Abstract:An authenticated encryption (AE) scheme simultaneously achieves two security goals: confidentiality and authenticity. AE can be divided into symmetric AE and asymmetrical (public key) AE. In a symmetric AE scheme, deniability is gained automatically. However, a public key AE scheme can not gain deniability automatically; on the contrary, it provides non-repudiation. In this paper, we address a question on deniability of public key AE. Of course, we can achieve this goal by “deniable authentication followed by encryption” method. However, such method has the following two weaknesses: (1) the computational cost and communication overhead are the sum of two cryptographic primitives; (2) it is complex to design cryptographic protocols with deniable authentication and confidentiality using two cryptographic primitives. To overcome the two weaknesses, we propose a new concept called deniable authenticated encryption (DAE) that can achieve both the functions of deniable authentication and public key encryption simultaneously, at a cost significantly lower than that required by the “deniable authentication followed by encryption” method. This single cryptographic primitive can simplify the design of cryptographic protocols with deniable authentication and confidentiality. In particular, we construct an identity-based deniable authenticated encryption (IBDAE) scheme. Our construction uses tag-key encapsulation mechanism (KEM) and data encapsulation mechanism (DEM) hybrid techniques, which is more practical for true applications. We show how to construct an IBDAE scheme using an identity-based deniable authenticated tag-KEM (IBDATK) and a DEM. We also propose an IBDATK scheme and prove its security in the random oracle model. For typical security level, our scheme is at least 50.7 and 22.7 % faster than two straightforward “deniable authentication followed by encryption” schemes, respectively. The communication overhead is respectively reduced at least 21.3 and 31.1 %. An application of IBDAE to an e-mail system is described.

A Certificateless One-Way Group Key Agreement Protocol for End-to-End Email Encryption

SafeEmail A safe and reliable email communication system without any spam

Efficient Deniably Authenticated Encryption and Its Application to E-Mail.

Secure Email Transmission Protocols -- A New Architecture Design

An Improved Certified E-Mail Protocol for Mobile Environments

Gsep: an E-Mail Protocol Based on Generalized Signcryption

A Provable Authenticated Group Key Agreement Protocol for Mobile Environment

Yet Another Certificateless Three-Party Authenticated Key Agreement Protocol

A Formal Security Analysis of the pEp Authentication Protocol for Decentralized Key Distribution and End-to-End Encrypted Email

A Group Key Agreement Protocol Based on ECDH and Short Signature

Efficient and provably secure password-based group key agreement protocol

Secure one-pass and two-party authenticated key agreement protocol

Towards a Secure E-mail Protocol with Perfect Forward Secrecy

Copy protection for email

Preventing EFail Attacks with Client-Side WebAssembly: The Case of Swiss Post's IncaMail

Identity-based Deniable Authenticated Encryption and Its Application to E-Mail System

An Attribute-Based End-to-End Policy-Controlled Signcryption Scheme for Secure Group Chat Communication

Scalable Group Key Exchange Protocol With Provable Security

Two-party Authenticated Key Agreement in Certificateless Public Key Cryptography

A Certificateless Two-Party Key Agreement Protocol from Challenge-Response Signatures

Efficient three-party authenticated key agreement protocol in certificateless cryptography