A Note on Secure Key Issuing in ID-based Cryptography.

Chunxiang Xu,Junhui Zhou,Zhiguang Qin

2005-01-01

Abstract:Most recently, Lee B. et al proposed a key issuing protocol for ID-based cryptography to solve the key escrow problem. However in this letter, we show that a malicious key generation center (KGC) can successfully attack the protocol to obtain users' private keys. This means that in the protocol, the key escrow problem isn't really removed.

What problem does this paper attempt to address?

Malicious KGC Attacks in Certificateless Cryptography.

Man Ho Au,Jing Chen,Joseph K. Liu,Yi Mu,Duncan S. Wong,Guomin Yang

DOI: https://doi.org/10.1145/1229285.1266997

2006-01-01

Abstract:ABSTRACTIdentity-based cryptosystems have an inherent key escrow issue, that is, the Key Generation Center (KGC) always knows user secret key. If the KGC is malicious, it can always impersonate the user. Certificateless cryptography, introduced by Al-Riyami and Paterson in 2003, is intended to solve this problem. However, in all the previously proposed certificateless schemes, it is always assumed that the malicious KGC starts launching attacks (so-called Type II attacks) only after it has generated a master public/secret key pair honestly. In this paper, we propose new security models that remove this assumption for both certificateless signature and encryption schemes. Under the new models, we show that a class of certificateless encryption and signature schemes proposed previously are insecure. These schemes still suffer from the key escrow problem. On the other side, we also give new proofs to show that there are two generic constructions, one for certificateless signature and the other for certificateless encryption, proposed recently that are secure under our new models.
Key Replacement Attack Against A Generic Construction Of Certificateless Signature

Bessie C. Hu,Duncan S. Wong,Zhenfeng Zhang,Xiaotie Deng

DOI: https://doi.org/10.1007/11780656_20

2006-01-01

Abstract:Certificateless cryptography involves a Key Generation Center (KGC) which issues a partial key to a user and the user also independently generates an additional public/secret key pair in such a way that the KGC who knows only the partial key but not the additional secret key is not able to do any cryptographic operation on behalf of the user; and a third party who replaces the public/secret key pair but does not know the partial key cannot do any cryptographic operation as the user either. We call this attack launched by the third party as the key replacement attack. In ACISP 2004, Yum and Lee proposed a generic construction of digital signature schemes under the framework of certificateless cryptography. In this paper, we show that their generic construction is insecure against key replacement attack. In particular, we show that the security requirements of their generic building blocks are insufficient to support some security claim stated in their paper. We then propose a modification of their scheme and show its security in a new and simplified security model. We show that our simplified definition and adversarial model not only capture all the distinct features of certificateless signature but are also more versatile when compared with all the comparable ones. We believe that the model itself is of independent interest.
Study of ID-based key management scheme

ZHANG Qiu-yu,WANG Rui-fang,YU Dong-mei,ZHANG Qi-kun

2007-01-01

Journal of Computer Applications

Abstract:An ID based key management scheme based on the bilinear property of Weil pairing defend on elliptic curve was proposed.The scheme used Key Generation Center(KGC) and Key Gene Combination Center(KGCC) to accomplish key management and generation.To avoid security problems caused by single independent key management,KGCC used seeded public key and private key mapping technology to mitigate the load of storage and improve the security of system.The analysis shows that this scheme is more efficient,lightweight,secure and stronger in anti-attack than traditional scheme.
An Improvement of an Identity-Based Key-insulated Signcryption

guobin zhu,hu xiong,ruijin wang,zhiguang qin

DOI: https://doi.org/10.1007/978-81-322-1759-6_12

2014-01-01

Abstract:As one of the fundamental cryptographic primitives, signcryption can achieve unforgeability and confidentiality simultaneously at the cost significantly lower than the signature-then-encryption approach in terms of computational costs and communication overheads. In view of the damage caused by the secret key leakage, Chen et al. proposed an efficient identity-based key-insulated signcryption (ID-KI-SC) scheme secure in the standard model recently. However, in this paper, we show that their scheme does not achieve the indistinguishability against adaptively chosen ciphertext attacks (IND-CCA2) and existential unforgeability against adaptively chosen message attacks (EUF-CMA). Furthermore, we propose an improved scheme that remedies the weakness of Chen et al.' s scheme.
Strongly Secure Certificateless Key-Insulated Signature Secure in the Standard Model

Yanan Chen,Weixiang Xu,Hu Xiong

DOI: https://doi.org/10.1007/s12243-015-0461-z

2015-01-01

Abstract:To protect signing rights against the compromise of secret key, the key-insulated signature (KIS) has attracted a lot of attention from the industry and academia. It would be interesting to investigate the notion of KIS in the certificateless public key cryptography (CL-PKC) environment to solve the problem of certificate management and key escrow simultaneously. To capture the seeming neglected attack mounted by the malicious key generation center (KGC), a stronger security model for the CL-PKC should be considered. In this paper, we first show that the only known CL-KIS scheme is vulnerable against malicious KGC attack, and then propose the first CL-KIS scheme secure against malicious KGC attack, with security proof in the standard model.
Certificateless Strong Key-Insulated Signature

Zhongmei Wan,Xuejia Lai,Jian Weng,Jiguo Li

DOI: https://doi.org/10.1109/icist.2011.5765252

2011-01-01

Abstract:To mitigate the damages of key-exposure, Dodis, Katz, Xu, and Yung, in Eurocrypt 2002, proposed a new paradigm called key-insulated security which provides tolerance against key exposures. Recently many identity-based key insulated signatures schemes have been proposed, however the problem of key escrow is inherent in this setting. To overcome this problem, certificateless public key cryptography was introduced in 2003. In this paper, we extend ID-based key-insulated signatures to certificateless scenarios and propose a certificateless key-insulated signature scheme with secure key-updates. The proposed scheme is strong key-insulated and perfectly key-insulated in the random oracle model.
A Note on the Security of KHL Scheme

Jian Weng,Yunlei Zhao,Robert H. Deng,Shengli Liu,Yanjiang Yang,Kouichi Sakurai

DOI: https://doi.org/10.1016/j.tcs.2015.07.051

IF: 1.002

2015-01-01

Theoretical Computer Science

Abstract:A public key trace and revoke scheme combines the functionality of broadcast encryption with the capability of traitor tracing. In Asiacrypt 2003, Kim, Hwang and Lee proposed a public key trace and revoke scheme (referred to as KHL scheme), and gave the security proof to support that their scheme is z-resilient against adaptive chosen-ciphertext attacks, in which the adversary is allowed to adaptively issue decryption queries as well as adaptively corrupt up to z users. In the passed ten years, KHL scheme has been believed as one of the most efficient public key trace and revoke schemes with z-resilience against adaptive chosen-ciphertext attacks under the well-studied DDH assumption. However, in this paper, by giving a concrete attack, we indicate that KHL scheme is actually not secure against adaptive chosen-ciphertexts, even without corruption of any user. We then identify the flaws in the security proof for KHL-scheme, and discuss the consequences of the attack.
Defending Against Key Exposure in Attribute-Based Encryption

J. Li,X. Chen,H. Tian,C. Gao

DOI: https://doi.org/10.1504/ijahuc.2014.065156

2014-01-01

International Journal of Ad Hoc and Ubiquitous Computing

Abstract:Since the notion of attribute-based encryption (ABE) was proposed, it has been found a lot of important applications such as fine-grained access control. However, the issue of key exposure problem in ABE has been solved completely. This problem is formally addressed and formulated in this paper. More specifically, we propose a new key-insulated ABE (KI-ABE) scheme as a solution to the key exposure problem. The definition and security model of KI-ABE is proposed. Then, a KI-ABE scheme is presented, which is provably secure under the proposed model. The scheme is secure in the remaining time periods against an adversary who compromises the insecure device and obtains secret keys for the periods of its choice. Finally, we show that the scheme also supports user delegation, which is critical when one wants to delegate part of attributes (privileges) to others.
Fully Secure Identity Based Key-Insulated Signcryption in the Standard Model

Guobin Zhu,Hu Xiong,Zhiguang Qin

DOI: https://doi.org/10.1007/s11277-014-1936-3

IF: 2.017

2014-01-01

Wireless Personal Communications

Abstract:To achieve unforgeability and confidentiality simultaneously, signcryption has been introduced with better efficiency than the signature-then-encryption approach in terms of computational costs and communication overheads. Taking the key leakage into account, it is desirable to design identity-based key-insulated signcryption (ID-KI-SC) scheme to reduce the damage caused by the secret key leakage. In this paper, we have shown that all of the existing ID-KI-SC scheme can not offer either the unforgeability property or the indistinguishability property. Furthermore, an improved scheme along with the formal security proof in the standard model has been suggested in this paper. In view of computational cost and communication overhead, our scheme is amongst the most efficient IB-SC schemes secure in the standard model.
On the Security of a Key Agreement and Key Protection Scheme

Yunxia Han,Chunxiang Xu,Debiao He,Kefei Chen

DOI: https://doi.org/10.1109/tifs.2020.2986881

IF: 7.231

2020-01-01

IEEE Transactions on Information Forensics and Security

Abstract:We point out that the key agreement and key protection scheme (published in IEEE Transactions on Information Forensics and Security, doi: 10.1109/TIFS.2018.2850299) fails to achieve the two-factor security. We demonstrate that in the scheme, if an adversary can control the master device of a target user, he can impersonate the user to pass the server's authentication.
Key Replacement Attack on Two Certificateless Signature Schemes Without Random Oracles

Qi Xia,Chunxiang Xu,Yong Yu

DOI: https://doi.org/10.4028/www.scientific.net/kem.439-440.1606

2010-01-01

Key Engineering Materials

Abstract:Liu et al. proposed the first certificateless signature scheme without random oracles in 2007. However, Xiong et al. showed that Liu et al.'s scheme is insecure against a malicious-but-passive KGC attack and proposed an improved scheme. In ISA 2009, Yuan et al. also proposed a new certificateless signature scheme without random oracles. Although they claimed that the two schemes are secure in the standard model, this paper shows that both Xiong et al.'s improved scheme and Yuan et al.'s new scheme are vulnerable to key replacement attack, where an adversary, obtaining a signature on a message and replacing the public key of a signer, can forge valid signatures on the same message under the replaced public key. We also give the corresponding modifications of the two schemes to resist key replacement attack.
Certificateless Signature: a New Security Model and an Improved Generic Construction

Bessie C. Hu,Duncan S. Wong,Zhenfeng Zhang,Xiaotie Deng

DOI: https://doi.org/10.1007/s10623-006-9022-9

IF: 1.4

2006-01-01

Designs Codes and Cryptography

Abstract:Certificateless cryptography involves a Key Generation Center (KGC) which issues a partial key to a user and the user also independently generates an additional public/secret key pair in such a way that the KGC who knows only the partial key but not the additional secret key is not able to do any cryptographic operation on behalf of the user; and a third party who replaces the public/secret key pair but does not know the partial key cannot do any cryptographic operation as the user either. We call this attack launched by the third party as the key replacement attack. In ACISP 2004, Yum and Lee proposed a generic construction of digital signature schemes under the framework of certificateless cryptography. In this paper, we show that their generic construction is insecure against key replacement attack. In particular, we give some concrete examples to show that the security requirements of some building blocks they specified are insufficient to support some of their security claims. We then propose a modification of their scheme and show its security in a new and simplified security model. We show that our simplified definition and adversarial model not only capture all the distinct features of certificateless signature but are also more versatile when compared with all the comparable ones. We believe that the model itself is of independent interest.A conventional certificateless signature scheme only achieves Girault's Level 2 security. For achieving Level 3 security, that a conventional signature scheme in Public Key Infrastructure does, we propose an extension to our definition of certificateless signature scheme and introduce an additional security model for this extension. We show that our generic construction satisfies Level 3 security after some appropriate and simple modification.
On the Security of an Efficient and Non-interactive Hierarchical Key Agreement Protocol

Guobin Zhu,Hu Xiong,Zhiguang Qin

DOI: https://doi.org/10.1007/s11277-013-1328-0

IF: 2.017

2014-01-01

Wireless Personal Communications

Abstract:As a fundamental cryptographic primitive, key agreement protocol allows two or more parties to agree on shared keys which will be used to protect their later communication. To resist against the corruption of any number of nodes at any level in the hierarchy, Guo et al. (Comput Secur 30:28–34, 2011) proposed a novel non-interactive hierarchical identity-based key agreement protocol along with a claimed security proof in the random oracle model. Unfortunately, by giving concrete attacks, we indicate that Guo et al.’s protocol is not secure even against the corruption of any leaf or intermediate nodes in the hierarchy. Concretely, the session key of one node will be compromised provided that one of its child node has been corrupted.
Strongly Secure Identity-Based Authenticated Key Agreement Protocols in the Escrow Mode

Liang Ni,GongLiang Chen,JianHua Li,YanYan Hao

DOI: https://doi.org/10.1007/s11432-011-4520-4

IF: 3.218

2012-01-01

Computers & Mathematics with Applications

Abstract:Escrowable identity-based authenticated key agreement(AKA) protocols are desirable under certain circumstances especially in certain closed groups applications.In this paper,we focus on two-party identitybased AKA schemes in the escrow mode,and present a strongly secure escrowable identity-based AKA protocol which captures all basic desirable security properties including perfect forward secrecy,ephemeral secrets reveal resistance and so on.The protocol is provably secure in the extended Canetti-Krawczyk model,and its security can be reduced to the standard computational bilinear Diffie-Hellman assumption in the random oracle model.Assuming no adversary can obtain the master private key for the escrow mode,our scheme is secure as long as each party has at least one uncompromised secret.Also,we present two strongly secure variants of the protocol,which are computationally more efficient than the original scheme.
Provably Secure Identity-based Threshold Key Escrow from Pairing.

Yu Long,Zheng Gong,Kefei Chen,Shengli Liu

2009-01-01

Abstract:This paper proposes an identity-based threshold key escrow scheme. The scheme is secure against identity-based threshold chosen-plaintext attack. It tolerates the passive adversary to access data of corrupted key escrow agency servers and the active adversary that can modify corrupted servers’ keys. The formal proof of security is presented in the random oracle model, assuming the Bilinear Di‐e-Hellman problem is computationally hard.
On Key Issuing Privacy in Distributed Online Social Networks

Tao Yang,Liyong Tang,Lingbo Kong,Zhong Chen

DOI: https://doi.org/10.1109/fskd.2012.6233869

2012-01-01

Abstract:Recently, distributed online social networks (OSNs) are developed to address the security and privacy issues in centralized OSNs. Identity based cryptography (IBC) was introduced into distributed OSNs recently for better identity verification and authentication purposes. However, current IBC-based solutions in OSNs could not address the problem of secure private key issuing. In this paper we propose PEKING: a novel Pivacy Enhanced Key IssuiNG scheme for distributed online social networks using IBC. Our scheme adopts key generate center (KGC) and key privacy assistants (PAs) to issue keys to peers securely. In the scheme, PAs can be selected from users' friends. Neither KGC nor PAs can impersonate the users to obtain the private keys. Furthermore, to maintain the security of PAs, we develop a scheme to authenticate PAs using Byzantine fault tolerance protocol. The experimental results show that PEKING performs effectively and efficiently, and is able to support large scale networks.
Further Attacks and Improvement of a Certificateless Signature Scheme.

Bo Yang,Zhao Yang,Nengfei Liu,Shougui Li

DOI: https://doi.org/10.1109/cis.2015.89

2013-01-01

Abstract:Certificate less public key cryptography is an attractive paradigm since it eliminates the use of certificates in traditional public key cryptography and alleviates the inherent key escrow problem in identity-based cryptography. Recently, Xiong et al. Proposed a certificate less signature scheme and proved that their scheme is existentially unforgeable against adaptive chosen message attack under the random oracle model. He et al. Pointed out that Xiong et al.'s scheme is insecure against the Type II adversary. But, their forged signatures are not random, and their improved scheme has the same security defects as Xiong et al.'s scheme. In this paper, we present two malicious-but-passive KGC attack methods on Xiong et al.'s scheme and our results show that their scheme is insecure against malicious-but-passive KGC attack. We also propose an improved scheme which is secure against the super Type I adversary and super Type II adversary.
Certificateless Public Key Encryption with Cryptographic Reverse Firewalls

Yuyang Zhou,Jing Guo,Fagen Li

DOI: https://doi.org/10.1016/j.sysarc.2020.101754

IF: 5.836

2020-01-01

Journal of Systems Architecture

Abstract:The Snowden incident shows that powerful attackers can compromise users' machines to steal users' private information. Currently, many encryption schemes that have proven to be secure cannot detect vulnerabilities. These vulnerabilities may reveal users' secrets, e.g., a machine hides some backdoors without a user's awareness, and an attacker can steal the user's private information through these backdoors. In 2015, Mironov and Stephens-Davidowitz proposed a new framework for solving this problem: cryptographic reverse firewall (CRF). However, their protocols can't protect certificateless public key encryption (CL-PKE). In this paper, we design a CRF protocol for CL-PKE, which is a one-round CL-PKE with CRFs (CL-PKE-CRF) deployed on a receiver and a key generating centre (KGC). This protocol is proved to achieve indistinguishability against chosen plaintext attack (IND-CPA). Compared with existing protocol with CRFs and two CL-PKE schemes, our protocol has the least communication cost. Meanwhile, we use JPBC library to implement our one-round CL-PKE-CRF. The experimental results indicate that under high security levels, our protocol has a advantage in the percentage of the running time. Since our protocol can resist exfiltration attacks from internal attackers, it is efficient and practical. Finally, we apply the same method to design a secure and effective one-round certificateless public key signature with a CRF (CL-PKS-CRF). This means that our protocol is not only targeted at a single CL-PKE scheme, but also can inspire the design of other certificateless public key cryptography schemes with CRFs.
Certificateless Key-Insulated Signature Without Random Oracles

Zhong-mei Wan,Xue-jia Lai,Jian Weng,Sheng-li Liu,Yu Long,Xuan Hong

DOI: https://doi.org/10.1631/jzus.a0820714

2011-01-01

Abstract:Leakage of the private key has become a serious problem of menacing the cryptosystem security. To reduce the underlying danger induced by private key leakage, Dodis et al. (2003) proposed the first key-insulated signature scheme. To handle issues concerning the private key leakage in certificateless signature schemes, we devise the first certificateless key-insulated signature scheme. Our scheme applies the key-insulated mechanism to certificateless cryptography, one with neither certificate nor key escrow. We incorporate Waters (2005)’s signature scheme, Paterson and Schuldt (2006)’s identity-based signature scheme, and Liu et al. (2007)’s certificateless signature scheme to obtain a certificateless key-insulated signature scheme. Our scheme has two desirable properties. First, its security can be proved under the non-pairing-based generalized bilinear Diffie-Hellman (NGBDH) conjecture, without utilizing the random oracle model; second, it solves the key escrow problem in identity-based key-insulated signatures.
Identity-based key-insulated signature with secure key-updates

Jian Weng,Shengli Liu,Kefei Chen,Xiangxue Li

DOI: https://doi.org/10.1007/11937807_2

2006-01-01

Abstract:Standard identity-based (ID-based) signature schemes typically rely on the assumption that secret keys are kept perfectly secure. However, with more and more cryptographic primitives are deployed on insecure devices (e.g. mobile devices), key-exposure seems inevitable. This problem is perhaps the most devastating attack on a cryptosystem since it typically means that security is entirely lost. To minimize the damage caused by key-exposure in ID-based signatures scenarios, Zhou et al. [32] applied Dodis et al.'s key-insulation mechanism [12] and proposed an ID-based key-insulated signature (IBKIS) scheme. However, their scheme is not strong key-insulated, i.e, if an adversary compromises the helper key, he can derive all the temporary secret keys and sign messages on behalf the legitimate user. In this paper, we re-formalize the definition and security notions for IBKIS schemes, and then propose a new IBKIS scheme with secure key-updates. The proposed scheme is strong key-insulated and perfectly key-insulated. Our scheme also enjoys desirable properties such as unbounded number of time periods and random-access key-updates.

A Note on Secure Key Issuing in ID-based Cryptography.

Malicious KGC Attacks in Certificateless Cryptography.

Key Replacement Attack Against A Generic Construction Of Certificateless Signature

Study of ID-based key management scheme

An Improvement of an Identity-Based Key-insulated Signcryption

Strongly Secure Certificateless Key-Insulated Signature Secure in the Standard Model

Certificateless Strong Key-Insulated Signature

A Note on the Security of KHL Scheme

Defending Against Key Exposure in Attribute-Based Encryption

Fully Secure Identity Based Key-Insulated Signcryption in the Standard Model

On the Security of a Key Agreement and Key Protection Scheme

Key Replacement Attack on Two Certificateless Signature Schemes Without Random Oracles

Certificateless Signature: a New Security Model and an Improved Generic Construction

On the Security of an Efficient and Non-interactive Hierarchical Key Agreement Protocol

Strongly Secure Identity-Based Authenticated Key Agreement Protocols in the Escrow Mode

Provably Secure Identity-based Threshold Key Escrow from Pairing.

On Key Issuing Privacy in Distributed Online Social Networks

Further Attacks and Improvement of a Certificateless Signature Scheme.

Certificateless Public Key Encryption with Cryptographic Reverse Firewalls

Certificateless Key-Insulated Signature Without Random Oracles

Identity-based key-insulated signature with secure key-updates