Universally Composable Security Research Articles

Cloud-SMPC: two-round multilinear maps secure multiparty computation based on LWE assumption

Cloud computing has data leakage from all parties, security protection of private data, and existing solutions do not provide a trade-off between security and overhead. With distributed data communication due to data barriers, information interaction security and data computation security have become challenges for secure computing. Combining cloud computing with secure multiparty computation can provide a higher level of data protection while maintaining the benefits of cloud computing. In this case, data can be stored in the cloud and computed through SMPC protocols, thus protecting the privacy and security of the data. However, multiple rounds of information interaction are often required, increasing the communication overhead, and the security strength is limited by the hardness assumption. In this paper, we work to achieve an optimal setting of the number of rounds in secure multi-party computation on the cloud to achieve a sublinear communication overhead and improve the security concept. A 2-round SMPC protocol is constructed in the framework of Universally Composable (UC). A 2-round SMPC protocol is constructed that uses multilinear maps based on the Learning from Errors (LWE) assumption. The participant encodes the input and sends it via broadcast to reduce the interaction, homomorphic computational encoding information for secure access to computational data and secure the SMPC protocol through UC security. This paper extends the participants to multiple parties, reduces the communication rounds to 2, the protocol achieves sublinear communication overhead in poly polynomial time, smaller setup size to poly(k), and static security is achieved.

Certified Randomness from Untrusted Sources and Uncharacterized Measurements.

Generating random numbers plays an important role in many scientific applications. Compared to pseudorandom number generators, a quantum device is capable of generating true random numbers by the laws of quantum mechanics. However, information-theoretical secure random numbers are regularly based on a perfect device model, which may deviate from a real-world device. To close this gap, we propose a quantum random number generation protocol and experimentally demonstrate it. In our protocol, we make no assumptions about the source. Some reasonable assumptions on the trusted two-dimensional measurement are needed, but we do not require a detailed characterization. Even if considering the most general quantum attack and using the general sources, we achieve a randomness generation rate of over 1Mbps with a universal composable security parameter of 10^{-10}.

Achieving One-Round Password-Based Authenticated Key Exchange over Lattices

<i>Password-based authenticated key exchange</i> (<inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq1-2939836.gif"/></alternatives></inline-formula>) protocol, a widely used authentication mechanism to realize secure communication, allows protocol participants to establish a high-entropy session key by pre-sharing a low-entropy password. An open challenge in <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq2-2939836.gif"/></alternatives></inline-formula> is how to design a quantum-resistant round-optimal <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq3-2939836.gif"/></alternatives></inline-formula>. To solve this challenge, lattice-based cryptography is a promising candidate for post-quantum cryptography. In addition, Katz and Vaikuntanathan (ASIACRYPT&#x2019;09) design the first <i>three-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq4-2939836.gif"/></alternatives></inline-formula> protocol by leveraging the smooth projective hash function (<inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq5-2939836.gif"/></alternatives></inline-formula>) over lattices. Subsequently, Zhang and Yu (AISACRYPT&#x2019;17) optimized Katz-Vaikuntanathan&#x2019;s approximate <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq6-2939836.gif"/></alternatives></inline-formula> via a splittable public key encryption. They then constructed a <i>two-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq7-2939836.gif"/></alternatives></inline-formula> by using the simulation-sound non-interactive zero-knowledge (NIZK) proofs, but how to construct a lattice-based simulation-sound NIZK remains an open research question. In other words, how to design a one-round <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq8-2939836.gif"/></alternatives></inline-formula> via an efficient lattice-based <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq9-2939836.gif"/></alternatives></inline-formula> still remains a challenge. In this work, we attempt to fill this gap by proposing a lattice-based <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq10-2939836.gif"/></alternatives></inline-formula> with adaptive smoothness. We then obtain a <i>one-round</i> <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq11-2939836.gif"/></alternatives></inline-formula> protocol over lattices with rigorous security analysis by integrating the proposed <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq12-2939836.gif"/></alternatives></inline-formula> into the one-round framework proposed by Katz and Vaikuntananthan (TCC&#x2019;11). Furthermore, we explore the possibilities of achieving two-round <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq13-2939836.gif"/></alternatives></inline-formula> and universal composable (UC) security from our <inline-formula><tex-math notation="LaTeX">$\mathsf {SPHF}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">SPHF</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq14-2939836.gif"/></alternatives></inline-formula>, and show the potential application of our <inline-formula><tex-math notation="LaTeX">$\mathsf {PAKE}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">PAKE</mml:mi></mml:math><inline-graphic xlink:href="wang-ieq15-2939836.gif"/></alternatives></inline-formula> in Internet of Things (IoTs) where communication cost is the main consideration.

Continuous-variable source-device-independent quantum key distribution against general attacks

The continuous-variable quantum key distribution with entanglement in the middle, a semi-device-independent protocol, places the source at the untrusted third party between Alice and Bob, and thus has the advantage of high levels of security with the purpose of eliminating the assumptions about the source device. However, previous works considered the collective-attack analysis, which inevitably assumes that the states of the source has an identical and independently distributed (i.i.d) structure, and limits the application of the protocol. To solve this problem, we modify the original protocol by exploiting an energy test to monitor the potential high energy attacks an adversary may use. Our analysis removes the assumptions of the light source and the modified protocol can therefore be called source-device-independent protocol. Moreover, we analyze the security of the continuous-variable source-device-independent quantum key distribution protocol with a homodyne-homodyne structure against general coherent attacks by adapting a state-independent entropic uncertainty relation. The simulation results indicate that, in the universal composable security framework, the protocol can still achieve high key rates against coherent attacks under the condition of achievable block lengths.

Identity-Based Proxy Signcryption Protocol with Universal Composability

Proxy signcryption means that the proxy signcrypter obtains the delegate authorization from the original signcrypter and then signcrypts the specified message on behalf of the original signcrypter. In this paper, we construct an identity-based proxy signcryption protocol (IBPSP) based on the universally composable (UC) framework. In the random oracle model, we prove that this protocol has the semantic security under the gap bilinear Diffie-Hellman and computational Diffie-Hellman assumptions. At the same time, an ideal functionality of the identity-based proxy signcryption protocol is defined in the UC security framework, and we also prove the equivalence between the universally composable identity-based proxy signcryption protocol and its IND-CCA2 and UF-CMA security. Analysis shows this IBPSP has both low computation complexity and semantic security together with UC security.

Composable security analysis of continuous-variable measurement-device-independent quantum key distribution with squeezed states for coherent attacks

Measurement-device-independent quantum key distribution protocol, whose security analysis does not rely on any assumption on the detection system, can immune the attacking against detectors. We give a first composable security analysis for continuous-variable measurement-device-independent quantum key distribution using squeezed states against general coherent attacks. The security analysis is derived based on the entanglement-based scheme considering finite size effect. A version of entropic uncertainty relation is exploited to give a lower bound on the conditional smooth min-entropy by trusting Alice's and Bob's devices. The simulation results indicate that, in the universal composable security framework, the protocol can tolerate 2.5 dB and 6.5 dB channel loss against coherent attacks with direct and reverse reconciliation, respectively.

Fair Efficiency Comparisons of Decoy‐State Quantum Key Distribution Protocols

Taking the schemes based on different formulas of secure key rate as examples, we give a fair comparison between typical protocols under Universal composable (UC) security frame. Through analyzing the relationship of security parameters in post-processing stage and final secure key rate, we achieve the unified quantification between protocols based on Gottesman-Lo-Lutkenhaus-Preskill (GLLP) formula and the ones under UC security. Based on the above research, the impact of different sending lengths and secure parameters on secure key rate is investigated. Besides, we analyze the conditions of fair comparison, and for the first time we give a fair comparison between the protocols based on GLLP formula and smooth entropy. By typical efficiency comparisons, we summarize the way for improving secure key rate in the light intensity choice and the single bit error rate estimation method.

Secure multi-party computation in large networks

We describe scalable protocols for solving the secure multi-party computation (MPC) problem among a significant number of parties. We consider both the synchronous and the asynchronous communication models. In the synchronous setting, our protocol is secure against a static malicious adversary corrupting less than a 1/3 fraction of the parties. In the asynchronous environment, we allow the adversary to corrupt less than a 1/8 fraction of parties. For any deterministic function that can be computed by an arithmetic circuit with m gates, both of our protocols require each party to send a number of messages and perform an amount of computation that is $$\tilde{O}(m/n + \sqrt{n})$$O~(m/n+n). We also show that our protocols provide statistical and universally-composable security. To achieve our asynchronous MPC result, we define the threshold counting problem and present a distributed protocol to solve it in the asynchronous setting. This protocol is load balanced, with computation, communication and latency complexity of $$O(\log {n})$$O(logn), and can also be used for designing other load-balanced applications in the asynchronous communication model.

Universally Composable RFID Mutual Authentication

Universally Composable (UC) framework provides the strongest security notion for designing fully trusted cryptographic protocols, and it is very challenging on applying UC security in the design of RFID mutual authentication protocols. In this paper, we formulate the necessary conditions for achieving UC secure RFID mutual authentication protocols which can be fully trusted in arbitrary environment, and indicate the inadequacy of some existing schemes under the UC framework. We define the ideal functionality for RFID mutual authentication and propose the first UC secure RFID mutual authentication protocol based on public key encryption and certain trusted third parties which can be modeled as functionalities. We prove the security of our protocol under the strongest adversary model assuming both the tags' and readers' corruptions. We also present two (public) key update protocols for the cases of multiple readers: one uses Message Authentication Code (MAC) and the other uses trusted certificates in Public Key Infrastructure (PKI). Furthermore, we address the relations between our UC framework and the zero-knowledge privacy model proposed by Deng et al. [1].

Full Security of Quantum Key Distribution From No-Signaling Constraints

We analyze a cryptographic protocol for generating a distributed secret key from correlations that violate a Bell inequality by a sufficient amount, and prove its security against eavesdroppers, constrained only by the assumption that any information accessible to them must be compatible with the non-signaling principle. The claim holds with respect to the state-of-the-art security definition used in cryptography, known as universally-composable security. The non-signaling assumption only refers to the statistics of measurement outcomes depending on the choices of measurements; hence security is independent of the internal workings of the devices - they do not even need to follow the laws of quantum theory. This is relevant for practice as a correct and complete modeling of realistic devices is generally impossible. The techniques developed are general and can be applied to other Bell inequality-based protocols. In particular, we provide a scheme for estimating Bell-inequality violations when the samples are not independent and identically distributed.

Universal Composability Notion for Functional Encryption Schemes

We have developed an ideal functionality for security requirement of functional encryption schemes. The functionality is needed when we want to show the security of a functional encryption scheme in universal composable (UC) framework. A functionality F fe was developed to represent ideal respond of a functional encryption scheme against any polynomial time active attacker. We show that UC security notion of functional encryption scheme F fe is as strong as fully secure functional encryption in an indistinguishable game with chosen cipher text attack. The proof used a method that showing for any environment algorithm, it can not distinguish ideal world where the attacker play with ideal functionality F fe and real world where the attacker play a fully secure functional encryption scheme.

Research on trust model of universally composable security computation

A trust model capturing some set-up assumptions is necessary to guarantee the existence of Universally Composable(UC) security computation.Little domestic research on the trust model of UC security computation has been made.In this paper,the essential requirement of UC security and its limitation on UC security computation were researched to find out why these set-up assumptions were used.And then overseas representative trust models were analyzed and their merits and demerits were compared respectively.Finally,the research trend in future was pointed out.

Securing wireless mesh networks in a unified security framework with corruption-resilience

Wireless mesh networks (WMN) are expected to be widespread due to their excellent properties like low-cost deployment, easy arrangement and self-organization. Although some proposed security schemes for WMNs with various security objectives have been put forward recently, it is a challenge to employ a uniform cryptography context to achieve resilience to trust authority corruption and maintain trust relationships flexibly among different domains. In this paper, a unified security framework (USF) for multi-domain wireless mesh networks is proposed. The identity-based encryption and the certificateless signature are unified in the proposed cryptography operations utilizing bilinear groups to solve key escrow problem. To ensure secure muliti-hop communication in WMN, the intra and inter domain authentication and key agreement protocols are devised sophisticatedly to achieve perfect forward secrecy and attack-resilience. With the enhanced security properties in the USF scheme, when a trust authority is corrupted, parts of the WMN could be survivable in the local area if proper measures are taken. A formal security proof of the proposed authentication protocols is presented based on Universal Composable security theory. The detailed performance analysis shows that the enhanced security attributes are achieved with reasonable overhead.

Universal composable security of multi-signature schemes

Since up to now the security of multi-signature protocols has only been considered in a single instance, the security of a multi-signature protocol when it is running with many other protocols concurrently was studied in the universal composable security framework. Firstly, the idea functionality of a multi-signature protocol was defined formally. Then, based on Waters' signature scheme, a multi-signature protocol was presented, which was proved to be Unified Communications (UC) secure. Thus, the presented multi-signature protocol can run safely in multi-protocol executing environments, such as Internet.

Using IND-CVA for constructing secure communication

Within the framework of UC (universally composable) security, a general method is presented to construct a secure channel protocol with using IND-CVA (indistinguishability of encryption scheme under ciphertext verification attacks). A channel protocol with using the method first invokes an ideal key-exchange protocol to get a session key, and then computes the messages with an authenticated encryption scheme. The paper shows that a channel protocol is UC secure if and only if the underlying authenticated encryption scheme is both IND-CVA secure and INT-PTXT secure. The condition about secure channel protocol in this paper is much weaker than IND-CCA secure and INT-CTXT secure. The IND-CVA can be presented for describing the privacy requirements of secure channels in detail. Moreover, the method for designing secure channel protocol in the paper reduces the UC security of secure channels, which are measured by action-simulation in the UC security framework, to the security of authenticated encryption schemes, which are measured semantically.

A new approach for UC security concurrent deniable authentication

Deniable authentication protocols allow a sender to authenticate a message for a receiver, in a way which the receiver cannot convince a third party that such authentication ever took place. When we consider an asynchronous multi-party network with open communications and an adversary that can adaptively corrupt as many parties as it wishes, we present a new approach to solve the problem of concurrent deniable authentication within the framework of universally composable (UC) security. We formulate a definition of an ideal functionality for deniable authentication. Our constructions rely on a modification of the verifiably smooth projective hashing (VSPH) with projection key function by trapdoor commitment. Our protocols are forward deniable and UC security against adaptive adversaries in the common reference string model. A new approach implies that security is preserved under concurrent composition of an unbounded number of protocol executions; it implies non-malleability with respect to arbitrary protocols and more. The novelty of our schemes is the use of witness indistinguishable protocols and the security is based on the decisional composite residuosity (DCR) assumption. This new approach is practically relevant as it leads to more efficient protocols and security reductions.

Universally composable anonymous Hash certification model

Ideal function is the fundamental component in the universally composable security model. However, the certification ideal function defined in the universally composable security model realizes the identity authentication by binding identity to messages and the signature, which fails to characterize the special security requirements of anonymous authentication with other kind of certificate. Therefore, inspired by the work of Marten, an anonymous hash certification ideal function and a more universal certificate CA model are proposed in this paper. We define the security requirements and security notions for this model in the framework of universal composable security and prove in the plain model (not in the random-oracle model) that these security notions can be achieved using combinations of a secure digital signature scheme, a symmetrical encryption mechanism, a family of pseudorandom functions, and a family of one-way collision-free hash functions. Considering the limitation of wireless environment and computation ability of wireless devices, this anonymous Hash certification ideal function is realized by using symmetry primitives.

Universally Composable Security Concurrent Deniable Authentication Based on Witness Indistinguishable

A new approach and an idea for exploration are presented to the concurrent deniable authentication based on witness-indistinguishable (WI) within the framework of universally composable (UC) security. A definition of an ideal functionality for deniable authentication is formulated. A new deniable authentication protocol is proposed based on two primitives of the verifiably smooth projective Hashing (VSPH) and non-committing encryptions (NCE). This new approach is practically relevant to VSPH based on the Decisional Diffie-Hellman (DDH) assumption and NCE based on the decisional composite residuosity (DCR) assumption. Compared with a timing constraint and public directory model, simulation of the concurrent protocols is not needed to restrict an adversary capability in a common reference string (CRS) model. The protocols are forward deniable and UC security against adaptive adversaries. Unlike previous proposals with the CCA2 public-key cryptosystem or multi-trapdoor commitments paradigm, the new paradigm leads to more efficient protocols.