The rapid growth of the Internet of Things (IoT) introduces challenges in secure authentication and delegation due to the limited computational capabilities of devices. Proxy signature schemes offer an effective solution by enabling controlled delegation of signing rights to more capable entities, such as gateway nodes. However, most existing schemes rely on classical assumptions that are likely to be broken by quantum adversaries. In this work, we address these challenges by proposing an isogeny-based post-quantum proxy signature scheme, CSI-PS. The scheme leverages the hardness of the Group Action Inverse Problem (GAIP) to provide post-quantum security in a gateway-assisted IoT setting. In the proposed construction, expensive isogeny-based operations are assigned to resource-capable entities such as IoT gateways, while sensor nodes only transmit data to the gateway. We provide explicit storage, communication, Merkle-authentication, key-distribution, and setup-cost accounting to clarify the practical deployment profile of the construction. Our analysis shows that the proposed scheme strikes an effective balance between security and efficiency in terms of computation and communication overhead, along with provable security under the EUF-CMA notion.
The rapid growth of the Internet of Things (IoT) introduces challenges in secure authentication and delegation due to the limited computational capabilities of devices. Proxy signature schemes offer an effective solution by enabling controlled delegation of signing rights to more capable entities, such as gateway nodes. However, most existing schemes rely on classical assumptions that are likely to be broken by quantum adversaries. In this work, we address these challenges by proposing an isogeny-based post-quantum proxy signature scheme, CSI-PS. The scheme leverages the hardness of the Group Action Inverse Problem (GAIP) to provide post-quantum security in a gateway-assisted IoT setting. In the proposed construction, expensive isogeny-based operations are assigned to resource-capable entities such as IoT gateways, while sensor nodes only transmit data to the gateway. We provide explicit storage, communication, Merkle-authentication, key-distribution, and setup-cost accounting to clarify the practical deployment profile of the construction. Our analysis shows that the proposed scheme strikes an effective balance between security and efficiency in terms of computation and communication overhead, along with provable security under the EUF-CMA notion.
Proxy signatures enable the secure delegation of signing authority, which is particularly useful in resource-constrained Internet of Things (IoT) environments. However, most existing schemes rely on classical hardness assumptions and therefore cannot resist quantum attacks. To address the challenge, we propose a post-quantum proxy signature scheme based on Dilithium for IoT scenarios. We first propose an asynchronous remote key generation (ARKG) scheme based on CRYSTALS-Kyber, enabling the delegator and proxy signer to generate proxy keys of Dilithium without real-time interaction. We further integrate ARKG with the Dilithium signature scheme to construct a proxy signature scheme called DPS while ensuring the unlinkability of proxy signatures. Additionally, our proposed DPS achieves post-quantum security and provides unforgeability, distinguishability, verifiability, and undeniability with formal proofs. Experimental performance evaluation shows that our scheme yields significant efficiency gains over existing quantum-safe proxy signature solutions, with 10× speedup for both the delegation and proxy signing phases, as well as a 2.4× improvement in the verification phase.
The Internet of Things (IoT) needs complex sensor networks.The increasing number of sensors and their networks underlines the importance of network security.Traditional digital signature schemes validate signatures from each node of networks, which need huge resources for storage and computation.To reduce the resources needed for security, a new scheme with a proxy signature is proposed.If an IoT application adopts the scheme and assigns its signing rights to the underlying nodes, the storage of their public keys is no longer necessary as the application trusts the signing rights.The development of computing technology introduces many risks to cryptographic schemes with a traditional digital signature, and a system with improved security at the quantum-resistant level is required.We propose a scheme with lattice-based cryptography using the bonsai-tree technique for a security system.The new scheme effectively protects the system from a chosen static message attack in the standard model.In the new scheme, an IoT application securely recognizes its honest nodes in the underlying sensor networks at a low storage cost, even in quantum computing.
Proxy re-signature enables transitive authentication of digital identities across different domains and has significant application value in areas such as digital rights management, cross-domain certificate validation, and distributed system access control. However, most existing proxy re-signature schemes, which are predominantly based on traditional public-key cryptosystems, face security vulnerabilities and certificate management bottlenecks. While identity-based schemes alleviate some issues, they introduce key escrow concerns. Certificateless schemes effectively resolve both certificate management and key escrow problems but remain vulnerable to quantum computing threats. To address these limitations, this paper constructs an efficient post-quantum certificateless proxy re-signature scheme based on algebraic lattices. Building upon algebraic lattice theory and leveraging the Dilithium algorithm, our scheme innovatively employs a lattice basis reduction-assisted parameter selection strategy to mitigate the potential algebraic attack vectors inherent in the NTRU lattice structure. This ensures the security and integrity of multi-party communication in quantum-threat environments. Furthermore, the scheme significantly reduces computational overhead and optimizes signature storage complexity through structured compression techniques, facilitating deployment on resource-constrained devices like Internet of Things (IoT) terminals. We formally prove the unforgeability of the scheme under the adaptive chosen-message attack model, with its security reducible to the hardness of the corresponding underlying lattice problems.
The imminent advent of quantum computing threatens the long-term security of classical public-key cryptography, creating critical challenges for resource-constrained internet of things (IoT) environments.Hybrid cryptographic frameworks combining elliptic curve cryptography (ECC) with post-quantum cryptography (PQC) primitives have emerged as a transitional solution; however, their security properties remain insufficiently validated under semi-trusted infrastructure assumptions.This paper presents a comprehensive security evaluation of a hybrid ECC-KEM authentication and key agreement framework targeting IoT deployments.Using a dual-verification methodology that integrates formal symbolic analysis with the Tamarin-Prover and practical AI-assisted testing via the APSVer tool, we identify a critical impersonation vulnerability that enables a semi-trusted third party (TTP) to reconstruct PUF-based authentication material.To mitigate this flaw, we introduce a protocol enhancement incorporating ML-DSA post-quantum digital signatures and device-isolated key derivation.Formal verification confirms that the enhanced protocol achieves mutual authentication, session key secrecy, replay resistance, and effective isolation of the TTP.Experimental performance analysis demonstrates that the proposed security improvements introduce only a 12%-15% computational overhead, preserving feasibility for constrained IoT devices.The proposed framework provides a practical, quantum-resilient authentication architecture suitable for next-generation secure IoT deployments.
The Internet of Things (IoT) is a growing area of technology and has been identified as a key tool for enhancing industries' operation and performance. As IoT deployment rises worldwide, so do the threats; hence, security, especially authen-tication and integrity, is a critical consideration. One significant future threat is quantum attacks, which can only be defeated using Post-Quantum (PQ) cryptosystems. New Digital Signature (DS) standards for PQ security have been selected by the US National Institute of Standards and Technology (NIST). However, IoT comes with its own technical challenges from the constrained resources allocated to sensors and other similar devices. As a consequence, the use and suitability of these PQ schemes for IoT remains an open research area. In this paper, we identify an IoT architecture built from three distinct layers represented by a server, a gateway and an IoT device, respectively. We first test PQ DS scheme standards and compare them with current standards in order to assess their practicality for use in this architecture to provide authentication and integrity. Then, we select the most suitable PQ scheme at each layer according to the features of the corresponding device (server, gateway, IoT device) and the security property (authentication, integrity). We finally carry out experiments on our selection and provide an architectural model for making IoT communication and interaction PQ secure.
The Edge-computing era presents opportunities for the rapid development of the Internet of Things (IoT), where identity authentication is fundamental to ensuring IoT security. However, under post-quantum attacks, traditional identity authentication schemes that rely on signcryption to generate node keys face challenges due to the high number of IoT nodes. These schemes consume significant resources, making it difficult to meet the low-cost requirements of IoT. Against the backdrop of the rapid development of new media and the increasingly growing security demands for resource-constrained consumer electronic edge devices, a lightweight group signcryption authentication scheme based on lattice cryptography is proposed. During the key generation phase, an improved trapdoor diagonal matrix is designed, optimizing the preimage sampling algorithm required for key generation and reducing the total time needed to generate multiple keys. In the identity authentication phase, based on the leftover hash lemma and the properties of signcryption, the scheme allows for simultaneous signing and encryption of messages in a single logical step. A low-interaction protocol combining dot products and hash operations is proposed, enabling group leaders to perform access authentication on behalf of group members. Simulation results show that the scheme reduces the number of interactions required for IoT device access, lowers computational costs during identity authentication, and reduces the total cost of signcryption and un-signcryption by at least 7% compared to existing schemes. Additionally, it is demonstrated that this scheme can resist post-quantum attacks in IoT environments.