Traditional Public Key Cryptosystems Research Articles

Efficient Algebraic Method for Testing the Invertibility of Finite State Machines

The emergence of new embedded system technologies, such as IoT, requires the design of new lightweight cryptosystems to meet different hardware restrictions. In this context, the concept of Finite State Machines (FSMs) can offer a robust solution when using cryptosystems based on finite automata, known as FAPKC (Finite Automaton Public Key Cryptosystems), introduced by Renji Tao. These cryptosystems have been proposed as alternatives to traditional public key cryptosystems, such as RSA. They are based on composing two private keys, which are two FSMs M1 and M2 with the property of invertibility with finite delay to obtain the composed FSM M=M1oM2, which is the public key. The invert process (factorizing) is hard to compute. Unfortunately, these cryptosystems have not really been adopted in real-world applications, and this is mainly due to the lack of profound studies on the FAPKC key space and a random generator program. In this paper, we first introduce an efficient algebraic method based on the notion of a testing table to compute the delay of invertibility of an FSM. Then, we carry out a statistical study on the number of invertible FSMs with finite delay by varying the number of states as well as the number of output symbols. This allows us to estimate the landscape of the space of invertible FSMs, which is considered a first step toward the design of a random generator.

A Novel High-Efficiency Password Authentication and Key Agreement Protocol for Mobile Client-Server

With the development of wireless technology, people increasingly rely on mobile devices. Since most mobile devices transmit sensitive information via insecure public channels, it is important to design multiauthentication key agreement protocols for security protection. Traditional scholars tend to use traditional public-key cryptosystems (PKCs) in their protocols to improve security. High-cost operations (e.g., elliptic curve point multiplication and bilinear pairing) were widely used in their scheme but were not suitable for mobile devices because of limited computing resources. In this study, we designed a novel high-efficiency multiauthentication and key agreement protocol and demonstrate its security in the random oracle model. Compared with other protocols, our proposed scheme only uses string concatenation operations, one-way hash functions, and XOR operations. In addition, our protocol requires much fewer computing resources to achieve the same level of security.

Divide-and-Conquer Template Attack on Scloud

Since shor proposed the quantum algorithm, the traditional public key cryptosystem is facing the risk of being breached. To address this issue, Post-Quantum Cryptography (PQC), also known as Anti-Quantum Cryptography, has been developed. Among the various PQC techniques, lattice-based cryptography has emerged as a significant area of research due to its many advantages. This paper studies the leakage of post quantum cryptography cloud on physical devices. Discovered that the matrix calculation operation of the Scloud algorithm has an impact on key security. Based on the characteristics of the curve, we propose a divide and conquer template attack method and introduce convolutional neural network technology for template construction. On the Cortex-M3 board, we have demonstrated that the proposed attack can effectively recover the key.

A Flexible and High-Performance Lattice-Based Post-Quantum Crypto Secure Coprocessor

Progress of quantum computing technology seriously threaten the industrial information security based on traditional public-key cryptosystem. Thus, the cryptosystem with anti-quantum attack characteristics is gradually becoming a significant research in the security field. In this article, a flexible and high-performance secure coprocessor is designed for security in industrial processes, which can execute the post-quantum cryptographic algorithm Saber efficiently. Custom instruction set and arithmetic accelerators are proposed to effectively optimize the flexibility of system architecture, and improve the performance of calculation. The hardware implementation results show that the maximum operating frequency of the coprocessor can reach 345 MHz. Compared with related state-of-the-art works, it achieves the highest operating frequency on the same Xilinx UltraScale+ FPGA platform, performing the encryption and decryption operations within 13.5 and 15.4 <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">μ</i> s, respectively. Meanwhile, this article achieves 1.7/3.1/5.9× area-time product improvements in look-up table flip-flop block memory storage with good flexibility.

Pairing-free certificateless blind signature scheme for smart grid

The smart grid is an emerging power system that can realize the information exchange between users and power companies in two-way communication and adjust power companies’ power supply according to the real-time power requests from smart meters on the users’ side. However, since malicious attackers can eavesdrop on two-way communication to collect and transmit information, they may leak users’ information. Therefore, this paper proposes a new certificateless blind signature (CLBS) scheme with batch verification function and improves a power request system model for the smart grid to protect users’ privacy. In addition, the proposed CLBS scheme simplifies the certificate management process in the traditional public key cryptosystem and eliminates the hidden key escrow in the identity-based public key cryptosystem. The unforgeability of the scheme is proved through the random oracle model, and the scheme’s security can be reduced to the intractability of the elliptic curve discrete logarithm problem (ECDLP). The analysis results show that our scheme does not use the time-consuming bilinear pairing operation, and has obvious advantages in computing performance compared with the existing signature schemes.

Traditional Public-Key Cryptosystems and Elliptic Curve Cryptography

The need to establish safer communication channels in a world where technological development is progressing in leaps and bounds is indispensable. Thus, implementing cryptographic algorithms, which are more complex to compromise, improves the possibilities of securing our sensitive data. In this paper, the authors analyze the algorithmic foundations and perform a comparative analysis of the traditional public-key cryptographic algorithms (e.g., RSA, ElGamal, Schnorr, DSA) and elliptic curve cryptography with NIST recommended curves. In the study, they focus on six different security strengths: 80-, 96-, 112-, 128-, 192-, and 256-bit key sizes. Moreover, this study provides a benchmark among different curves (NIST, SEC2, and IEFT Brainpool) that can be used with various security levels. The authors study and compare the characteristics and performance of the traditional asymmetric algorithms and the elliptic curve algorithms for information security. The results obtained in this study will be graphically visualized through statistical graphs and tables with quantification response times.

Proficient and Safe Token with Secret and Public Keys Sharing Algorithm for Preventing Cryptographic Key Leakage in Wireless Sensor Network

Sensor devices in the Wireless Sensor Network (WSN) are commonly subjected to various forms of attacks, such as flood attacks, eavesdropping attacks, etc. When an attacker compromises a sensor device, the sensor device's data contents become non-confidential and are grabbed by the attacker, putting the entire network at risk. As a result, to prevent key leaks in WSN networks, this paper proposes a Token with Secret and Public Keys Sharing (TSP-KS) algorithm. In the existence of attackers, cryptography is used to provide secure communication. A traditional public-key cryptosystem is appropriate in cryptography since it does not need the sender and receiver to supply the same secret to communicate without risk. However, they frequently rely on complex mathematical calculations, making them far less capable than equivalent symmetric-key cryptosystems. The high cost of encrypting long messages with public-key cryptography could be problematic in a wide range of applications. A hybrid system deals with it using a combination of the two. In WSN, Admin creates a token, a secret key, a public key, and a private key. Here, the token is used for access control in sensor devices and the administrator, the secret and public keys are utilized for packet encryption in sensor devices and the base station, and the private key is utilized for decryption in the administrator. Admin shares token with secret and public key for sensor devices and base station for encryption purposes. As a result, the TSP-KS algorithm was utilized to securely share these token with secret and public keys for sensor devices and base station over a distributed way. Experimental results demonstrate that the TSP-KS algorithm securely shares a token with a secret and public key.

Quantum Secure Communication Between Service Provider and Sim

In resource-constrained devices such as Subscriber Identity Module (SIM), the possibility of using authentication and key exchange methods, which include the mutual verification of two parties to ensure the security of communication, provides a significant advantage. As the cost efficient computations may not be efficiently performed on resource-constrained devices, security is the main problem for SIMs. With the advancing technology and the use of quantum computers, it is predicted that this may lead to threats. It is a well-known fact that security on traditional public key cryptosystems will become vulnerable by using quantum computers due to Shor&#x2019;s algorithm. In this paper, two different resistant to quantum attacks structures are proposed to ensure secure communication between SIM and service providers. In the proposed methods, Advanced Encryption Standard (AES-256) is used for communication with resource-constrained devices, and N-th degree Truncated polynomial Ring Units (NTRU) encryption system is used for communication with servers. Two methods are proposed, one with the private key and one without the private key in the production phase. This protocol provides authentication, data privacy and integrity for post-quantum SIM cards. The proposed method is inspired by the FLAT (Federated Lightweight Authentication) protocol. However, the main difference from the FLAT protocol is that it has more nodes and is resistant to quantum attacks.

PSCPAC: Post-quantum secure certificateless public auditing scheme in cloud storage

To reduce the local storage burden and enjoy the conveniently ubiquitous access, an increasing number of individuals and enterprises prefer to outsource their data to the cloud server. Due to the loss of physical control over data, how to guarantee the cloud server stores user’s data honestly becomes an important security challenge. Meanwhile, most of existing public auditing schemes based on traditional public key cryptosystem either suffer from bearing the heavy burden of certificate management or possess an inherent key escrow drawback. Even worse, with the advent of powerful quantum computers, most of them could be cracked quickly by a large-scale quantum computer in polynomial time in the near future. To this end, we propose a novel post-quantum secure certificateless public auditing scheme in cloud storage (PSCPAC) from lattice assumptions. Compared with the existing schemes, our novel scheme enjoys the following promising merits: (1) removing the requirement for complicated certificate management in traditional PKI-based public auditing schemes; (2) eliminating the inherent key escrow problem in ID-based public auditing schemes; (3) providing resistance against quantum computers attacks. Correctness, security and performance analysis demonstrate that PSCPAC is provably secure, highly efficient and more practical for post-quantum security in cloud storage public auditing.

Identity-based Data Possession Verification Scheme for Multi-Replica Storage in Cloud

In the cloud storage environment, how to efficiently and dynamically complete the integrity verification of multi-user and multi-replica data is a challenging problem. Based on the bilinear mapping signature mechanism and the multi-branch authentication tree, we propose an identity-based integrity verification scheme of multi-replica data for cloud, which solves the problem of large public key storage and management overhead in signature algorithm based on traditional public key cryptosystems. The proof shows that our scheme satisfies the robustness and has the function of protecting privacy. The results of analysis indicate that, compared with the existing similar schemes, our scheme has higher communication efficiency and computing performance.

A key-escrow free identity-based signature scheme without requirement of a secure channel in the private key issuance phase

Identity-based cryptosystem (IBC) provides us the simplest key management procedures over traditional public key cryptosystem (PKC) as it eliminates the need for certificates of PKC. Hence, no certificate management activities are involved in IBC. However, there are two major drawbacks with the identity-based cryptosystem. One is the key-escrow problem and the other one is the necessity of a channel which is secure for the transmission of the private key, generated by a trusted centre called key generation centre (KGC). In this work, we propose an identity-based signature scheme, fitted in an existing established variant IBC model. The proposed scheme avoids the necessity of the secure channel as well as it is key-escrow free. The proposed scheme is constructed using bilinear pairings and based on the blinding-binding technique.

Secure Route-Obfuscation Mechanism with Information-Theoretic Security for Internet of Things.

As accessibility of networked devices becomes more and more ubiquitous, groundbreaking applications of the Internet of Things (IoT) find their place in many aspects of our society. The exploitation of these devices is the main reason for the cyberattacks in IoT networks. Security design is still an open problem and a crucial step in making IoT applications successful. In dicey environments, such as e-health, smart grid, and smart cities, real-time commands must reach the end devices in the scale of milliseconds. Traditional public-key cryptosystem, albeit necessary in the context of general Internet security, falls short in establishing new session keys in the scale of milliseconds for critical messages. In this paper, a systematic perspective for securing IoT communication, specifically satisfying the real-time constraint against certain adversaries in realistic settings. First, at the network layer, we propose a secret random route computation scheme using the software-defined network (SDN) based on a capability scheme using the network actions. The computed routes are random in the eyes of the eavesdropper. Second, at the application layer, the source breaks command messages into secret shares and sends them through the network to the destination. Only the legitimate destination device can reconstruct the command. The secret sharing scheme is efficient compared to PKI and comes with information-theoretic security against adversaries. Our proof formalizes the notion of security of the proposed scheme, and our simulations validate our design.

An efficient certificateless public auditing scheme in cloud storage

AbstractCloud storage is a mode of online storage in which data are stored on multiple virtual servers usually hosted by third parties. Cloud service providers manage and operate data storage as services. The major concern in cloud storage is the integrity of outsourced data. Many public auditing schemes which authorize the third party auditor (TPA) to check the integrity of outsourced data have been proposed. However, most of them are based on traditional public key cryptosystems. This paper proposes an efficient certificateless public auditing Scheme (CL‐PAS) in cloud storage. In the process of challenge and auditing, CL‐PAS ensures that malicious cloud servers cannot forge auditing evidences to deceive TPA to pass the verification, and prevents curious TPA from recovering original data from auditing evidences. So it strengthens privacy preserving. Security analysis shows that CL‐PAS scheme meets the predetermined security requirements. The simulation and performance analysis results show that, compared with similar schemes, CL‐PAS scheme has the higher efficiency.

Novel efficient identity-based signature on lattices

With the rapid development of electronic information technology, digital signature has become an indispensable part of our lives. Traditional public key certificate cryptosystems cannot overcome the limitations of certificate management. Identity-based cryptosystems can avoid the certificate management issues. The development of quantum computers has brought serious challenges to traditional cryptography. Post-quantum cryptography research is imperative. At present, almost all post-quantum identity-based signature (IBS) schemes are constructed using Gaussian sampling or trapdoor technologies. However, these two technologies have a great impact on computational efficiency. To overcome this problem, we construct an IBS scheme on lattices by employing Lyubashevsky’s signature scheme. Based on the shortest vector problem on lattices, our scheme does not use Gaussian sampling or trapdoor technologies. In the random oracle model, it is proved that our scheme is strongly unforgeable against adaptive chosen messages and identity attacks. The security level of our scheme is strongly unforgeable, which is a higher level than the existential unforgeability of other schemes. Compared with other efficient schemes, our scheme has advantages in computation complexity and security.

Adaptively secure certificate-based broadcast encryption and its application to cloud storage service

The existing public key broadcast encryption schemes are mainly constructed in identity-based cryptosystem, which bears the inherent problems of key escrow and key distribution. The certificate-based encryption mechanism can effectively address the problems in identity-based cryptosystem. Meanwhile, it simplifies the certificate revocation issue for traditional public key cryptosystem. Inspired by the idea of certificate-based encryption, we put forward the new primitive certificate-based broadcast encryption as well as its formal definition and security model. In virtue of prime order bilinear groups, we present an instantiation scheme of certificate-based broadcast encryption. To our best knowledge, the proposed scheme is the first adaptively secure scheme for certificate-based broadcast encryption in the standard model against chosen-ciphertext attack. Compared with the previous work, our scheme has advantages in the respects of computation cost as well as security properties. Furthermore, we present an application scenario of the proposed scheme for data access control in cloud storage service.

Anonymous Certificate-Based Broadcast Encryption With Personalized Messages

Broadcast encryption with personalized messages (BEPM) is a newly proposed cryptographic primitive, which supports a broadcaster to deliver the common encrypted broadcast message to a group of authorized users. It also supports a broadcaster to deliver the personalized messages to the individual authorized users simultaneously. However, none of the existing BEPM schemes consider the anonymity of authorized users, which is a crucial security requirement for many BEPM application scenarios. Besides, the previous studies on BEPM only achieve security against chosen-plaintext attack adversaries. Certificate-based cryptosystem gives a viable way to construct more secure and efficient BEPM schemes. We propose the new concept of anonymous certificate-based broadcast encryption with personalized messages (ANON-CBBE-PM). Subsequently, we illustrate the formal definition and the security model of ANON-CBBE-PM. Furthermore, we present an ANON-CBBE-PM scheme, which solves key escrow problem in identity-based cryptosystem and certificate management problem in traditional public key cryptosystem. Compared with the existing BEPM schemes, the proposed scheme not only protects the privacy of authorized users, but also has advantage in performance. To be more specific, the lengths of the user secret key and the system public parameters, as well as the cost for decryption are constant. For those BEPM applications with a multitude of users whose computing ability is limited, the proposed scheme is more practical. In addition, our scheme simultaneously achieves anonymity and confidentiality under adaptive chosen-ciphertext attack in the standard model.

Auxiliary graph based routing, wavelength, and time-slot assignment in metro quantum optical networks with a novel node structure.

Nowadays, critical sectors in government, finance, and military are facing increasingly high security challenges. However, traditional public-key crypto-systems based on computational complexity are likely to suffer from upgrade computational power. Quantum key distribution (QKD) is a promising technology to effectively address the challenge by providing secret keys due to the laws of quantum physics. Limited by the transmission distance of quantum communications, remote parties have to share secret keys by exchanging keys through the trusted relay nodes hop by hop. However, if relaying hop by hop is still used in metro quantum-optical networks (MQON), a large amount of key resources will be wasted since the distance between any two nodes is short. Therefore, the problem of how to distribute quantum keys with lower waste of key resources over MQON is urgent. In order to solve this problem, we design a novel quantum node structure that is able to bypass itself. Also, by extending the connectivity graph, auxiliary graphs are constructed to describe the adjacency of quantum nodes in different levels influenced by the physical distance. Based on the novel node, two routing, wavelength and time-slot assignment algorithms are proposed, in which some middle nodes can be bypassed to reduce the resource consumption as long as the distance between the two parties meets the requirement of quantum key distribution. Simulations have been conducted to verify the performance of the proposed algorithms in terms of blocking probability, resource utilization, number of bypassed nodes, and security rate per service. Numerical results illustrate that our algorithms perform better on resource utilization than a traditional scheme without bypass. Furthermore, a tradeoff between the keys saved and blocking probability is analyzed and discussed in our paper.

CCA-Secure and Revocable Certificateless Encryption with Ciphertext Evolution

Certificateless cryptosystems have attracted great interests in cryptographic research since its invention. Because compared with traditional public key cryptosystems or identity-based cryptosystems, they could not only simplify the certificate management, but also alleviate the key escrow problem. In certificateless cryptosystems, user revocation is a challenging issue. To address this issue, one popular method is to update the key via public channels. However, most of the existing schemes in this approach are impractical because of the following two shortcomings. Firstly, the user needs to maintain a list of decryption keys, but the size of the list will keep increasing. Secondly, the revoked user can still recover the plaintexts of the encrypted data prior to revocation, and this is a particular threat in some applications. To solve these problems, this paper presents revocable certificateless encryption with ciphertext evolution. We give a generic construction and then describe how it can be initialized concretely. In our proposed scheme, the user only needs to keep one decryption key, and once a user is revoked, it can no longer decrypt any ciphertext in the server. Moreover, the IND-CCA security model is defined against three types of attacks. And our schemes are formally proved to satisfy these security requirements.

Hyper Elliptical Curve Cryptography (Hecc) For Cloud

This system provides an insight into developing a distributed system which is secure, robust and user friendly. This thesis suggests a design and implementation of a digital envelope that combines the hashing algorithm of MD5, the symmetric key algorithm of AES and the asymmetric key algorithm of Hyper Elliptic Curve. A hybrid algorithm is designed, combining the best of both AES and ECC over GF(p) cryptography. The MD5 hash algorithm is adopted to ensure integrity of the data. Cryptography (HECC). This paper discusses securing the data in clouds through implementing the key for encryption and decryption using hyper elliptical curve cryptography. The focus is on Advanced Encryption Standard (AES), the most commonly used secret key cryptographic algorithm, and Hyper Elliptic Curve Cryptography (HECC), public key cryptographic algorithms which have gained popularity in the recent years and are replacing traditional public key cryptosystems, such as RSA and ECC. Such techniques are necessary in order to use high security cryptographic algorithms in real world applications.

A hierarchical identity-based security for delay tolerant networks using lattice-based cryptography

Routing and secure communication are important concerns in Delay Tolerant Networks (DTNs). Previously designed security schemes utilize traditional public key cryptosystems for entity and data security that provide security under some hard problems like integer factorization and discrete logarithmic problems. These algorithms are vulnerable to Quantum attacks. In this paper lattice based cryptosystem has been used first time for DTN security. Lattice based cryptosystems utilize post-quantum cryptographic algorithms which are unbreakable by quantum attacks. First we present a novel Hierarchical structure for DTN having intracluster and intercluster communications. Then, we propose a security design to provide end-to-end security to DTN application data using lattice based cryptographic signature and encryption algorithms, secure under LWE hard problem over lattices. For securing intracluster and intercluster communication, three new schemes have been proposed: (i) Lattice based hierarchical identity-based key agreement scheme, based on lattice based Diffie-Hellman key agreement protocol, secure under LWE assumption but adapted to hierarchical structure. (ii) To derive new session keys, i.e. keys for new joining nodes and for key refreshment, a new lattice based hierarchical identity-based key update scheme has been proposed, which is based on Singh et al.’s lattice based forward secure identity-based encryption algorithm, (iii) A lattice based non-interactive key agreement scheme, based on schemes proposed by Agrawal et al. and Singh et al., has been proposed for generating a secret key for two communicating nodes in different clusters. This design can effectively resist man-in-the-middle attack, replay attack, dictionary attack, and parallel session attack and maintains forward and backward secrecy.