Resolution of Proof of Possession in Public Key Infrastructure

周瑞辉,胡红钢,荆继武

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.04.020

2002-01-01

Abstract:This article introduces the problem on proof of possession in PKI, and narrates various resolutions of it. The focus of this article is the indirect method of proof of possession of encryption certificates.

What problem does this paper attempt to address?

Lattice-based PKEs/KEMs

Xianhui Lu,Jiang Zhang

DOI: https://doi.org/10.1093/nsr/nwab090

IF: 20.6

2021-05-24

National Science Review

Abstract:The invention of public-key cryptography (PKC) by Diffie and Hellman in 1976 is one of two milestones marking the beginning of modern cryptography. The security of a PKC system requires that it should be infeasible to compute the private key from a given public key, which in turn is typically guaranteed by the difficulty in solving some cryptographic-friendly mathematical problems. Among those problems, the integer factorization and discrete logarithm problems play pivotal roles in the development of public-key cryptography. In particular, the assumption that there is no polynomial time (classical) algorithm that solves the above two problems constitutes the basis for the security of almost all currently used public-key cryptosystems, such as RSA and ElGamal. However, Shor [1] found an efficient quantum solving algorithm for the integer factorization and discrete logarithm problems in 1994, which would destroy the security basis for most real deployed PKC systems if large-scale quantum computers become available. The rapid development of quantum technology in recent years suggests that we are getting closer to the quantum crisis of current PKC systems.

multidisciplinary sciences
Credibility Attestation of Property Remote Attestation Method

Cui Yan-Li,Zhang Xing

DOI: https://doi.org/10.1109/fitme.2009.68

2009-01-01

Abstract:During the realizing process of remote attestation, except for using trusted computing technology to protect physical security, storage security and operation security of certifier, cipher mechanism need to be combined to ensure the credibility of attestation method of certifier. This paper designs an attestation method model of property remote attestation, and applies the authentication and access control logic technology to make formal description for the participants of attestation method of property remote attestation, and finally prove the credibility of attestation method. Paper's research conclusion proves, after increasing the authority of certificate and trusted property certificate, the credibility of property remote attestation method can be guaranteed among the computing environment applying the public key infrastructure participates.
Private Proof of Solvency

Hamid Bateni,Keyvan Kambakhsh

DOI: https://doi.org/10.48550/arXiv.2310.13900

2023-10-21

Cryptography and Security

Abstract:The Private Proof of Solvency is a groundbreaking solution in the realm of Proof of Solvency, offering a secure, efficient, and privacy-preserving method for crypto custody providers such as centralized cryptocurrency exchanges or enterprise custody providers. By leveraging the inherent state concept of every blockchain and pioneering cryptographic techniques like zkp, our approach ensures businesses can prove their reserves without revealing their transactions, addresses, or the total amount of liabilities.
Improvements on Non-Interactive Zero-Knowledge Proof Systems Related to Quadratic Residuosity Languages.

Wei Liu,Jian Weng,Bingsheng Zhang,Kai He,Junjie Huang

DOI: https://doi.org/10.1016/j.ins.2022.09.026

IF: 8.1

2022-01-01

Information Sciences

Abstract:Non-interactive zero-knowledge (NIZK) proof systems are very useful for statement verification without interaction in cryptography; they entail just one message, called the proof, that convinces the verifier of the truth of the statement without leaking any extra information. Many NIZK proof systems are related to quadratic residuosity languages and follow three main steps. First, the prover and the verifier sample a common reference string (CRS) in some particular form. Second, the prover proves that n is a Blum integer (BL , n = p 1 t 1 · p 2 t 2, where p 1 and p 2 are different primes both congruent to 3 modulo 4, and t 1 and t 2 are odd). Third, various statements (e.g., NQR n , OR n , AND n , T ( k , t ), and 3 SAT) can be proven by the prover based on the properties of BL . In this study, we improve the NIZK proof system for n ∈ BL based on the special distribution of the square roots modulo n and embed this proof in the third step. Moreover, we show that the CRS can be sampled more efficiently using the improved process.
Decentralized Public Key Infrastructures Atop Blockchain.

Yannan Li,Yong Yu,Chunwei Lou,Nadra Guizani,Lianhai Wang

DOI: https://doi.org/10.1109/mnet.011.2000085

IF: 10.294

2020-01-01

IEEE Network

Abstract:The public key infrastructure (PKi) has been widely adopted to create, manage, distribute, store and revoke digital certificates, which plays an important role in bootstrapping secure communications. A PKi system authenticates entities with the corresponding public keys and it lays the security foundation for public-key cryptosystems in public-key encryption and digital signatures. However, traditional PKi systems suffer from security breaches, such as single-point-of-failure and man-in-the-middle attacks due to the existence of a centralized certificate authority. in this article, we review the traditional centralized PKi system as well as the subjected security concerns, and then we propose possible solutions to address these issues with the emerging blockchain technology. Two frameworks are presented where blockchain is utilized as a public bulletin board or trusted majority. We implement the functions to evaluate the off-chain time costs and on-chain gas costs of the proposal, which demonstrate the feasibility and practicality of the proposal.
A Study on CRL Revocation Delay of PKI

张雪琳,马跃,王玮,徐塞虹

DOI: https://doi.org/10.3321/j.issn:1000-6788.2004.03.015

2004-01-01

Abstract:Public Key Infrastructure (PKI) is a infrastructure of asymmetric encryption that delivers strong capabilities for services such as data confidentiality,authentication,integrity and non-repudiation to effectively mitigate various risks involved in a network environment. The PKI infrastructure ensures that the availability of a well conceived combination of services,communications methods and protocols to its constituent applications and programs. It means that the infrastructure provides a blanket to enable the interoperability of its constituent parts for available,reliable,and unobtrusive security services. In this paper,a model of CRL disribution is set up. By analyzing the revocation delay,we get the expression of revocation delay.The simulation result is also given,which proved correctness of our analysis .
Identity-based Provable Data Possession Revisited: Security Analysis and Generic Construction.

Hongyu Liv,Yi Mu,Jining Zhao,Chunxiang Xu,Huaqun Wang,Leiting Chen,Yong Yu

DOI: https://doi.org/10.1016/j.csi.2016.09.012

IF: 3.721

2016-01-01

Computer Standards & Interfaces

Abstract:Provable Data Possession (PDP), which enables cloud users to verify the data integrity without retrieving the entire file, is highly essential for cloud storage. Observing all the existing PDP schemes rely on the Public Key Infrastructure (PKI), Wang proposed an identity-based distributed provable data possession (ID-DPDP) scheme that can (1) eliminate the complex certificate management and (2) be applied to the multi-cloud scenario. The scheme is efficient, flexible and supports private verification, delegated verification and public verification. In this paper, we find that ID-DPDP is flawed since it fails to achieve soundness. We then fix the flaw by presenting a generic construction for identity-based PDP (ID-PDP) protocol, derived from secure digital signature schemes and traditional PDP protocols. We prove that the soundness of the generic ID-PDP construction depends on the security of the underlying PDP protocols and the signature schemes. An instance of the generic construction by utilizing a state-of-the-art PDP protocol due to Shacham and Waters and BLS short signature scheme is given. Moreover, a new ID-DPDP protocol is obtained by extending the basic ID-PDP to multiple clouds environment. The implementation shows that the proposed ID-PDP protocol is efficient.
BB-PKI: Blockchain-Based Public Key Infrastructure Certificate Management.

Abba Garba,Qinwen Hu,Zhong Chen,Muhammad Rizwan Asghar

DOI: https://doi.org/10.1109/hpcc-smartcity-dss50907.2020.00108

2020-01-01

Abstract:Recently, real-world attacks against the web Public Key Infrastructure (PKI) have arisen more frequently. The current PKI that use Registration Authorities/Certificate Authorities (RAs/CAs) model suffer from notorious security vulnerabilities. Most of these vulnerabilities are due to compromises of RAs, which lead to impersonation attacks resulting in CAs misbehaving to issue bogus certificates. To counter this problem, many approaches, such as Certificate Transparency (CT), ARPKI, and PoliCert, have been proposed. Nonetheless, no solution has yet gained widespread acceptance as a result of complexity and deployability issues. Moreover, existing approaches still require to satisfy complicated interactions and synchronisation among the entities that are involved during certificate issuance, updates, and revocations. In this paper, we propose a new Blockchain-Based PKI (BB-PKI) to address these vulnerabilities of CA misbehaviour caused by impersonation attacks against RAs. Certificate Issuance Request (CIR) should be vouched by manifold RAs. Multiple CAs shall sign and issue the certificate using an out-of-band secure communication channel. Any RA that contributes to the verification process of a user's request can publish the certificate in the blockchain by creating a smart contract certificate transaction. BB-PKI offers strong security guarantees, compromising $n - 1$ of the RAs or CAs is not enough to launch impersonation attacks, meaning that attackers cannot compromise more than the threshold of the latter signatures to launch an attack.
Indistinguishable Proofs of Work or Knowledge.

Foteini Baldimtsi,Aggelos Kiayias,Thomas Zacharias,Bingsheng Zhang

DOI: https://doi.org/10.1007/978-3-662-53890-6_30

2016-01-01

Abstract:We introduce a new class of protocols called Proofs of Work or Knowledge PoWorKs. In a PoWorK, a prover can convince a verifier that she has either performed work or that she possesses knowledge of a witness to a public statement without the verifier being able to distinguish which of the two has taken place. We formalize PoWorK in terms of three properties, completeness, f-soundness and indistinguishability where f is a function that determines the tightness of the proof of work aspect and present a construction that transforms 3-move HVZK protocols into 3-move public-coin PoWorKs. To formalize the work aspect in a PoWorKï¾¿protocol we define cryptographic puzzles that adhere to certain uniformity conditions, which may also be of independent interest. We instantiate our puzzles in the random oracle RO model as well as via constructing \"dense\" versions of suitably hard one-way functions. We then showcase PoWorKï¾¿protocols by presenting a number of applications. We first show how non-interactive PoWorKs can be used to reduce spam email by forcing users sending an e-mail to either prove to the mail server they are approved contacts of the recipient or to perform computational work. As opposed to previous approaches that applied proofs of work to this problem, our proposal of using PoWorKs is privacy-preserving as it hides the list of the receiver's approved contacts from the mail server. Our second application, shows how PoWorK can be used to compose cryptocurrencies that are based on proofs of work \"Bitcoin-like\" with cryptocurrencies that are based on knowledge relations these include cryptocurrencies that are based on \"proof of stake\", and others. The resulting PoWorK-based cryptocurrency inherits the robustness properties of the underlying two systems while PoWorK-indistinguishability ensures a uniform population of miners. Finally, we show that PoWorKï¾¿protocols imply straight-line quasi-polynomial simulatable arguments of knowledge and based on our construction we obtain an efficient straight-line concurrent 3-move statistically quasi-polynomial simulatable argument of knowledge.
Conformation and Application of Dynamic Public Key Infrastructure

李彪,张申生

DOI: https://doi.org/10.3321/j.issn:1006-2467.2002.09.019

2002-01-01

Abstract:PKI (Public Key Infrastructure) is the basis of secure applications in World Wide Web. The lack of dynamic property in traditional conformation of PKI can not fulfill the security requirements in virtual enterprises. A new conformation of PKI, based on a secret sharing scheme, was proposed to establish the security framework across enterprises and the trust among them.
On the Practicality of Smart Contract PKI

Christos Patsonakis,Katerina Samari,Aggelos Kiayias,Mema Roussopoulos

DOI: https://doi.org/10.1109/DAPPCON.2019.00022

2019-02-03

Abstract:Public key infrastructures (PKIs) are one of the main building blocks for securing communications over the Internet. Currently, PKIs are under the control of centralized authorities, which is problematic as evidenced by numerous incidents where they have been compromised. The distributed, fault tolerant log of transactions provided by blockchains and more recently, smart contract platforms, constitutes a powerful tool for the decentralization of PKIs. To verify the validity of identity records, blockchain-based identity systems store on chain either all identity records, or, a small (or even constant) sized amount of data to verify identity records stored off chain. However, as most of these systems have never been implemented, there is little information regarding the practical implications of each design's tradeoffs. In this work, we first implement and evaluate the only provably secure, smart contract based PKI of [1] on top of Ethereum. This construction incurs constant-sized storage at the expense of computational complexity. To explore this tradeoff, we propose and implement a second construction which, eliminates the need for trusted setup, preserves the security properties of [1] and, as illustrated through our evaluation, is the only version with constant-sized state that can be deployed on the live chain of Ethereum. Furthermore, we compare these two systems with the simple approach of most prior works, e.g., the Ethereum Name Service, where all identity records are stored on the smart contract's state, to illustrate several shortcomings of Ethereum and its cost model. We propose several modifications for fine tuning the model, which would be useful to be considered for any smart contract platform like Ethereum so that it reaches its full potential to support arbitrary distributed applications.

Distributed, Parallel, and Cluster Computing
Provably Secure Identity Based Provable Data Possession.

Yong Yu,Yafang Zhang,Yi Mu,Willy Susilo,Hongyu Liu

DOI: https://doi.org/10.1007/978-3-319-26059-4_17

2015-01-01

Abstract:Provable Data Possession PDP, which enables cloud users to verify the integrity of their outsourced data without retrieving the entire file from cloud servers, is highly essential in secure cloud storage. A majority of the existing PDP schemes rely on the expensive Public Key Infrastructure PKI. In this paper, we eliminate the complex certificate management of PDP by presenting a generic construction of identity-based PDP ID-PDP protocol, derived from identity-based signatures IBS and traditional PDP protocols. We formalize the security model of ID-PDP and prove that the soundness of the generic construction depends on the security of the underlying PDP protocols and the IBS. Then, a concrete ID-PDP protocol is described as an instance of the generic construction to a state-of-the-art PDP protocol due to Shacham and Waters. The implementation shows that our ID-PDP protocol is efficient and practical.
Blockchain-Based Public Key Infrastructure: A Transparent Digital Certification Mechanism for Secure Communication

Aqsa Rashid,Asif Masood,Haider Abbas,Yin Zhang

DOI: https://doi.org/10.1109/mnet.101.2000532

IF: 10.294

2021-01-01

IEEE Network

Abstract:Public Key Infrastructure (PKI) has been considered to be an enabler of secure communication, while, due to its complex and centralized design, there have been instances in the past for Certification Authority's (CA) misbehaving and publishing rogue certificates for targeted attacks. This research aims to present a blockchain-based mechanism that lays down a concrete foundation for creating a transparent and secure block-chain-based mechanism for the issuance and management of digital certificates that enables prevention against CA misbehaving. A prototype is deployed and tested on the Ethereum test network, and the results are made publicly available for verification and validation. As a result, the proposed Ethereum blockchain-based PKI mechanism enables secure, transparent, and auditable issuance and management of digital certificates together with the solution of Sybil, Spoofing, and Man-in-the-Middle (MITM) attacks.
Research and Realization of Wireless Communication Network Security Based on Public Key Infrastructure

张华

DOI: https://doi.org/10.3969/j.issn.1001-893x.2005.01.036

2005-01-01

Abstract:Security is becoming the key issue in current wireless communicating networks. In this paper Public Key Infrastructure( PKI) mechanism is proposed to protect network security. At first PKI is introduced, then the features and limitations of wireless communicating networks are discussed. A creative technology and solution is provided to apply PKI into wireless communicating networks. Finally a demo system using this solution is followed.
The Condition and Future of Research on the Revocation Methods of Digital Certificate

Zhang Manman,Liu Zhiyuan

DOI: https://doi.org/10.3969/j.issn.1008-8245.2007.05.014

2007-01-01

Abstract:Certificate revocation is always a hard problem in the research and application of public key infrastructure(PKI).In this paper,a review of certificate revocation schemes is present.The working principles of all schemes are described,and the advantages and disadvantages of each scheme are analyzed in details.And the future work is outlined in the end.
PKI Technology for Data Encryption

Zhu Zhenfang

Abstract:These PKI is a kind of follow the standard use of public key encryption technology for the development of e-commerce to provide a secure foundation platform technology and specifications. The application of digital certificates is under the network environment to solve the problem such as identity authentication, access control, and information protection. This thesis mainly studied the part of the problem, this paper introduced the basic knowledge of cryptography and PKI theory foundation and basic system, of several common PKI trust model had carried on the detailed introduction, designed the distributed network environment, interconnection security platform of authentication and information encryption module.

Computer Science,Engineering
Public Key Infrastructure: Managing the E-Business Security

XJ Lai

DOI: https://doi.org/10.1007/978-0-387-35515-3_52

2000-01-01

Abstract:With the recent explosive growth of the Internet, more and more business are conducted over the open communication network. The increase of information transmitted electronically has lead to an increased need for security. Cryptographic techniques, especially the public-key cryptographic techniques are used to provide the necessary protection to ensure such business process. The widespread of public-key technology requires a reliable and trusted system to manage public keys. Public-key infrastructure provides such a system for mange the trust of the public keys.
I Have the Proof: Providing Proofs of Past Data Possession in Cloud Forensics

Shams Zawoad,Ragib Hasan

DOI: https://doi.org/10.48550/arXiv.1211.4328

2012-11-19

Abstract:Cloud computing has emerged as a popular computing paradigm in recent years. However, today's cloud computing architectures often lack support for computer forensic investigations. A key task of digital forensics is to prove the presence of a particular file in a given storage system. Unfortunately, it is very hard to do so in a cloud given the black-box nature of clouds and the multi-tenant cloud models. In clouds, analyzing the data from a virtual machine instance or data stored in a cloud storage only allows us to investigate the current content of the cloud storage, but not the previous contents. In this paper, we introduce the idea of building proofs of past data possession in the context of a cloud storage service. We present a scheme for creating such proofs and evaluate its performance in a real cloud provider. We also discuss how this proof of past data possession can be used effectively in cloud forensics.

Cryptography and Security,Distributed, Parallel, and Cluster Computing
Optimal CRL Releasing Strategy in Public Key Infrastructure.

Chengyu Ma,Nan Hu,Yingjiu Li

2006-01-01

Abstract:Public key infrastructure has been proposed as a promising foundation for verifying the authenticity of communicating parties and transferring trust over the internet. One of the key issues in public key infrastructure is how to manage certificate revocations. Various technical solutions dealing with key revocation have been proposed. However, to the best of our best knowledge, no rigorous efforts have been made to understand the behavior of certificate revocation requests based on empirical data. Furthermore, there is no study on the managerial aspect of Certificate Revocation Release. In this study, based on the empirical data collected from VeriSign, we prove that a revocation system will become stable after a period of time. We show that different certificate authorities should take different strategies for releasing different types of certificate revocations. We also provide the exact steps by which certificate authorities can follow to derive optimal releasing strategies.
Windows 2000 Public Key Infrastructure and Electronic Commerce

梁晋,施仁,梁峰,彭波

DOI: https://doi.org/10.3969/j.issn.1000-3428.2000.07.001

2000-01-01

Abstract:This paper introduces the technology of Public Key Infrastructure (PKI) in Windows 2000 and describes how to use it in electronic commerce. Standards for PKI are still evolving even as they are being widely implemented as a necessary element of electronic commerce. There are some new features in Windows 2000's PKI. Windows 2000 will become the ideal platform of electronic commerce.

Resolution of Proof of Possession in Public Key Infrastructure

Lattice-based PKEs/KEMs

Credibility Attestation of Property Remote Attestation Method

Private Proof of Solvency

Improvements on Non-Interactive Zero-Knowledge Proof Systems Related to Quadratic Residuosity Languages.

Decentralized Public Key Infrastructures Atop Blockchain.

A Study on CRL Revocation Delay of PKI

Identity-based Provable Data Possession Revisited: Security Analysis and Generic Construction.

BB-PKI: Blockchain-Based Public Key Infrastructure Certificate Management.

Indistinguishable Proofs of Work or Knowledge.

Conformation and Application of Dynamic Public Key Infrastructure

On the Practicality of Smart Contract PKI

Provably Secure Identity Based Provable Data Possession.

Blockchain-Based Public Key Infrastructure: A Transparent Digital Certification Mechanism for Secure Communication

Research and Realization of Wireless Communication Network Security Based on Public Key Infrastructure

The Condition and Future of Research on the Revocation Methods of Digital Certificate

PKI Technology for Data Encryption

Public Key Infrastructure: Managing the E-Business Security

I Have the Proof: Providing Proofs of Past Data Possession in Cloud Forensics

Optimal CRL Releasing Strategy in Public Key Infrastructure.

Windows 2000 Public Key Infrastructure and Electronic Commerce