Forgery and counterfeiting are emerging as serious security risks in low-cost pervasive computing devices. These devices lack the computational, storage, power, and communication resources necessary for most cryptographic authentication schemes. Surprisingly, low-cost pervasive devices like Radio Frequency Identification (RFID) tags share similar capabilities with another weak computing device: people.

These similarities motivate the adoption of techniques from human-computer security to the pervasive computing setting. This paper analyzes a particular human-to-computer authentication protocol designed by Hopper and Blum (HB), and shows it to be practical for low-cost pervasive devices. We offer an improved, concrete proof of security for the HB protocol against passive adversaries.

This paper also offers a new, augmented version of the HB protocol, named HB+, that is secure against active adversaries. The HB+ protocol is a novel, symmetric authentication protocol with a simple, low-cost implementation. We prove the security of the HB+ protocol against active adversaries based on the hardness of the Learning Parity with Noise (LPN) problem.

/pdf/authenticating-pervasive-devices-with-human-protocols-2wyr5tc06p.pdf

Authenticating pervasive devices with human protocols

One interesting and important challenge for the cryptologic community is that of providing secure authentication and identification for unassisted humans. There are a range of protocols for secure identification which require various forms of trusted hardware or software, aimed at protecting privacy and financial assets. But how do we verify our identity, securely, when we don't have or don't trust our smart card, palmtop, or laptop?

In this paper, we provide definitions of what we believe to be reasonable goals for secure human identification. We demonstrate that existing solutions do not meet these reasonable definitions. Finally, we provide solutions which demonstrate the feasibility of the security conditions attached to our definitions, but which are impractical for use by humans.

/pdf/secure-human-identification-protocols-1vs9qsbror.pdf

Secure Human Identification Protocols

A proxy signature scheme permits an entity to delegate its signing rights to another. These schemes have been suggested for use in numerous applications, particularly in distributed computing. Before our work (Boldyreva et al. in Cryptology ePrint Archive, Report 2003/096, 2003) appeared, no precise definitions or proven-secure schemes had been provided. In this paper, we formalize a notion of security for proxy signature schemes and present provably-secure schemes. We analyze the security of the well-known delegation-by-certificate scheme and show that after some slight but important modifications, the resulting scheme is secure, assuming the underlying standard signature scheme is secure. We then show that employment of aggregate signature schemes permits bandwidth savings. Finally, we analyze the proxy signature scheme of Kim, Park and Won, which offers important performance benefits. We propose modifications to this scheme which preserve its efficiency and yield a proxy signature scheme that is provably secure in the random-oracle model, under the discrete-logarithm assumption.

/pdf/secure-proxy-signature-schemes-for-delegation-of-signing-4r2zmypa5d.pdf

Secure Proxy Signature Schemes for Delegation of Signing Rights

An efficient nonrepudiable threshold proxy signature scheme with known signers

A (t, n) threshold proxy signature scheme allows t or more proxy signers from a designated group of n proxy signers to sign messages on behalf of an original signer. The authors review both Zhang's threshold proxy signature scheme and Kim's threshold proxy signature scheme. They show that Zhang's scheme suffers from some weaknesses and Kim's scheme suffers from a disadvantage. Based on Zhang's scheme, they propose a new threshold proxy signature scheme to defeat the weaknesses of Zhang's scheme and the disadvantage of Kim's scheme.

Threshold proxy signatures

In 1997, Zhang proposed two new nonrepudiable proxy signature schemes to delegate signing capability. Both schemes claimed to have a property of knowing that a proxy signature is generated by either the original signer or a proxy signer. However, this paper will show that Zhang's second scheme fails to possess this property. Moreover, we shall show that the proxy signer can cheat to get the original signer's signature, if Zhang's scheme is based on some variants of ElGamal-type signature schemes. We modify Zhang's nonrepudiable proxy signature scheme to avoid the above attacks. The modified scheme also investigates a new feature for the original signer to limit the delegation time to a certain period.

On Zhang's Nonrepudiable Proxy Signature Schemes

At Eurocrypt'91, Matsumoto and Imai presented a human identification scheme for insecure channels, which is suitable for human ability of memorizing and processing a short secret. It prevents an intruder from peeping user in typing password on terminal connected to the central computer. However, in this paper, we are going to propose a new attack, called the replay challenge attack, where a malicious terminal pretends to be the host and replays the host's challenges to reveal the secret password. A modified scheme will be proposed to avoid this attack.

/pdf/on-the-matsumoto-and-imai-s-human-identification-scheme-1hyz6cbert.pdf

On the Matsumoto and Imai's human identification scheme

At Eurocrypt'91, Matsumoto and Imai presented a human identification scheme suitable for the human ability of memorising and processing a short secret. It protects against an intruder peeping as a user enters authentication information on a terminal connected to the authentication server. In this paper several attacks are discussed to investigate the security of their scheme. A modified scheme is proposed to avoid these attacks.

Chih-Hung Wang

Papers

On Zhang's Nonrepudiable Proxy Signature Schemes

On the Matsumoto and Imai's human identification scheme

On the Matsumoto and Imai human identification scheme

Comments on two group signatures

Research note: New generalized group-oriented cryptosystem based on Diffie-Hellman scheme