Showing papers on "Key escrow published in 2019"

An improved certificateless aggregate signature scheme without bilinear pairings for vehicular ad hoc networks

Abstract: Certificateless aggregate signature (CL-AS) is a digital signature technique used to achieve improved performance in resource-constrained environments like vehicular ad hoc networks (VANETs) by eliminating the certificate issue in the traditional public key cryptography (PKC), addressing the key escrow problem in identity-based PKC, and utilizing the efficiency benefits of aggregate signature. Recently, an efficient CL-AS scheme for VANETs was proposed which the authors claimed to be existentially secure against forgery attacks in the random oracle model. In this paper, the scheme was analyzed and found to be insecure under existing security model. Consequently, we propose a new efficient certificateless aggregate signature scheme for VANETs applications based on elliptic curve cryptography. The proposed scheme does not only meet the privacy and security requirements for VANETs, but supports batch verification, autonomy, and conditional privacy preservation. In addition, the proposed scheme is provably secure against existential forgery on adaptive chosen message attack in the random oracle model based on the hardness assumption of the elliptic curve discrete logarithm problem. Extensive efficiency analysis demonstrates that the performance of the proposed scheme exceeds those of the recent related schemes in terms of computation cost and communication overhead.

Certificateless searchable public key authenticated encryption with designated tester for cloud-assisted medical Internet of Things

Abstract: In the past few years, internet of things has been explored in medical area to achieve high efficiency and accuracy in the medical treatment and management. One of the most powerful technologies called the medical Internet of Things (mIoT), is underpinned by the considerable computational ability of cloud and the efficient data collection of medical sensors. As the data is transmitted over open network, security remains a paramount concern in mIoT. Encryption techniques may help to protect patient privacy, but they limit the future retrieval of the encrypted data. To uplift this limitation, public key encryption with keyword search (PEKS) has been introduced. However, most of the existing PEKS schemes are based on public key infrastructure or identity-based cryptography, which suffers from the certificate management issue and key escrow problem in system deployment, respectively. Moreover, inside keyword guessing attack seems to become a severe issue to violate privacy in data search. To address these issues, we present a certificateless searchable public key authenticated encryption scheme with designated tester (CL-dPAEKS), which, we believe, is suitable for cloud-assisted mIoT. We prove that our scheme can resist various types of attacks, and it is more secure than other schemes that built on certificateless cryptography, without significant loss in efficiency.

An Efficient and Provably Secure Certificateless Blind Signature Scheme for Flying Ad-Hoc Network Based on Multi-Access Edge Computing

Abstract: Unmanned aerial vehicles (UAVs), when interconnected in a multi-hop ad-hoc fashion, or as a flying ad-hoc network (FANET), can efficiently accomplish mission-critical tasks. However, UAVs usually suffer from the issues of shorter lifespan and limited computational resources. Therefore, the existing security approaches, being fragile, are not capable of countering the attacks, whether known or unknown. Such a security lapse can result in a debilitated FANET system. In order to cope up with such attacks, various efficient signature schemes have been proposed. Unfortunately, none of the solutions work effectively because of incurred computational and communication costs. We aimed to resolve such issues by proposing a blind signature scheme in a certificateless setting. The scheme does not require public-key certificates, nor does it suffer from the key escrow problem. Moreover, the data that are aggregated from the platform that monitors the UAVs might be too huge to be processed by the same UAVs engaged in the monitoring task. Due to being latency-sensitive, it demands high computational capability. Luckily, the envisioned fifth generation (5G) mobile communication introduces multi-access edge computing (MEC) in its architecture. MEC, when incorporated in a UAV environment, in our proposed model, divides the workload between UAVs and the on-board microcomputer. Thus, our proposed model extends FANET to the 5G mobile network and enables a secure communication between UAVs and the base station (BS).

Fully Secure Lightweight Certificateless Signature Scheme for IIoT

Abstract: In recent years, Industrial Internet of Things (IIoT) has become increasingly important for applications in the industry. Inevitably, security for IIoT has become a priority in order to deploy secure applications. Amongst available cryptographic tools, certificateless signature schemes offer sound authentication solutions and avoid public-key certification from Trusted Third Parties (TTP). Certificateless signatures solve the key escrow problem against the dishonest Private Key Generator (PKG) and has considered to be a useful tool for IIoT applications. Recently, Karati et al. (IEEE Trans. Industrial Informatics, vol.14, no. 8, 2018) presented a lightweight certificateless signature scheme for IIoT Environments. This scheme was then broken by Zhang et al. (IEEE Access, vol. 8, 2018) by simply allowing to change the public key of the signer and using the homomorphic property of the original scheme. In this paper, we introduce a new attack to the scheme against the existential unforgeability, which is universal since we do not have to assume homomorphic property. We then introduce an entirely new lightweight certificateless signature scheme, which has been proven to be fully secure against all attacks found earlier. Our scheme is the first lightweight certificateless signature scheme with full security and is the most efficient in comparison with other existing schemes. It is desirable for IIoT applications. We also provide experimental results to justify our claims.

A security scheme for intelligent substation communications considering real-time performance

Abstract: Tampering, forgery and theft of the measurement and control messages in a smart grid could cause one breakdown in the power system. However, no security measures are employed for communications in intelligent substations. Communication services in an intelligent substation have high demands for real-time performance, which must be considered when deploying security measures. This paper studies the security requirements of communication services in intelligent substations, analyzes the security capabilities and shortages of IEC 62351, and proposes a novel security scheme for intelligent substation communications. This security scheme covers internal and telecontrol communications, in which the real-time performance of each security measure is considered. In this scheme, certificateless public key cryptography (CLPKC) is used to avoid the latency of certificate exchange in certificate-based cryptosystem and the problem of key escrow in identity-based cryptosystem; the security measures of generic object-oriented substation event, sampled measure value and manufacturing message specification in IEC 62351 are improved to meet the real-time requirements of the messages as well as to provide new security features to resist repudiation and replay attacks; and the security at transport layer is modified to fit CLPKC, which implements mutual authentication by exchanging signatures. Furthermore, a deployment of CLPKC in an intelligent substation is presented. We also evaluate the security properties of the scheme and analyze the end-to-end delays of secured services by combining theoretical calculation and simulation in this paper. The results indicate that the proposed scheme meets the requirements of security and real-time performance of communications in intelligent substations.

ESKI-IBE: Efficient and secure key issuing identity-based encryption with cloud privacy centers

Abstract: Digital certificate validation associated with traditional public key cryptosystems make it impractical in real-world environments due to their storage cost. The identity-based cryptosystems have been proven advantageous as they do not require any digital certificate validation and hence their storage. Due to the key escrow, user slandering and secure key issuing problems, IBE adoption is limited to the small networks only. The existing solutions either lose the identity-based feature or require high computation cost. In this paper, we propose a mechanism to generate the user’s private key in which we mitigate the trust on single PKG by replacing it with single semi-trusted key generation center (KGC), which authenticates the user and provide the partial private key and multiple cloud privacy centers (CPCs), which protect the user’s private key with their secret keys. In order to reduce the computation cost to generate the user’s private key, the maximum computations are offloaded to the CPCs, and only constant (very less) number of operations are run on the KGC. We use the ECC-based blind technique to secure the communication over a public channel. Using the proposed escrow-free private key generation mechanism, we design an identity based encryption scheme, which is semantically secured against IND-ID-CCA attack assuming BDH problem.

Privacy-Preserving Certificateless Cloud Auditing with Multiple Users

Abstract: Cloud auditing is one of the important processes to ensure the security and integrity of data in cloud storage. Implementing cloud auditing requires various cryptographic tools such as identity-based cryptography and its variant: certificateless cryptography which solves the inherent key escrow problem in identity-based cryptography. Applying certificateless cryptography to cloud auditing has shown many merits. However, in a multi-user setting, certificateless cloud auditing (CLCA) schemes require additional security requirements. For instance, the identity privacy becomes an important issue that should be taken into consideration in some applications. In this paper, we concentrate on the identity privacy of CLCA schemes. We define the security models of privacy-preserving CLCA schemes, namely the uncheatability and anonymity and propose an efficient CLCA scheme, which is secure in the security models. As a feature of our scheme, the tag of a message is compact, which consists of only one group element. The uncheatability is based on variants of bilinear Diffie–Hellman assumption in the random oracle model. The identity privacy of the user is information-theoretically guaranteed against the third party auditor.

Efficient Privacy-Preserving Certificateless Provable Data Possession Scheme for Cloud Storage

Abstract: Cloud computing is a burgeoning paradigm that offers reliable and adaptive infrastructure to the data owner who shares his data with the data user through the cloud server. In the data sharing process, the integrity of the data stored in the cloud faces serious threats. The provable data possession schemes ensure that a cloud server provider proves to a third party auditor that it is truthfully storing data from the data owner. However, the PKI-based provable data possession scheme suffers the management issue of the certificates and the identity-based provable data possession scheme causes an inherent key escrow problem. In this paper, we put forward an efficient privacy-preserving certificateless provable data possession scheme based on certificateless cryptography and elliptic curve cryptography, which has been proved to be unforgeable against adaptive chosen message attacks in the random oracle model. At the same time, the data integrity can be audited by the third party auditor without downloading the whole data. The proposed scheme gives away no information of the stored data to the third party auditor during the audit phase and the data owner's identity privacy is protected. The experiment results show that the proposed scheme is of efficiency and feasibility as far as computation and communication costs are concerned.

A Lightweight and Provable Secured Certificateless Signcryption Approach for Crowdsourced IIoT Applications

Abstract: Industrial Internet of Things (IIoT) is a new type of Internet of Things (IoT), which enables sensors to merge with several smart devices to monitor machine status, environment, and collect data from industrial devices. On the other hand, cloud computing provides a good platform for storing crowdsourced data of IIoT. Due to the semi-trusted nature of cloud computing and communication through open channels, the IIoT environment needs security services such as confidentiality and authenticity. One such solution is provided by the identity-based signcryption. Unfortunately, the identity-based signcryption approach suffers from the key escrow problem. Certificateless signcryption is the alternative of identity-based signcryption that can resolve the key escrow problem. Here, we propose a lightweight certificateless signcryption approach for crowdsourced IIoT applications with the intention of enhancing security and decreasing the computational cost and communication overhead. The security and efficiency of the proposed approach are based on the hyper elliptic curve cryptosystem. The hyper elliptic curve is the advance version of the elliptic curve having small parameters and key size of 80 bits as compared to the elliptic curve which has 160-bits key size. Further, we validate the security requirements of our approach through automated validation of Internet security protocols and applications (AVISPA) tool with the help of high level protocol specification language (HLPSL). Moreover, our lightweight and secured scheme will attract low resource devices and will become a perk in the environment of IIoT.

A Blockchain-Based Access Control Scheme for Smart Grids

Abstract: At present, the access control schemes in the power grid are centralized. In the centralized system, the data of the network sensor nodes is transmitted by centralized nodes, and the data itself may be illegally tamped with or lost, which can lead to reduced system reliability. For this feature, we apply blockchain technology to the design of access control schemes. In this paper, we propose a blockchain-based access control scheme that is suitable for multiple scenarios in the smart grid. Our access control scheme is based on an identity-based combined encryption, signature and signcryption scheme. In addition, we design a consensus algorithm in the power system for the consortium blockchain architecture to solve the key escrow problem of the untrusted third parties. Our scheme also ensures the confidentiality, integrity, authentication and non-repudiation of the data. Compared with the existing work, our scheme can use the same key pair to encrypt, sign and signcrypt the message, which has lower computation and communication costs in multiple scenarios of smart grids.

Efficient and Anonymous Certificateless Multi-Message and Multi-Receiver Signcryption Scheme Based on ECC

Abstract: As the further extension of the multi-receiver signcryption, the multi-message and multi-receiver signcryption allows a sender to simultaneously signcrypt different messages for different receivers in only one logic operation, which makes it more flexible than the traditional multi-receiver signcryption in which only the same and unique message can be sent to all authorized receivers. The existing multi-message and multi-receiver signcryption schemes are constructed based on either the identity-based cryptography or the public key infrastructure-based cryptography, and thus, they have to suffer from the key escrow problem inherent in the identity-based cryptography or the public key certificate management burden related with the public key infrastructure-based cryptography. Certificateless public key cryptography provides an idea to solve the key escrow problem and eliminate the public key certificate management burden and has been applied to many cryptographic algorithms. In this paper, to avoid the above problems in the existing multi-message and multi-receiver signcryption schemes, the concept of the certificateless public key cryptography was introduced into the designing of the multi-message and multi-receiver signcryption, and a certificateless multi-message and multi-receiver signcryption scheme was proposed. The proposed scheme is free from the key escrow problem and the public key certificate management burden because it is constructed based on the certificateless public key cryptography. Moreover, compared with the existing schemes, it is improved in efficiency because it does not use the bilinear pairing operations but utilizes the limited number of scalar point multiplication on elliptic curve cryptography operations. At the same time, the proposed scheme achieves receiver anonymity.

Context-Aware Adaptive Authentication and Authorization in Internet of Things

Abstract: The rapid technological advancements in wireless communications, ubiquitous sensing and mobile networking have paved the way for the emergence of the Internet of Things (IoT) era, where “anything” can be connected “anywhere” at “anytime”. However, the flourish of IoT still faces various security and privacy preserving challenges that need to be addressed. In such pervasive and heterogeneous environment where the context conditions dynamically and frequently change, efficient and context-aware mechanisms are required to meet the users' changing needs. Therefore, it seems crucial to design an adaptive access control scheme in order to remotely control smart things while considering the dynamic context changes. In this paper, we propose a Context-Aware Attribute-Based Access Control (CAABAC) approach that incorporates the contextual information with the Ciphertext-Policy Attribute-based Encryption (CP-ABE) to ensure data security and provide an adaptive contextual privacy. From a security perspective, the proposed scheme satisfies the security requirements such as confidentiality, context-aware privacy, and resilience against key escrow problem. Performance analysis proves the efficiency and the effectiveness of the proposed scheme compared to benchmark schemes in terms of storage, communication and computational cost.

Constructing pairing-free certificateless public key encryption with keyword search

Abstract: Searchable public key encryption enables a storage server to retrieve the publicly encrypted data without revealing the original data contents. It offers a perfect cryptographic solution to encrypted data retrieval in encrypted data storage systems. Certificateless cryptography (CLC) is a novel cryptographic primitive that has many merits. It overcomes the key escrow problem in identity-based cryptosystems and the cumbersome certificate problem in conventional public key cryptosystems. Motivated by the appealing features of CLC, three certificateless encryption with keyword search (CLEKS) schemes were presented in the literature. However, all of them were constructed with the costly bilinear pairing and thus are not suitable for the devices that have limited computing resources and battery power. So, it is interesting and worthwhile to design a CLEKS scheme without using bilinear pairing. In this study, we put forward a pairing-free CLEKS scheme that does not exploit bilinear pairing. We strictly prove that the scheme achieves keyword ciphertext indistinguishability against adaptive chosen-keyword attacks under the complexity assumption of the computational Diffie-Hellman problem in the random oracle model. Efficiency comparison and the simulation show that it enjoys better performance than the previous pairing-based CLEKS schemes. In addition, we briefly introduce three extensions of the proposed CLEKS scheme.

Identity-Based Encryption with Security Against the KGC: A Formal Model and Its Instantiation from Lattices

Abstract: The key escrow problem is one of the main barriers to the widespread real-world use of identity-based encryption (IBE). Specifically, a key generation center (KGC), which generates secret keys for a given identity, has the power to decrypt all ciphertexts. At PKC 2009, Chow defined a notion of security against the KGC, that relies on assuming that it cannot discover the underlying identities behind ciphertexts. However, this is not a realistic assumption since, in practice, the KGC manages an identity list and hence it can easily guess the identities corresponding to given ciphertexts. Chow later closed the gap between theory and practice by introducing a new entity called an identity-certifying authority (ICA) and proposed an anonymous key-issuing protocol. Essentially, this allows the users, KGC, and ICA to interactively generate secret keys without users ever having to reveal their identities to the KGC. Unfortunately, the proposed protocol did not include a concrete security definition, meaning that all of the subsequent works following Chow lack the formal proofs needed to determine whether or not it delivers a secure solution to the key escrow problem.

Certificateless designated verifier signature revisited: achieving a concrete scheme in the standard model

Abstract: In a designated verifier signature (DVS) scheme, the signer (Alice) creates a signature which is only verifiable by a designated verifier (Bob). Furthermore, Bob cannot convince any third party that the signature was produced by Alice. A DVS scheme is applicable in scenarios where Alice must be authenticated to Bob without disturbing her privacy. The de-facto construction of DVS scheme is achieved in a traditional public key infrastructure (PKI) setting, which unfortunately requires a high-cost certificate management. A variant of identity-based (ID-based) setting DVS eliminates the need of certificates, but it introduces a new inherent key escrow problem, which makes it impractical. Certificateless public key cryptography (CL-PKC) is empowered to overcome the problems of PKI and ID-based settings, where it does not suffer from any of the aforementioned problems. However, only a few number of certificateless DVS (CL-DVS) schemes have been proposed in the literature to date. Moreover, all existing CL-DVS schemes are only proven secure in the random oracle model, while some of them are already known to be insecure. We provide three contributions in this paper. First, we revisit the security proofs of existing CL-DVS schemes in the literature and show that unfortunately there are some drawbacks in the proofs of all of those schemes. Second, we concentrate on the recently proposed CL-DVS scheme (IEEE Access 2018) and show a drawback in its security proof which makes it unreliable. Furthermore, we show that this scheme is delegatable in contrast to the author’s claim. Finally, we propose a CL-DVS scheme and prove its security requirements in the standard model. Our scheme is not only the first scheme with a complete and correct security proofs, but also the only scheme in the standard model.

A Blockchain-Based Access Control Scheme for Smart Grids.

Abstract: At present, the access control schemes in the power grid are centralized. In the centralized system, the data of the network sensor nodes is transmitted by centralized nodes, and the data itself may be illegally tamped with or lost, which can lead to reduced system reliability. For this feature, we apply blockchain technology to the design of access control schemes. In this paper, we propose a blockchain-based access control scheme that is suitable for multiple scenarios in the smart grid. Our access control scheme is based on an identity-based combined encryption, signature and signcryption scheme. In addition, we design a consensus algorithm in the power system for the consortium blockchain architecture to solve the key escrow problem of the untrusted third parties. Our scheme also ensures the confidentiality, integrity, authentication and non-repudiation of the data. Compared with the existing work, our scheme can use the same key pair to encrypt, sign and signcrypt the message, which has lower computation and communication costs in multiple scenarios of smart grids.

Fine-grained access control of EHRs in cloud using CP-ABE with user revocation

Abstract: Cloud computing is a novel model for computing and storing. It enables elasticity, on-demand and low-cost usage of computing resources. Electronic health record (EHR) is an emerging patient-oriented paradigm for sharing of medical data. With the arrival of cloud computing, health care industries outsource their EHR to the cloud servers but, at the same time there is increased demand and concern for outsourced EHR’s security also. The major concerns in data outsourcing are the implementation of access policies and policies modification. To address these issues, the optimal solution is Ciphertext Policy Attribute Based Encryption (CP-ABE). CP-ABE allows the patients to describe their own access policies and implement those policies on their data before outsourcing into the cloud servers. But there are major limitations like key escrow and user revocation problems. In this paper, we proposed a modified CP-ABE scheme with user revocation to strengthen data outsourcing system in cloud architecture. The proposed system addresses the key-escrow and revocation problems. 1) The key-escrow problem is solved by using two-authority computation between the key generator authority and cloud server and 2) An immediate attribute modification method is used to achieve fine-grained user revocation. Security analysis and performance evaluation demonstrates that the proposed system is efficient to achieve security in outsourced EHRs in cloud servers.

Anonymous Certificateless Multi-Receiver Signcryption Scheme Without Secure Channel

Abstract: The certificateless multi-receiver signcryption scheme provides the sender with the ability to send the same message to multiple authorized receivers contemporaneously, and at the same time, it can avoid the key escrow problem in the existing identity-based multi-receiver signcryption schemes, which makes it to get great attention in the field of one-to-many communication. However, in the existing certificateless multi-receiver signcryption schemes, a secure channel is essential for their key extract algorithm, which brings some troubles in practical applications. On one hand, the security of the partial private key depends on the secure channel. Once the secure channel is broken by an attacker, the user’s partial private key may be leaked. On the other hand, maintaining the secure channel increases the economic cost and implementation complexity of the application systems. Motivated by these concerns, we propose a new anonymous certificateless multi-receiver signcryption scheme, in which the key generation center only utilizes a public channel to send the pseudo partial private key to the user during the key extract algorithm, and the designated user can work out the real partial private key from the pseudo partial private key while others cannot. The avoidance of the secure channel improves the security of the proposed scheme and makes the communication system much lighter.

An Efficient Conditional Privacy-Preserving Authentication Scheme for Vehicular Ad Hoc Networks Using Online/Offline Certificateless Aggregate Signature

Abstract: Vehicular ad hoc networks (VANETs) are fundamental components of building a safe and intelligent transportation system. However, due to its wireless nature, VANETs have serious security and privacy issues that need to be addressed. The conditional privacy-preserving authentication protocol is one important tool to satisfy the security and privacy requirements. Many such schemes employ the certificateless signature, which not only avoids the key management issue of the PKI-based scheme but also solves the key escrow problem of the ID-based signature scheme. However, many schemes have the drawback that the computational expensive bilinear pairing operation or map-to-point hash function are used. In order to enhance the efficiency, certificateless signature schemes for VANETs are usually constructed to support signature aggregation or online/offline computation. In this paper, we propose an efficient conditional privacy-preserving authentication scheme using an online/offline certificateless aggregate signature, which does not require bilinear pairing or map-to-point hash function, to address the security and privacy issues of VANETs. Our proposed scheme is proven to be secure with a rigorous security proof, and it satisfies all the security and privacy requirements with a better performance compared with other related schemes.

Certificateless deniably authenticated encryption and its application to e-voting system

Abstract: The concept of deniably authenticated encryption (DAE) is presently significant in cryptography due to its security properties and wide range of application. It achieves deniable authentication and confidentiality in a simultaneous manner. It has merited application in e-voting systems, e-mail systems and confidential online negotiation. Although several DAE schemes have been proposed recently, we point out that those constructions are either weak against masquerading attacks or inherent key escrow problem. As a remedy, we propose a certificateless deniably authenticated encryption (CLDAE) scheme that is provably secure. Typically, we can obtain this goal using the “deniable authentication followed by certificateless encryption” approach. However, this approach is computationally expensive and complex to design since it is a combination of two cryptographic constructions. In contrast, our CLDAE scheme is a single cryptographic construction but it concurrently accomplishes the requirements of public key encryption and deniable authentication at a relatively lower cost. For instance, our simulation results at 80 bits of security level shows up to be approximately 43.3 and $$30.4\%$$ respectively faster than two “deniable authentication followed by certificateless encryption” schemes. Moreover, the communication overhead of our CLDAE scheme is 12.9 and $$34.9\%$$ lesser than that of those two schemes respectively. Finally, to demonstrate the significance of our CLDAE scheme, we apply it to a real world application such as e-voting system.

Privacy-Preserving Multi-Receiver Certificateless Broadcast Encryption Scheme with De-Duplication

Abstract: Nowadays, the widely deployed and high performance Internet of Things (IoT) facilitates the communication between its terminal nodes. To enhance data sharing among terminal devices and ensure the recipients’ privacy protection, a few anonymous multi-recipient broadcast encryption (AMBE) proposals are recently given. Nevertheless, the majority of these AMBE proposals are only proven be securely against adaptively chosen plain-text attack (CPA) or selectively chosen ciphertext attack (CCA). Furthermore, all AMBE proposals are subjected to key escrow issue due to inherent characteristics of the ID-based public cryptography (ID-PKC), and cannot furnish secure de-duplication detection. However, for cloud storage, it is very important for expurgating duplicate copies of the identical message since de-duplication can save the bandwidth of network and storage space. To address the above problems, in the work, we present a privacy-preserving multi-receiver certificateless broadcast encryption scheme with de-duplication (PMCBED) in the cloud-computing setting based on certificateless cryptography and anonymous broadcast encryption. In comparison with the prior AMBE proposals, our scheme has the following three characteristics. First, it can fulfill semantic security notions of data-confidentiality and receiver identity anonymity, whereas the existing proposals only accomplish them by formalizing the weaker security models. Second, it achieves duplication detection of the ciphertext for the identical message encrypted with our broadcast encryption. Finally, it also avoids the key escrow problem of the AMBE schemes.

Constructing certificateless encryption with keyword search against outside and inside keyword guessing attacks

Abstract: Searchable public key encryption is a useful cryptographic paradigm that enables an untrustworthy server to retrieve the encrypted data without revealing the contents of the data. It offers a promising solution to encrypted data retrieval in cryptographic cloud storage. Certificateless public key cryptography (CLPKC) is a novel cryptographic primitive that has many merits. It overcomes the key escrow problem in identity-based cryptography (IBC) and the cumbersome certificate problem in conventional public key cryptography (PKC). Motivated by the appealing features of CLPKC, several certificateless encryption with keyword search (CLEKS) schemes have been presented in the literature. But, our cryptanalysis demonstrates that the previously proposed CLEKS frameworks suffer from the security vulnerability caused by the keyword guessing attack. To remedy the security weakness in the previous frameworks and provide resistance against both inside and outside keyword guessing attacks, we propose a new CLEKS framework. Under the new framework, we design a concrete CLEKS scheme and formally prove its security in the random oracle model. Compared with previous two CLEKS schemes, the proposed scheme has better overall performance while offering stronger security guarantee as it withstands the existing known types of keyword guessing attacks.

Privacy-Protected Certificateless Aggregate Signature Scheme in VANET

Abstract: We propose a certificateless aggregate signature (CLAS) scheme for privacy protection based on the certificateless public key cryptosystem and aggregate signature aiming at the common problems of communication security and efficiency in vehicular ad hoc network (VANET). The scheme can resist two different types of adversary attacks under the random oracle model and satisfy the unforgeability of communication messages as well as traceability and anonymity of vehicles. The scheme avoids the key escrow problem and certificate management. Based on the bilinear pairing operations, the aggregation verification of multiple messages is realized through aggregation signature. We quantitatively analyze the computational overhead of the scheme and define a new variable of computational efficiency. Our scheme is proved to be more efficient when V2I communication is carried out in urban roads compared with other schemes.

Construction of Certificateless Proxy Signcryption Scheme From CMGs

Abstract: As a cryptography primitive for secure data transmission, certificateless proxy signcryption (CLPS) allows an original signcrypter to entrust his signing authority to a proxy signcrypter for signing specified message on his behalf. In this paper, we combine CLPS with cyclic multiplication groups (CMGs) to construct a new certificateless proxy signcryption scheme from CMGs (CMGs-CLPSS). CMGs-CLPSS will receive significant attention because it simplifies the traditional public key cryptosystem (PKC) and solves the key escrow issue suffered by identity-based public key cryptosystem (IB-PKC). In CMGs-CLPSS, an encrypted message can only be decrypted by a designated receiver who is also responsible for verifying the message; moreover, if a later dispute over repudiation occurs, the designated receiver can readily announce ordinary CLPS for public verification without any extra computation effort. CMGs-CLPSS is proved to have the indistinguishability under adaptive chosen-ciphertext attacks (IND-CCA2 security) and existential unforgeability under adaptive chosen-message attacks (UF-CMA security) in the random oracle model. CMGs-CLPSS outperforms the existing schemes on the basis of computational complexity and is suitable for applications in digital contract signing and online proxy auction, and so on.

Top-Level Secure Certificateless Signature Scheme in the Standard Model

Abstract: In order to overcome the key escrow problem, Al- Riyami and Paterson introduced the concept of certificateless public key cryptography (CL-PKC) in 2003. CL-PKC requires neither public key certification nor the key escrow problem. After that, CL-PKC has been widely applied. In 1991, Girault defined three security levels of the key generation center (KGC), where the higher level of KGC means the stronger security of the system. Recently, lots of certificateless signature schemes and their security models have been presented. However, there is no certificateless signature scheme proposed in the literature that achieves the property of Girault's level-3 security without random oracles. In view of aforementioned issues, we propose a new construction of certificateless signature scheme. The proposed certificateless signature scheme is provably secure in the standard model and satisfies Girault's level-3 security. The security of the proposed scheme is based on the hardness of generalized computational Diffie-Hellman and many Diffie-Hellman problems.

Key Escrow Protocol Based on a Tripartite Authenticated Key Agreement and Threshold Cryptography

Abstract: While instant messaging systems bring convenience to people's lives and work, they also make it easier for malicious users to discuss and plot illegal activities. Therefore, determining how to balance the privacy protection requirements of user communication in the network with the authorized monitoring requirements of law enforcement agencies (LEAs) is a meaningful task. To solve this problem, a new tripartite authenticated key agreement (Tri-AKA) protocol and a session key escrow scheme based on threshold cryptography and the new Tri-AKA protocol were proposed. In the proposed scheme, the LEA participates as a normal user in the key agreement process of two users and uses (t, n) threshold cryptography to share its ephemeral private key with n key escrow agents (KEAs). When necessary, the LEA can combine t KEAs to recover the specified session key and decrypt the communications, thereby preventing malicious administrators in the LEA from arbitrarily monitoring user communications. Finally, we proved the security of the proposed Tri-AKA protocol under the Computational Diffie-Hellman (CDH) assumption with the Random Oracle Model and the security of the proposed key escrow scheme under the Elliptic Curve Discrete Logarithm (ECDL) assumption. Analysis of our session key escrow scheme and comparison with other schemes show that our scheme can avoid the “once monitor, monitor forever” scenario and achieve fine-grained control in each session. Moreover, our scheme has low storage overhead for each KEA.

Security Anlysis of Certificateless Aggregate Signature Scheme in VANETs

Abstract: Certificateless aggregate signature (CLASS) scheme which combines on certificateless signature and aggregation signature solves the identity-based (ID) public key infrastructure (PKI)'s key escrow problem, the PK problem of traditional PKI. So, CLASS schemes can be applied in many fields to solve the privacy problem and security problem, for example in the information network and system of medicine and biology. Also there are many CLASS schemes to be proposed for these fields. In this manuscript, we analyze the CLASS scheme for VANETs proposed in 2018 which is more efficient than other similar schemes. We find which the CLASS scheme cannot satisfy the security the following two properties, namely unforgeability and traceability as they claimed. That is to say that the attacker may forge a correct signature and it may pass the signature verification but the attacker unknows the secret key. So, the CLASS scheme is not suitable for applying in any system. As an improving, after analyzing original scheme, it is found that the key problems for being insecure and give one simple method to solve the existed drawbacks.