The contributions of this thesis fall into three areas of certificateless cryptography. The first area is encryption, where we propose new constructions for both identity-based and certificateless cryptography. We construct an n-out-of- n group encryption scheme for identity-based cryptography that does not require any special means to generate the keys of the trusted authorities that are participating. We also introduce a new security definition for chosen ciphertext secure multi-key encryption. We prove that our construction is secure as long as at least one authority is uncompromised, and show that the existing constructions for chosen ciphertext security from identity-based encryption also hold in the group encryption case. We then consider certificateless encryption as the special case of 2-out-of-2 group encryption and give constructions for highly efficient certificateless schemes in the standard model. Among these is the first construction of a lattice-based certificateless encryption scheme. Our next contribution is a highly efficient certificateless key encapsulation mechanism (KEM), that we prove secure in the standard model. We introduce a new way of proving the security of certificateless schemes based that are based on identity-based schemes. We leave the identity-based part of the proof intact, and just extend it to cover the part that is introduced by the certificateless scheme. We show that our construction is more efficient than any instanciation of generic constructions for certificateless key encapsulation in the standard model. The third area where the thesis contributes to the advancement of certificateless cryptography is key agreement. Swanson showed that many certificateless key agreement schemes are insecure if considered in a reasonable security model. We propose the first provably secure certificateless key agreement schemes in the strongest model for certificateless key agreement. We extend Swanson's definition for certificateless key agreement and give more power to the adversary. Our new schemes are secure as long as each party has at least one uncompromised secret. Our first construction is in the random oracle model and gives the adversary slightly more capabilities than our second construction in the standard model. Interestingly, our standard model construction is as efficient as the random oracle model construction.
The contributions of this thesis fall into three areas of certificateless cryptography. The first area is encryption, where we propose new constructions for both identity-based and certificateless cryptography. We construct an n-out-of- n group encryption scheme for identity-based cryptography that does not require any special means to generate the keys of the trusted authorities that are participating. We also introduce a new security definition for chosen ciphertext secure multi-key encryption. We prove that our construction is secure as long as at least one authority is uncompromised, and show that the existing constructions for chosen ciphertext security from identity-based encryption also hold in the group encryption case. We then consider certificateless encryption as the special case of 2-out-of-2 group encryption and give constructions for highly efficient certificateless schemes in the standard model. Among these is the first construction of a lattice-based certificateless encryption scheme. Our next contribution is a highly efficient certificateless key encapsulation mechanism (KEM), that we prove secure in the standard model. We introduce a new way of proving the security of certificateless schemes based that are based on identity-based schemes. We leave the identity-based part of the proof intact, and just extend it to cover the part that is introduced by the certificateless scheme. We show that our construction is more efficient than any instanciation of generic constructions for certificateless key encapsulation in the standard model. The third area where the thesis contributes to the advancement of certificateless cryptography is key agreement. Swanson showed that many certificateless key agreement schemes are insecure if considered in a reasonable security model. We propose the first provably secure certificateless key agreement schemes in the strongest model for certificateless key agreement. We extend Swanson's definition for certificateless key agreement and give more power to the adversary. Our new schemes are secure as long as each party has at least one uncompromised secret. Our first construction is in the random oracle model and gives the adversary slightly more capabilities than our second construction in the standard model. Interestingly, our standard model construction is as efficient as the random oracle model construction.
In Asiacrypt 2003, Al-Riyami and Paterson proposed the notion of certificateless cryptography, a technique to remove key escrow from traditional identity-based cryptography as well as circumvent the certificate management problem of traditional public key cryptography.Subsequently much research has been done in the realm of certificateless encryption and signature schemes, but little to no work has been done for the identification primitive until 2013 when Chin et al. rigorously defined certificateless identification and proposed a concrete scheme.However Chin et al.'s scheme was proven in the random oracle model and Canetti et al. has shown that certain schemes provable secure in the random oracle model can be insecure when random oracles are replaced with actual hash functions.Therefore while having a proof in the random oracle model is better than having no proof at all, a scheme to be proven in the standard model would provide stronger security guarantees.In this paper, we propose the first certificateless identification scheme that is both efficient and show our proof of security in the standard model, that is without having to assume random oracles exist.
Certificateless cryptography aims at combining the advantages of identity based and public key cryptography in order to avoid the key escrow problem inherent in the identity based cryptography and cumbersome certificate management in the traditional public key infrastructure. A new two party certificateless key agreement protocol (CL-KA) is proposed and we proved it secure in the random oracle model (ROM). Our protocol only requires each entity to compute one pairing, up to now, it turns out to be the most efficient one of all the previously known CL-KA schemes.
Cryptographic protocols are used to encrypt data during their transmission over a network or to store it on a data carrier. This thesis is about the method of identity-based encryption. In this form of encryption, the name or identity of the target subject is used to encrypt the data. This property makes it a perfect tool for modern electronic communication, because all involved identities and endpoint addresses (e.g. IP addresses) have to be unique worldwide and must be known in order to establish a communication. The identity-based key agreement protocol that has been invented in this thesis has several advantages compared to existing schemes. One important property is its complete independence of key generators. This independence allows each participating security domain to set up and maintain its own key generator. They are not forced to agree on a common setup or a common secret anymore. Due to the properties of the protocol, the security domains are still compatible to each other. Users from one security domain can communicate with users from another security domain using encryption. This new property of independence is also carried over to a signature protocol. It allows users from different security domains to sign a certain object. Additionally, the act of signing is independent and the signers do not need to communicate with each other. Apart from the protocol and its security proofs with respect to standard definitions from the literature, the thesis contains an analysis of existing schemes. Attacks on known protocols and assumptions are presented, and it is shown under which circumstances these become insecure. On the one hand, a completely new approach that is based on defined or rather undefined objects in discrete structures is used. On the other hand, the method of lattice based reduction is successfully applied to the new area of secret sharing schemes. Finally, application scenarios for the protocol are presented. These scenarios are chosen such that the advantages of the protocol become apparent. Cryptographic protocols are used to encrypt data during their transmission over a network or to store it on a data carrier. This thesis is about the method of identity-based encryption. In this form of encryption, the name or identity of the target subject is used to encrypt the data. This property makes it a perfect tool for modern electronic communication, because all involved identities and endpoint addresses (e.g. IP addresses) have to be unique worldwide and must be known in order to establish a communication. The identity-based key agreement protocol that has been invented in this thesis has several advantages compared to existing schemes. One important property is its complete independence of key generators. This independence allows each participating security domain to set up and maintain its own key generator. They are not forced to agree on a common setup or a common secret anymore. Due to the properties of the protocol, the security domains are still compatible to each other. Users from one security domain can communicate with users from another security domain using encryption. This new property of independence is also carried over to a signature protocol. It allows users from different security domains to sign a certain object. Additionally, the act of signing is independent and the signers do not need to communicate with each other. Apart from the protocol and its security proofs with respect to standard definitions from the literature, the thesis contains an analysis of existing schemes. Attacks on known protocols and assumptions are presented, and it is shown under which circumstances these become insecure. On the one hand, a completely new approach that is based on defined or rather undefined objects in discrete structures is used. On the other hand, the method of lattice based reduction is successfully applied to the new area of secret sharing schemes. Finally, application scenarios for the protocol are presented. These scenarios are chosen such that the advantages of the protocol become apparent. The first application is telephony, GSM as well as Voice over IP (VoIP). In this case, the telephone number of the callee is used as the encryption key. Implementations on a modern mobile phone as well as within existing Voice over IP software are presented. The second application is IP networks. Here, the IP address of a communication unit is used as the encryption key. However, in this case, there are more problems than in the GSM/VoIP case, e.g., dynamic IP addresses or network address translation (NAT) where an IP address is substituted by another one. These are only two problems out of several for which solutions are presented.
A pairing-free certificateless two party key agreement scheme(CL-KA) is proposed.This work is able demonstrates all existing CL-KA schemes(except for Lippold's scheme) are insecure in the eCK model.The scheme is secure in the eCK model as long as each party has at least one uncompromised secret.The scheme has proven to be secure in the random oracle model(ROM),assuming that the computational Diffie-Hellman assumption hold even if the key generation centre(KGC) learns the ephemeral secrets of both parties,or reveal secret values/replace public keys,but not both.The scheme eliminates pairing computation.It achieves efficiency in computational cost when compared with all the other known certificateless key agreement schemes.The scheme is more suitable for the restricted bandwidth of the communication environment,such as ad hoc networks,wireless sensors,and so on.
A group key exchange (GKE) protocol allows a set of parties to agree upon a common secret session key over a public network. In this thesis, we focus on designing efficient GKE protocols using public key techniques and appropriately revising security models for GKE protocols. For the purpose of modelling and analysing the security of GKE protocols we apply the widely accepted computational complexity approach. The contributions of the thesis to the area of GKE protocols are manifold. We propose the first GKE protocol that requires only one round of communication and is proven secure in the standard model. Our protocol is generically constructed from a key encapsulation mechanism (KEM). We also suggest an efficient KEM from the literature, which satisfies the underlying security notion, to instantiate the generic protocol. We then concentrate on enhancing the security of one-round GKE protocols. A new model of security for forward secure GKE protocols is introduced and a generic one-round GKE protocol with forward security is then presented. The security of this protocol is also proven in the standard model. We also propose an efficient forward secure encryption scheme that can be used to instantiate the generic GKE protocol. Our next contributions are to the security models of GKE protocols. We observe that the analysis of GKE protocols has not been as extensive as that of two-party key exchange protocols. Particularly, the security attribute of key compromise impersonation (KCI) resilience has so far been ignored for GKE protocols. We model the security of GKE protocols addressing KCI attacks by both outsider and insider adversaries. We then show that a few existing protocols are not secure against KCI attacks. A new proof of security for an existing GKE protocol is given under the revised model assuming random oracles. Subsequently, we treat the security of GKE protocols in the universal composability (UC) framework. We present a new UC ideal functionality for GKE protocols capturing the security attribute of contributiveness. An existing protocol with minor revisions is then shown to realize our functionality in the random oracle model. Finally, we explore the possibility of constructing GKE protocols in the attribute-based setting. We introduce the concept of attribute-based group key exchange (AB-GKE). A security model for AB-GKE and a one-round AB-GKE protocol satisfying our security notion are presented. The protocol is generically constructed from a new cryptographic primitive called encapsulation policy attribute-based KEM (EP-AB-KEM), which we introduce in this thesis. We also present a new EP-AB-KEM with a proof of security assuming generic groups and random oracles. The EP-AB-KEM can be used to instantiate our generic AB-GKE protocol.