Forward-secure identity-based signature: Security notions and construction

The security of traditional identity-based signatures wholly depends on the security of secret keys. Exposure of secret keys requires reissuing all previously assigned signatures. This limitation becomes more obvious today as key exposure is more common with increasing use of mobile and unprotected devices. Under this background, mitigating the damage of key exposure in identity-based signatures is an important problem. To deal with this problem, we propose to integrate forward security into identity-based signatures. In this paper, we firstly formalize the definition and security notions for forward-secure identity-based signature scheme, and then construct an efficient scheme. All parameters in our scheme have, at most, log-squared complexity in terms of the total number of time periods. The scheme is provably secure without random oracles.     

标准模型下可证明安全的入侵容忍公钥加密方案

在传统的公钥加密方案中,一旦解密密钥泄漏,系统的安全性将完全丧失.特别是随着越来越多的加密系统被应用到移动的、安全性低的设备中,密钥泄漏显得难以避免.入侵容忍公钥加密的提出就是为了减小密钥泄漏对加密系统的危害,具有比前向安全加密、密钥隔离加密更强的安全性.在这种体制下,整个生命周期被分割成离散的时间阶段,公钥固定不变,密钥信息分享在解密者和基地中,前者独立完成解密操作,而后者则在每个时间周期中提供一个更新信息来帮助演化解密密钥.此外,每个时间段内有多次密钥刷新的操作,可以刷新解密者的密钥和基密钥.当解密者和基地被入侵时,只要不是同时被入侵,安全性就可以得到保证.即使入侵者同时入侵解密者和基地,也不会影响以前时间段密文的安全性.提出了一个入侵容忍公钥加密方案,所有费用参数关于总共时间段数的复杂性均不超过对数的平方.证明了该方案是标准模型下安全的.这是一个不需要随机预言的可证明安全的入侵容忍公钥加密方案.     

混沌系统在网络保密通信中的应用方法

混沌保密通信是当今研究信息安全的热门课题之一。该文就混沌系统应用于保密通信的基本理论,编码方式和密钥等内容作一简要讨论,并采用一次一密密码机制,用Lorenz系统的混沌输出作为密钥对文本文件进行加密和解密。这种一次一密加密方式具有很强的抗破译性。     

Revocable attribute-based encryption from standard lattices

Attribute-based encryption (ABE) is an attractive extension of public key encryption, which provides fine-grained and role-based access to encrypted data. In its key-policy flavor, the secret key is associated with an access policy and the ciphertext is marked with a set of attributes. In many practical applications, and in order to address scenarios where users become malicious or their secret keys are compromised, it is necessary to design an efficient revocation mechanism for ABE. However, prior works on revocable key-policy ABE schemes are based on classical number-theoretic assumptions, which are vulnerable to quantum attacks. In this work, we propose the first revocable key-policy ABE scheme that offers an efficient revocation mechanism while maintaining fine-grained access control to encrypted data. Our scheme is based on the learning with errors (LWE) problem, which is widely believed to be quantum-resistant. Our scheme supports polynomial-depth policy function and has short secret keys, where the size of the keys depends only on the depth of the supported policy function. Furthermore, we prove that our scheme satisfies selective revocation list security in the standard model under the LWE assumption.     

Full black-box retrievable and accountable identity-based encryption

Accountable identity-based encryption (A-IBE) was proposed to relieve the key escrow problem caused by the fully trustworthy private-key generator (PKG) in the IBE system, where the true generator of private keys or decoder boxes can be traced back to the PKG or related users. Retrievable A-IBE (RA-IBE) enhances the security of A-IBE by providing retrievability to the master secret key of the PKG when more than one private key of the same user are released. RA-IBE strengthens the deterrent effect of A-IBE against the PKG since disclosure of the master secret key could lead to the breakdown of the entire IBE system. However, current RA-IBE schemes only provide retrievability in a white-box model, which limits the ability to support traceability and retrievability on well-formed private keys only. This overlooks the fact that a malicious PKG can easily conceal a private key within a decoder box, making the inserted private key inaccessible. To overcome this limitation, we propose a full black-box RA-IBE scheme, where traceability and retrievability of decoder boxes are provided while the malicious PKG is allowed to access the decryption oracle in the security model simultaneously. We first give the formal definition and security models of full black-box RA-IBE and then present a concrete construction. In our construction, a user interacts with the PKG to obtain its private key and an additional commitment tuple with which the user can retrieve the master secret key of the PKG using a related decoder box generated by the PKG. Finally, we show that the proposed full black-box RA-IBE scheme is secure in the random oracle model.     

CCA2 secure (hierarchical) identity-based parallel key-insulated encryption without random oracles

In order to mitigate the damages of key-exposure, key-insulated encryption introduces a helper key used to periodically update the decryption key. Under the usual circumstances, frequent updating increases the risk of helper key-exposure. Parallel key-insulated encryption (PKIE) supports frequent key updates without increasing the risk of helper key-exposure. In an identity-based cryptosystem, a private key generator (PKG) uses a master secret key to issue private keys to users based on their identities. In this paper, we propose a new identity-based parallel key-insulated encryption (IBPKIE) scheme which achieves IND-ID-KI-CCA2 security without random oracles. Our IBPKIE scheme has short public parameters and a tight reduction with an additive factor.Hierarchical identity-based cryptography was first proposed in 2002. It allows a root PKG to distribute workload by delegating private key generation and entity authentication tasks to lower-level PKGs. In this paper, we formalize the syntax and security model for a hierarchical identity-based parallel key-insulated encryption (HIBPKIE) scheme. We then propose an HIBPKIE scheme with constant size ciphertext, and prove that it achieves IND-ID-KI-CCA2 security without random oracles. To the best of our knowledge, this is the first HIBPKIE scheme up to now.     

Adaptive CCA broadcast encryption with constant-size secret keys and ciphertexts

We consider designing public-key broadcast encryption schemes with constant-size secret keys and ciphertexts, achieving chosen-ciphertext security. We first argue that known CPA-to-CCA transforms currently do not yield such schemes. We then propose a scheme, modifying a previous selective CPA secure proposal by Boneh, Gentry, and Waters. Our scheme has constant-size secret keys and ciphertexts, and we prove that it is selective chosen-ciphertext secure based on standard assumptions. Our scheme has ciphertexts that are shorter than those of the previous CCA secure proposals. Then, we propose a second scheme that provides the functionality of both broadcast encryption and revocation schemes simultaneously using the same set of parameters. Finally, we show that it is possible to prove our first scheme adaptive chosen-ciphertext secure under reasonable extensions of the bilinear Diffie–Hellman exponent and the knowledge-of-exponent assumptions. We prove both of these extended assumptions in the generic group model. Hence, our scheme becomes the first to achieve constant-size secret keys and ciphertexts (both asymptotically optimal) and adaptive chosen-ciphertext security at the same time.     

Intrusion-resilient identity-based signature: Security definition and construction

Traditional identity-based signatures depend on the assumption that secret keys are absolutely secure. Once a secret key is exposed, all signatures associated with this secret key have to be reissued. Therefore, limiting the impact of key exposure in identity-based signature is an important task. In this paper, we propose to integrate the intrusion-resilient security into identity-based signatures to deal with their key exposure problem. Compared with forward-secure identity-based signatures and key-insulated identity-based signatures, our proposal can achieve higher security. The proposed scheme satisfies that signatures in any other time periods are secure even after arbitrarily many compromises of base and signer, as long as the compromises do not happen simultaneously. Furthermore, the intruder cannot generate signatures pertaining to previous time periods, even if she compromises base and signer simultaneously to get all their secret information. The scheme enjoys nice average performance. There are no cost parameters including key setup time, key extract time, base (signer) key update time, base (signer) key refresh time, signing time, verifying time, and signature size, public parameter size, base (signer) storage size having complexity more than O(log T) in terms of the total number of time periods T in this scheme. We also give the security definition of intrusion-resilient identity-based signature scheme and prove that our scheme is secure based on this security definition in the random oracle model assuming CDH problem is hard.     

标准模型下的高效强安全混合加密方案

如何设计标准模型下满足适应性选择密文安全（IND-CCA2）的高效加密方案,是公钥密码学领域的一个重要研究课题。基于判定型双线性Diffie-Hellman问题,提出了一个高效、短公/私钥长度、强安全的,基于对称加密算法、消息认证码算法、密钥分割算法等基础算法的一次一密型混合加密方案,分析了方案的安全性和效率。方案在标准模型下被证明具有IND-CCA2安全性,支持公开的密文完整性验证,与同类方案相比计算效率高。     

基于ID的门限多重秘密共享方案

为了避免现有秘密共享方案中的秘密份额分发机制的不足,结合基于身份(ID)的公钥密码技术,提出了利用参与者私钥作为其主份额的秘密份额分发方法.首先,对Zheng提出的签密方案进行了安全分析,发现其不具备前向保密性,并针对该安全问题,提出了一个改进的签密方案.同时,在所提出的改进方案的基础上,结合基于ID的公钥密码系统,提出了一个新的门限多重秘密共享方案.该方案有效地解决了秘密份额的安全分发问题,不需要秘密分发者和参与者之间事先进行任何信息交互,能够在分发秘密的同时分发秘密份额.该方案还具有前向保密性,即使秘密分发者的私钥被泄漏,也不会影响之前所共享秘密的安全性.因此,所提出的基于身份的秘密共享方案具有更高的安全性和有效性,能够更好地满足应用需求.     

Improvement on Meshram et al.ʼs ID-based cryptographic mechanism

Meshram et al. proposed an ID-based cryptosystem based on the generalized discrete logarithm problem (GDLP) and the integer factorization problem (IFP) in 2012, and their contribution lies in that they firstly proposed an idea to construct the ID-based cryptosystem without using the bilinear pair. This scheme can achieve the security goal of protecting data and prevent the adversary from snooping the encrypted data or the user?s private key. However, our analyses show that their scheme is still incorrect and has a deadlock problem, because the user cannot carry out the encryption process as expected because it is required for the user to own the key authentication center?s private information which is designed to be secret to users. A solution to the deadlock problem is given and an improved scheme is proposed.     

Efficient solution to the millionaires' problem based on asymmetric commutative encryption scheme

Secure multiparty computation is an important scheme in cryptography and can be applied in various real‐life problems. The first secure multiparty computation problem is the millionaires' problem, and its protocol is an important building block. Because of the less efficiency of public key encryption scheme, most existing solutions based on public key cryptography to this problem are inefficient. Thus, a solution based on the symmetric encryption scheme has been proposed. In this paper, we formally analyse the vulnerability of this solution, and propose a new scheme based on the decisional Diffie‐Hellman assumption. Our solution also uses 0‐encoding and 1‐encoding generated by our modified encoding method to reduce the computation cost. We implement the solution based on symmetric encryption scheme and our protocol. Extensive experiments are conducted to evaluate the efficiency of our solution, and the experimental results show that our solution can be much more efficient and be approximately 8000 times faster than the solution based on symmetric encryption scheme for a 32‐bit input and short‐term security. Moreover, our solution is also more efficient than the state‐of‐the‐art solution without precomputation and can also compare well with the state‐of‐the‐art protocol while the bit length of private inputs is large enough.     

Efficient forward secure identity-based shorter signature from lattice

All regular cryptographic schemes rely on the security of the secret key. However, with the explosive use of some relatively insecure mobile devices, the key exposure problem has become more aggravated. In this paper, we propose an efficient forward secure identity-based signature (FSIBS) scheme from lattice assumption, with its security based on the small integer solution problem (SIS) in the random oracle model. Our scheme can guarantee the unforgeability of the past signatures even if the current signing secret key is revealed. Moreover, the signature size and the secret key size of our scheme are unchanged and much shorter. To the best of our knowledge, our construction is the first FSIBS scheme based on lattice which can resist quantum attack. Furthermore, we extend our FSIBS scheme to a forward secure identity-based signature scheme in the standard model.     

Memory leakage-resilient searchable symmetric encryption

Along with the popularization and rapid development of cloud-computing, more and more individuals and enterprises choose to store their data in cloud servers. However, in order to protect data privacy and deter illegal accesses, the data owner has to encrypt his data before outsourcing it to the cloud server. In this situation, searchable encryption, especially searchable symmetric encryption (SSE) has become one of the most important techniques in cloud-computing area. In the last few years, researchers have presented many secure and efficient SSE schemes. Like traditional encryption, the security of all existing SSE schemes are based on the assumption that the data owner holds a secret key that is unknown to the adversary. Unfortunately, in practice, attackers are often able to obtain some or even all of the data owner’s secret keys by a great variety of inexpensive and fast side channel attacks. Facing such attacks, all existing SSE schemes are no longer secure. In this paper, we investigate how to construct secure SSE schemes with the presence of memory attack. We firstly propose the formal definition of memory leakage-resilient searchable symmetric encryption (MLR-SSE, for short). Based on that, we present one adaptive MLR-SSE scheme and one efficient non-adaptive dynamic MLR-SSE scheme based on physical unclonable functions (PUFs), and formally prove their security in terms of our security definitions.     

A novel image cipher based on mixed transformed logistic maps

In this paper, a novel secure cryptosystem is proposed for direct encryption of color images, based on transformed logistic maps. The proposed cipher provides good confusion and diffusion properties that ensures extremely high security due to the mixing of colors pixels. The encryption scheme makes use of six odd secret keys and chaotic keys for each operation. The operations include initial permutation of all pixels with six odd keys, nonlinear diffusion using first chaotic key, xoring the second chaotic key with resultant values and zig-zag diffusion with third chaotic key. The proposed scheme supports key sizes ranging from 192 to 400 bits. The security and performance of the proposed image encryption technique have been analysed thoroughly using statistical analysis, key sensitivity analysis, differential analysis, key space analysis, entropy analysis and performance analysis. Results of the various types of analyses are showing that the proposed image encryption technique is more secure and fast and hence suitable for the real-time applications.     

基于仲裁的SM9标识加密算法

SM9-IBE是我国于2016年发布的标识加密算法行业标准.标识加密算法以用户的标识(如邮件地址、身份证号等)作为公钥,从而降低系统管理用户密钥的复杂性.然而,标识加密算法的密钥撤销和更新问题却变得更加困难.此外,SM9算法的结构特殊使得已有技术无法完全适用于该算法.为此,本文提出一种基于仲裁的SM9标识加密算法,可快...     

An ID-based cryptographic mechanisms based on GDLP and IFP

In 1984, Shamir introduced the concept of an identity-based cryptosystem. In this system, each user needs to visit a key authentication center (KAC) and identify himself before joining a communication network. Once a user is accepted, the KAC will provide him with a secret key. In this way, if a user wants to communicate with others, he only needs to know the identity of his communication partner and the public key of the KAC. There is no public file required in this system. However, Shamir did not succeed in constructing an identity-based cryptosystem, but only in constructing an identity-based signature scheme. In this paper, we propose an ID-based cryptosystem under the security assumptions of the generalized discrete logarithm problem and integer factorization problem. We consider the security against a conspiracy of some entities in the proposed system and show the possibility of establishing a more secure system.     

标准模型下可证安全的无证书全同态加密体制

针对现有全同态加密体制普遍存在的公钥尺寸大的缺陷,结合无证书公钥加密的思想,提出一种无证书全同态加密体制设计方案,无需对公钥进行身份认证,因而有效提高密码系统的整体应用效率。体制利用满秩差分矩阵实现身份信息的嵌入,摆脱了对于哈希函数的依赖,因而在安全性证明中无需引入随机谕示假设;借助一对彼此对偶的正态分布采样函数实现部分私钥的提取,进而结合容错学习问题实例生成体制私钥;通过双重加密使服务器失去对用户密文进行解密的能力,从而杜绝密钥托管问题。体制的安全性在标准模型下归约到容错学习问题的难解性。     

Secure key management scheme for dynamic hierarchical access control based on ECC

An access control mechanism in a user hierarchy is used to provide the management of sensitive information for authorized users. The users and their own information can be organized into a number of disjoint sets of security classes according to their responsibilities. Each security class in a user hierarchy is assigned an encryption key and can derive the encryption keys of all lower security classes according to predefined partially ordered relation. In 2006, Jeng and Wang proposed an efficient key management scheme based on elliptic curve cryptosystems. This paper, however, pointed out that Jeng-Wang scheme is vulnerable to the so-called compromising attack that the secret keys of some security classes can be compromised by any adversary if some public information modified. We further proposed a secure key management scheme based on elliptic curve cryptosystems to eliminate the pointed out the security leak and provide better security requirements. As compared with Jeng and Wang's scheme (Jeng and Wang, 2006), the proposed scheme has the following properties. (i) It is simple to execute the key generation and key derivation phases. (ii) It is easily to address dynamic access control when a security class is added into or deleted from the hierarchy. (iii) It is secure against some potential attacks. (iv) The required storage of the public/secret parameters is constant.     

可证明安全的多接收者公钥加密方案设计与分析

针对现有安全广播协议密钥分发效率较低的问题,提出了一种通过多接收者公钥加密实现安全广播的方法.以Shamir的门限秘密共享方案为设计基础,首先提出了一个基于椭圆曲线上双线性变换的具有抗不可区分选择明文攻击(IND-CPA)安全性的多接收者公钥加密方案,然后对所提方案进行安全扩展,在此基础上最终提出了一个具有抗不可区分自适应选择密文攻击(IND-CCA2)安全性的多接收者公钥加密方案.基于双线性判定Diffie- Hellman假设和双线性间隙Diffie-Hellman假设,对上述所声称的IND-CPA安全性和IND-CCA2安全性进行了证明.同时,对方案的正确性及性能等进行了分析和证明.分析发现,该方案是一个安全、有效的公钥加密方案.由一个加密密钥所加密的密文可以被多个解密密钥解密而得到其所对应的明文,这使得该方案具有非常重要的应用,尤其是可以用来实现安全广播,以便在不安全的、开放的网络环境中安全地广播敏感信息.