DOCSLIB.ORG

Análisis E Implementación Eficiente De Protocolos Criptográficos De Llave

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Análisis E Implementación Eficiente De Protocolos Criptográficos De Llave Centro de Investigacion´ y de Estudios Avanzados del Instituto Politecnico´ Nacional Unidad Zacatenco Departamento de Computacion´ An´alisis e implementaci´oneficiente de protocolos criptogr´aficosde llave p´ublica Tesis que presenta Jos´eEduardo Ochoa Jim´enez para obtener el grado de Doctor en Ciencias en Computaci´on Director de tesis Dr. Francisco Jos´eRamb´oRodr´ıguezHenr´ıquez Ciudad de M´exico Febrero, 2019 ii Center for Research and Advanced Studies of National Polytechnic Institute Zacatenco campus Computer science department Analysis and efficient implementation of public key cryptographic protocols Submitted by Jos´eEduardo Ochoa Jim´enez for the degree of Ph.D. in Computer Science Advisor Francisco Jos´eRamb´oRodr´ıguezHenr´ıquez,Ph.D. Mexico City February, 2019 iv Dedication To my family. v vi Acknowledgements I thank my advisor Francisco Rodr´ıguez-Henr´ıquezfor his guidance and support during my Ph.D. studies. I also thank my friends from the cryptography laboratory for sharing their knowledge and for having shared with me hard and good times. I thank the Consejo Nacional de Ciencia y Tecnolog´ıaCONACyT for the scholarship pro- vided to me during the period that I was a Ph.D. candidate at Cinvestav. And finally, a special thanks to the Department staff who supported me during my Ph.D. research. vii viii Resumen Durante las ´ultimascuatro d´ecadas,el paradigma de la criptograf´ıa de llave p´ublica ha brindado soluciones elegantes a diversos problemas dif´ıcilesque surgen de aplicaciones contempor´aneasde seguridad de la informaci´on.Ejemplos de estos problemas incluyen: au- tenticaci´onde entidades, anonimato, no repudio, por nombrar s´oloalgunos. No obstante, la implementaci´oneficiente de la criptograf´ıade llave p´ublica implica el c´alculode operaciones aritm´eticasno triviales sobre operandos extremadamente grandes. Por tal motivo, el objetivo principal de esta tesis es analizar cuidadosamente algunos de los protocolos criptogr´aficosde llave p´ublicam´aspopulares, con la finalidad de identificar las operaciones cr´ıticasque influ- yen significativamente en el costo computacional de dichos esquemas. Una vez identificadas estas operaciones, nuestro siguiente objetivo es proponer mejoras algor´ıtmicasy/o de imple- mentaci´onque permitan reducir significativamente el tiempo de ejecuci´onde estos protocolos, mientras se mantiene la seguridad en contra de ataques de canal lateral de los esquemas. Este trabajo de investigaci´onexamina tres sub´areasdiferentes de la criptograf´ıade llave p´ublica,es decir, esquemas basados en la factorizaci´onde n´umerosenteros, emparejamientos e isogenias. Las primeras dos sub´areasse han utilizado e implementado intensamente en innumerables aplicaciones de seguridad de la informaci´on.Mientras que el ´ultimoesquema es un candida- to prometedor para realizar el intercambio de llaves secretas en un escenario post-cu´antico, donde se supone que ya se encuentran disponibles computadoras cu´anticas suficientemente poderosas. Nuestro estudio comienza realizando un an´alisiscuidadoso de la implementaci´on eficiente de la aritm´eticaentera y de campos finitos en las micro-arquitecturas de los pro- cesadores m´asrecientes. Este an´alisisnos permiti´odise~naruna biblioteca de software que es utilizada para implementar de manera segura el algoritmo de firma RSA. De la sub´area de criptograf´ıabasada en emparejamientos, se aborda el problema general del \hashing" de tiempo constante hacia curvas el´ıpticas,donde se proponen algoritmos pr´acticos,eficientes y seguros para realizar el \hashing" a los subgrupos de curva el´ıpticautilizados en este tipo de protocolos. Adem´as,se dise~n´ouna biblioteca de software que implementa dos protocolos de autenticaci´onde dos factores, los cuales son seguros contra ataques simples de canal lateral. Por otra parte, proponemos el uso de emparejamientos sobre curvas el´ıpticascon grado de encajamiento uno para implementar el protocolo de firma corta propuesto por Boneh, Lynn y Shacham (BLS). Nuestro esquema aprovecha el hecho de que la mejora algor´ıtmicapara el c´alculode logaritmos discretos, reportado recientemente por Kim y Barbulescu, no se aplica al escenario cuando el \Discrete Logarithm Problem" (DLP) se calcula en campos finitos de orden primo. En el caso de la criptograf´ıabasada en isogenias, se proponen diversas optimiza- ciones algor´ıtmicascuyo objetivo es mejorar el desempe~node las operaciones aritm´eticasde curvas el´ıpticasy campos finitos. Estas optimizaciones producen una aceleraci´onimportante del tiempo de ejecuci´ondel protocolo \Supersingular Isogeny Diffie-Hellman" (SIDH). Fi- nalmente, se presenta una nueva construcci´ondel protocolo SIDH, utilizando isogenias cuyo grado no es una potencia de un primo, la cual permite conseguir una aceleraci´onconsiderable en su c´alculo. ix x Abstract During the last four decades, the public-key cryptography paradigm has provided ele- gant solutions to several difficult problems that arise in contemporary information security applications. Examples of these problems include, entity authentication, anonymity, non- repudiation to name just a few. Nevertheless, the efficient implementation of public-key cryptography involves the computation of non-trivial arithmetic operations with extremely large operands. Accordingly, the main research goal of this thesis is to carefully analyze some of the most popular public key cryptographic protocols with the aim of identifying critical operations that significantly influence the whole computational cost of those schemes. Once that these operations were identified, our next objective was to propose algorithmic and/or implementation improvements that allow us to obtain significant speedups in the running time of those protocols, while keeping a sound security of those schemes against side-channel attacks. In this research work, we examine three different sub-areas of public-key cryptog- raphy, namely, Integer-factorization-based, pairing-based and isogeny-based cryptographic schemes. The first two sub-areas have been intensively used and deployed in innumerable information security applications. The last sub-area is a promising candidate for computing secret key-exchange in a post-quantum scenario, where it is assumed that powerful quantum computers are already available. Taking into account practical considerations, we started our study by performing a careful analysis of the efficient implementation of integer and finite field arithmetic over the newest desktop micro-architectures. In this study, different techniques for the efficient computation of modular multiplication were especially analyzed due to the large influence of this operation in the performance achieved by the cryptographic schemes studied in this work. This study allows us to design a software library used for implementing the RSA signature algorithm in a secure way. In the case of pairing-based cryptography, we discuss the general problem of constant-time hashing into elliptic curves and we propose practical, efficient, and secure algorithms for hashing values to elliptic curve subgroups used in pairing-based cryptographic protocols. Moreover, we design a software library that implements two pairing-based two-factor authentication protocols, which allows to thwart simple side-channel attacks. Then, we also propose the usage of pairings over elliptic curves with embedding degree one to implement the Boneh, Lynn and Shacham (BLS) short signature protocol. Our scheme takes advantage of the fact that the algorithmic improvement for computing discrete logarithms recently reported by Kim and Barbulescu, do not apply to the scenario when the Discrete Logarithm Problem (DLP) is computed on prime-order fields Fp. In the case of isogeny-based cryptography, we proposed several al- gorithmic optimizations targeting both elliptic curve and finite field arithmetic operations. These optimizations yielded an important speedup in the runtime cost of the Supersingular Isogeny Diffie-Helmann (SIDH) protocol. Finally, we presented a new construction of the SIDH using non-prime power degree isogenies in the Bob's side, which allows us to achieve a considerable speedup in its computation. xi Cinvestav xii Contents 1. Introduction 13 1.1. Motivation..................................... 15 1.2. Outline....................................... 16 2. Mathematical background 17 2.1. Groups........................................ 17 2.1.1. Subgroups.................................. 19 2.1.2. Cyclic groups................................ 19 2.1.3. Cosets.................................... 20 2.1.4. Group homomorphisms.......................... 21 2.2. Rings........................................ 22 2.3. Fields........................................ 24 2.3.1. Field extensions.............................. 25 2.4. Elliptic curves.................................... 26 2.4.1. The group law............................... 27 2.4.2. Elliptic curves over finite fields...................... 30 2.5. Discrete Logarithm Problem (DLP)....................... 32 I Integer-factorization-based cryptography 33 3. Integer and finite field arithmetic 35 3.1. Representation of large integers.......................... 35 3.2. Arithmetic instructions in processors....................... 36 3.2.1. AVX2 instruction set............................ 36 3.3. Integer arithmetic................................. 37 3.3.1. Addition and subtraction......................... 37 3.3.2. Multiplication................................ 38 3.3.3. Squaring................................... 41 3.3.4. Modular
Load more

Recommended publications
  • Public Auditing for Secure and Efficient Cloud Data Storage: a Comprehensive Survey
    Vol-7 Issue-4 2021 IJARIIE-ISSN(O)-2395-4396 Public Auditing for Secure and Efficient Cloud Data Storage: A Comprehensive Survey 1Ayesha Siddiqha Mukthar, 2Dr. Jitendra Sheetlani 1Research Scholar, Sri Satya Sai University of Technology and Medical Sciences, Sehore 2Associate Professor, Sri Satya Sai University of Technology and Medical Sciences, Sehore Abstract: Nowadays storage of data is big problem because the huge generation of multimedia data likes images, audio, video etc. whose size is very large. For storing of these data size of conventional storage is not sufficient so we need remote storage such as cloud which is resilient infrastructure, reliable and high quality performance for the cloud users. In the cloud there is no direct physical control over the records because the cloud uses its resource pool for storing. Consequently data reliability fortification and auditing is not a modest task. The user prerequisites to depend on a Third Party Auditor (TPA) who is working as a public auditor for authenticating the data integrity and privacy. This paper presents the various auditing techniques of cloud computing for improving security and then future research challenges which need to be adopt by researchers to make system obvious. Keywords: Auditing, Cloud Computing, Storage, TPA, Reliability, Integrity. Introduction: Cloud is offering the different services to its users. Data sharing between two organizations which common in many application areas. The current data sharing and integration among various organizations requires the central and trusted authority to collect data from all data sources and then integrate the collected data. In current trend, there is necessary condition which defines the data sharing while preserving privacy in cloud.
    [Show full text]
  • On the Implementation of Pairing-Based Cryptosystems a Dissertation Submitted to the Department of Computer Science and the Comm
    ON THE IMPLEMENTATION OF PAIRING-BASED CRYPTOSYSTEMS A DISSERTATION SUBMITTED TO THE DEPARTMENT OF COMPUTER SCIENCE AND THE COMMITTEE ON GRADUATE STUDIES OF STANFORD UNIVERSITY IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF DOCTOR OF PHILOSOPHY Ben Lynn June 2007 c Copyright by Ben Lynn 2007 All Rights Reserved ii I certify that I have read this dissertation and that, in my opinion, it is fully adequate in scope and quality as a dissertation for the degree of Doctor of Philosophy. Dan Boneh Principal Advisor I certify that I have read this dissertation and that, in my opinion, it is fully adequate in scope and quality as a dissertation for the degree of Doctor of Philosophy. John Mitchell I certify that I have read this dissertation and that, in my opinion, it is fully adequate in scope and quality as a dissertation for the degree of Doctor of Philosophy. Xavier Boyen Approved for the University Committee on Graduate Studies. iii Abstract Pairing-based cryptography has become a highly active research area. We define bilinear maps, or pairings, and show how they give rise to cryptosystems with new functionality. There is only one known mathematical setting where desirable pairings exist: hyperellip- tic curves. We focus on elliptic curves, which are the simplest case, and also the only curves used in practice. All existing implementations of pairing-based cryptosystems are built with elliptic curves. Accordingly, we provide a brief overview of elliptic curves, and functions known as the Tate and Weil pairings from which cryptographic pairings are derived. We describe several methods for obtaining curves that yield Tate and Weil pairings that are efficiently computable yet are still cryptographically secure.
    [Show full text]
  • Short Signatures from the Weil Pairing∗
    Short Signatures from the Weil Pairing∗ Dan Boneh† Ben Lynn Hovav Shacham [email protected] [email protected] [email protected] Abstract We introduce a short signature scheme based on the Computational Diffie-Hellman assump- tion on certain elliptic and hyper-elliptic curves. For standard security parameters, the signature length is about half that of a DSA signature with a similar level of security. Our short signature scheme is designed for systems where signatures are typed in by a human or are sent over a low-bandwidth channel. We survey a number of properties of our signature scheme such as signature aggregation and batch verification. 1 Introduction Short digital signatures are needed in environments with strong bandwidth constraints. For ex- ample, product registration systems often ask users to key in a signature provided on a CD label. When a human is asked to type in a digital signature, the shortest possible signature is needed. Similarly, due to space constraints, short signatures are needed when one prints a bar-coded digital signature on a postage stamp [50, 45]. As a third example, consider legacy protocols that allocate a fixed short field for non-repudiation [1, 32]. One would like to use the most secure signature that fits in the allotted field length. The two most frequently used signatures schemes, RSA and DSA, produce relatively long sig- natures compared to the security they provide. For example, when one uses a 1024-bit modulus, RSA signatures are 1024 bits long. Similarly, when one uses a 1024-bit modulus, standard DSA signatures are 320 bits long.
    [Show full text]
  • Multi-Use Unidirectional Proxy Re-Signatures Benoît Libert, Damien Vergnaud
    Multi-Use Unidirectional Proxy Re-Signatures Benoît Libert, Damien Vergnaud To cite this version: Benoît Libert, Damien Vergnaud. Multi-Use Unidirectional Proxy Re-Signatures. 2008 ACM Con- ference on Computer and Communications Security, CCS 2008, 2008, Alexandria, United States. pp.511-520, 10.1145/1455770.1455835. inria-00357568 HAL Id: inria-00357568 https://hal.inria.fr/inria-00357568 Submitted on 30 Jan 2009 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Multi-Use Unidirectional Proxy Re-Signatures? Beno^ıtLibert1 and Damien Vergnaud2 1 Universit´eCatholique de Louvain, Microelectronics Laboratory Place du Levant, 3 { 1348 Louvain-la-Neuve { Belgium 2 Ecole Normale Sup´erieure{ C.N.R.S. { I.N.R.I.A. 45, Rue d'Ulm { 75230 Paris CEDEX 05 { France Abstract. In 1998, Blaze, Bleumer, and Strauss suggested a cryptographic primitive termed proxy re-signature in which a proxy transforms a signature computed under Alice's secret key into one from Bob on the same message. The proxy is only semi-trusted in that it cannot learn any signing key or sign arbitrary messages on behalf of Alice or Bob. At CCS 2005, Ateniese and Hohenberger revisited this primitive by providing appropriate security definitions and efficient constructions in the random oracle model.
    [Show full text]
  • Implementation Issues in the Construction of an Application Framework for Secure SMS Messages on Android Smartphones
    SECURWARE 2015 : The Ninth International Conference on Emerging Security Information, Systems and Technologies Implementation Issues in the Construction of an Application Framework for Secure SMS Messages on Android Smartphones Alexandre Melo Braga12, Romulo Zanco Neto1, André Luiz Vannucci1, and Ricardo Shiguemi Hiramatsu1 1 Centro de Pesquisa e Desenvolvimento em Telecomunicações (Fundação CPqD) Campinas, São Paulo, Brazil 2 Universidade Estadual de Campinas (UNICAMP) Campinas, São Paulo, Brazil Email:{ambraga,romulozn,vannucci,ricardoh}@cpqd.com.br Abstract—This paper details the construction of an application bytes long, but provide the same security level of framework for SMS security that provides secrecy, integrity, conventional signatures with at least twice its size. Such a authentication, and non-repudiation for SMS messages. The small length saves space in message payload, so that an proposed framework integrates authenticated encryption and authenticated message can occupy only a single SMS. short digital signatures to management services for The resulting application framework for SMS security is cryptographic keys and digital certificates. The framework part of an integrated infrastructure for mobile security on hides from final users all details concerning certificate and key mobile devices [5][6], that provides strong cryptography management. A flexible trade-off between security objectives [3][4] to security-aware mobile applications [1][2]. and message length makes it possible to offer three levels of The text is organized as follows. Section II offers security: (i) secrecy only, (ii) secrecy and message background information about SMS internal workings. authentication, and (iii) secrecy, origin authentication and non- repudiation. The main contribution is the use of short Section III provides related work on SMS security.
    [Show full text]
  • Report on Pairing-Based Cryptography
    Volume 120 (2015) http://dx.doi.org/10.6028/jres.120.002 Journal of Research of the National Institute of Standards and Technology Report on Pairing-based Cryptography Dustin Moody, Rene Peralta, Ray Perlner, Andrew Regenscheid, Allen Roginsky, and Lily Chen National Institute of Standards and Technology, Gaithersburg, MD 20899 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] This report summarizes study results on pairing-based cryptography. The main purpose of the study is to form NIST’s position on standardizing and recommending pairing-based cryptography schemes currently published in research literature and standardized in other standard bodies. The report reviews the mathematical background of pairings. This includes topics such as pairing-friendly elliptic curves and how to compute various pairings. It includes a brief introduction to existing identity-based encryption (IBE) schemes and other cryptographic schemes using pairing technology. The report provides a complete study of the current status of standard activities on pairing-based cryptographic schemes. It explores different application scenarios for pairing-based cryptography schemes. As an important aspect of adopting pairing-based schemes, the report also considers the challenges inherent in validation testing of cryptographic algorithms and modules. Based on the study, the report suggests an approach for including pairing-based cryptography schemes in the NIST cryptographic toolkit. The report also outlines several questions that will require further study if this approach is followed. Key words: IBE; identity-based encryption; pairing-based cryptography; pairings. Accepted: January 21, 2015 Published: February 3, 2015 http://dx.doi.org/10.6028/jres.120.002 1.
    [Show full text]
  • Outsourcing Data Storage Without Outsourcing Trust in Cloud Computing
    Outsourcing Data Storage without Outsourcing Trust in Cloud Computing by Aiiad A. Albeshri Bachelor of Science (Computer Science), KAU, Saudi Arabia – 2002 Master of Information Technology (QUT) – 2007 Thesis submitted in accordance with the regulations for Degree of Doctor of Philosophy School of Electrical Engineering and Computer Science Science and Engineering Faculty Queensland University of Technology July 2013 Keywords Cloud Computing, Cloud Security, Cloud Storage, Cloud Storage Se- curity, Geographic Assurance, Data Replication, Trust in the Cloud i ii Abstract Cloud computing has emerged as a major ICT trend and has been acknowledged as a key theme of industry by prominent ICT organisations. This new paradigm delivers a large pool of virtual and dynamically scalable resources, including com- putational power, storage, hardware platforms and applications, to users via In- ternet technologies. Examples of these benefits include increases in flexibility and budgetary savings through minimisation of hardware and software investments. It would appear that cloud customers are enthusiastic about being allowed to store their data in the cloud but at the same time they want personal satis- faction and the comfort of checking for themselves (or through a trusted third party) that their data is protected. The main theme of this thesis is to allow the users of the cloud services to outsource their data without the need to trust the cloud provider. Specifically, cloud customers will be able to verify the confiden- tiality, integrity, availability, fairness (or mutual non-repudiation), data freshness, geographic assurance and replication of their data. The thesis first addresses the security requirements for cloud storage as iden- tified from the literature.
    [Show full text]
  • Privately Outsourcing Exponentiation to a Single Server: Cryptanalysis and Optimal Constructions
    Privately Outsourcing Exponentiation to a Single Server: Cryptanalysis and Optimal Constructions C´elineChevalier∗ Fabien Laguillaumiey Damien Vergnaudz Abstract We address the problem of speeding up group computations in cryptography using a single untrusted computational resource. We analyze the security of an efficient protocol for securely outsourcing multi- exponentiations proposed at ESORICS 2014. We show that this scheme does not achieve the claimed security guarantees and we present several practical polynomial-time attacks on the delegation protocol which allows the untrusted helper to recover part (or the whole) of the device secret inputs. We then pro- vide simple constructions for outsourcing group exponentiations in different settings (e.g. public/secret, fixed/variable bases and public/secret exponents). Finally, we prove that our attacks on the ESORICS 2014 protocol are unavoidable if one wants to use a single untrusted computational resource and to limit the computational cost of the limited device to a constant number of (generic) group operations. In particular, we show that our constructions are actually optimal. Keywords. Secure outsource computation, Cryptanalysis, Coppersmith methods, Protocols, Optimal- ity results 1 Introduction We address the problem of \outsourcing" computation from a (relatively) weak computational device to a more powerful entity. This problem has been considered in various settings since many years (distributed- computing projects { e.g., Mersenne prime search { or cloud computing) but the proliferation of mobile devices, such as smart phones or RFID tags, provides yet another venue in which a computationally weak device would like to be able to outsource a costly operation to a third party helper. Low-cost RFID tags do not usually have the computational or memory resources to perform complex cryptographic operations and it is natural to outsource these operations to some helper.
    [Show full text]
  • Real-Time Digital Signatures for Time-Critical Networks
    IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 12, NO. 11, NOVEMBER 2017 2627 Real-Time Digital Signatures for Time-Critical Networks Attila Altay Yavuz, Member, IEEE, Anand Mudgerikar, Ankush Singla, Ioannis Papapanagiotou, Senior Member, IEEE, and Elisa Bertino Fellow, IEEE Abstract— The secure and efficient operation of time-critical infrastructures possible. Such infrastructures will usher networks, such as vehicular networks, smart-grid, and other automation in a large number of application domains such as smart-infrastructures, is of primary importance in today’s soci- transportation, manufacturing, smart-grid and urban life (e.g. ety. It is crucial to minimize the impact of security mechanisms over such networks so that the safe and reliable operations Smart-city). of time-critical systems are not being interfered. For instance, Because of their control capabilities and pervasive data if the delay introduced by the crypto operations negatively acquisition, securing such smart-infrastructures is a critical affects the time available for braking a car before a collision, requirement. Even though many security techniques are avail- the car may not be able to safely stop in time. In particular, able, their application to smart infrastructures is not straight- as a primary authentication mechanism, existing digital signa- tures introduce a significant computation and communication forward, especially when such infrastructures are based on overhead, and therefore are unable to fully meet the real-time networks that include mobile devices, and for safety reasons, processing requirements of such time-critical networks. In this they have to meet real-time requirements. We refer to such paper, we introduce a new suite of real-time digital signatures networks as time-critical networks.
    [Show full text]
  • View the Index
    INDEX OF TERMS 2013, 2 Axolotl, 11 65537, 2 Backdoor, 11 A5/0, 2 Backtracking resistance, 11 A5/1, 2 Backward secrecy, 11 A5/2, 3 Base64, 12 A5/3, 3 BassOmatic, 12 A5/4, 3 BB84, 12 Adaptive attack, 3 bcrypt, 12 AEAD (authenticated encryption Biclique cryptanalysis, 13 with associated data) , 3 BIKE (Bit Flipping Key AES (Advanced Encryption Encapsulation), 13 Standard), 4 BIP (Bitcoin improvement AES-CCM, 4 proposal), 13 AES-GCM, 5 Bit Gold, 14 AES-GCM-SIV, 5 Bitcoin, 14 AES-NI, 5 Black, 14 AES-SIV, 6 BLAKE, 14 AIM (Advanced INFOSEC Machine), 6 BLAKE2, 14 AKA, 6 BLAKE3, 14 AKS (Agrawal–Kayal–Saxena), 7 Bleichenbacher attack, 15 Algebraic cryptanalysis, 7 Blind signature, 15 Alice, 7 Block cipher, 16 All-or-nothing transform (AONT), 7 Blockchain, 16 Anonymous signature, 8 Blockcipher, 17 Applied Cryptography, 8 Blowfish, 17 Applied cryptography, 8 BLS (Boneh-Lynn-Shacham) ARC4, 8 signature, 17 Argon2, 8 Bob, 18 ARX (Add-Rotate-XOR), 9 Boolean function, 18 ASIACRYPT, 9 Boomerang attack, 18 Asymmetric cryptography, 9 BQP (bounded-error quantum Attack, 9 polynomial time), 19 Attribute-based encryption (ABE), 10 Braid group cryptography, 19 Authenticated cipher, 11 Brainpool curves, 19 Break-in recovery, 20 Cryptologia, 29 Broadcast encryption, 20 Cryptology, 29 Brute-force attack, 20 Cryptonomicon, 29 Bulletproof, 20 Cryptorchidism, 30 Byzantine fault tolerance, 21 Cryptovirology, 30 CAESAR, 21 CRYPTREC, 30 Caesar’s cipher, 22 CSIDH (Commutative Supersingular CAVP (Cryptographic Algorithm Isogeny Diffie–Hellman), 30 Validation Program), 22
    [Show full text]
  • On Instantiating Pairing-Based Protocols with Elliptic Curves of Embedding Degree One
    ON INSTANTIATING PAIRING-BASED PROTOCOLS WITH ELLIPTIC CURVES OF EMBEDDING DEGREE ONE SANJIT CHATTERJEE, ALFRED MENEZES, AND FRANCISCO RODR´IGUEZ-HENR´IQUEZ Abstract. Since the discovery of identity-based encryption schemes in 2000, bilinear pair- ings have been used in the design of hundreds of cryptographic protocols. The most com- monly used pairings are constructed from elliptic curves over finite fields with small em- bedding degree. These pairings can have different security, performance, and functionality characteristics, and were therefore classified into Types 1, 2, 3 and 4. In this paper, we observe that this conventional classification is not applicable to pairings from elliptic curves with embedding degree one. It is important to understand the security, efficiency, and func- tionality of these pairings in light of recent attacks on certain pairings constructed from elliptic curves with embedding degree greater than one. We define three kinds of pairings from elliptic curves with embedding degree one, discuss some subtleties with using them to implement pairing-based protocols, and provide an estimated cost of implementing them on modern processors. 1. Introduction Let G1, G2 and GT be groups of prime order n. A cryptographic pairing e : G1 ×G2 ! GT is a map that is bilinear, non-degenerate and efficiently computable. Since 2000, when Boneh and Franklin proposed their identity-based encryption scheme [11], cryptographic pairings have been used extensively to design a wide variety of cryptographic protocols. Cryptographic pairings are constructed from elliptic curves of small embedding degree. More precisely, let E be an elliptic curve defined over the finite field Fq. Let n be a prime divisor of #E(Fq) with gcd(n; q) = 1, and let k be the smallest positive integer such that k n j q − 1; the number k is called the embedding degree of E (with respect to n).
    [Show full text]
  • A ABE, See Attribute-Based Encryption (ABE) Additive Inverse Addition and Subtraction Property, 7, 8 Inverse Addition and Subtra
    Index A B ABE, see Attribute-based encryption (ABE) Baby-step giant-step algorithm, 30–31 Additive inverse Bilinear mapping, 20, 26–27, 34–35 addition and subtraction property, 7, 8 Blind signature schemes inverse Chaum’s RSA, 252–253 addition and subtraction property, 7, 8 Okomoto-Schnorr protocol, 254–255 modular arithmetic, 7 Schnorr protocol, 253–254 and multiplicative inverse, 2 BLS short signature/BLS signature scheme, notation, 158–161 260 Asymmetric encryption (ASE), 82 Boneh-Boyen IBE, 152–156 Asymmetric key cryptography, 37, 104, 113, algorithm 244 decryption, 155 Attribute-based encryption (ABE) encryption, 155 access policy, 230–231 extract, 154, 155 basic model basic scheme complexity assumptions, 230 additive notation, 158 categories decrypting, 160–161 CP-ABE, 235–237 encryption, 160 KP-ABE, 233–235 private key extraction, 60 comparisons, 239–240 security, 167–169 difference, 237 setup of parameters, 158–160 encryption, 226 classification of IBE schemes, 156–157 IBE, 228 full scheme literature review, 238–239 decrypting, 167 PKI, 227, 228 encrypting, 166 public key encryption, 226–227 private key extraction, 166 security, 225, 240 setup of parameters, 165–166 working, 231–233 HIBE Attributes decryption, 199 Boneh-Franklin IBE, 138 encryption, 198 FIBE, 206 extraction of the private key, 198 public parameters, 162 setup, 197–198 See also Attribute-based encryption (ABE) limitation, 152 © Springer Nature Switzerland AG 2021 303 K. A. B. Ahmad et al. (eds.), Functional Encryption, EAI/Springer Innovations in Communication and
    [Show full text]