abelian groups under a standard cryptographic assumption and resolves a conjecture of Rivest (Theory of Cryptography Conference—Proceedings of TCC 2004, LNCS, vol. 2951, pp. 505–521, 2004).

Algebraic Construction for Zero-Knowledge Sets

Zero knowledge sets is a new cryptographic primitive introduced by Micali, Rabin, and Kilian in FOCS 2003. It has been intensively studied recently. However all the existing ZKS schemes follow the basic structure by Micali et al. That is, the schemes employ the Merkle tree as a basic structure and mercurial commitments as the commitment units to nodes of the tree. The proof for any query consists of an authentication chain. We propose in this paper a new algebraic scheme that is completely different from all the existing schemes. Our new scheme is computationally secure under the standard strong RSA assumption. Neither mercurial commitments nor tree structure is used in the new construction. In fact, the prover in our construction commits the desired set without any trapdoor information, which is another key important difference from the previous approaches.

Short Signatures Without Random Oracles and the SDH Assumption in Bilinear Groups

We describe a short signature scheme that is strongly existentially unforgeable under an adaptive chosen message attack in the standard security model. Our construction works in groups equipped with an efficient bilinear map, or, more generally, an algorithm for the Decision Diffie-Hellman problem. The security of our scheme depends on a new intractability assumption we call Strong Diffie-Hellman (SDH), by analogy to the Strong RSA assumption with which it shares many properties. Signature generation in our system is fast and the resulting signatures are as short as DSA signatures for comparable security. We give a tight reduction proving that our scheme is secure in any group in which the SDH assumption holds, without relying on the random oracle model.