Storage services are among the primary cloud computing offerings, providing advantages of scale, cost and availability to its customers. However, studies and past experiences show that large-scale storage service can be unreliable, and vulnerable to various internal and external threats that cause loss and/or corruption of customer data. In this work, we present a query authentication scheme for cloud-based storage system where the data is populated by multiple sources and retrieved by the clients. The system allows clients to verify the authenticity and integrity of the retrieved data in a scalable and efficient way, without requiring implicit trust on the storage service provider. The proposed mechanism is based on our recently proposed multi-trapdoor hash functions, using its properties to achieve near constant communication and computation overhead for authenticating query responses, regardless of the data size, or the number of sources. We develop a discrete log-based instantiation of the scheme and evaluate its security and performance. Our security analysis shows that forging the individual or aggregate authentication tags is infeasible under the discrete log assumption. Our performance evaluation demonstrates that the proposed scheme achieves superior efficiency and scalability compared to existing query authentication schemes offering support for multiple sources.

Digital streaming Internet applications such as online gaming, multimedia playback, presentations, news feeds, and stock quotes involve end-users with very low tolerance for high latency, low data rates, and playback interruption. To protect such delay-sensitive streams against malicious attacks, security mechanisms need to be designed to efficiently process long sequence of bits. We study the problem of efficient authentication for real-time and delay-sensitive streams commonly seen in content distribution, multicast, and peer-to-peer networks. We propose a novel signature amortization technique based on trapdoor hash functions for authenticating individual data blocks in a stream. Our technique provides: 1) Resilience against transmission losses of intermediate blocks in the stream; 2) Small and constant memory/compute requirements at the sender and receiver; 3) Minimal constant communication overhead needed for transmission of authenticating information. Our proposed technique renders authentication of digital streams practical and efficient. We substantiate this claim by constructing DL-SA, a discrete-log-based instantiation of the proposed technique. DL-SA provides adaptive stream verification, where the receiver has control over modulating computation cost versus buffer size. Our performance analysis demonstrates that DL-SA incurs the least per-block communication and signature generation overheads compared to existing schemes with comparable features.

Proxy signatures have found extensive use in authenticating agents acting on behalf of users in applications such as grid computing, communications systems, personal digital assistants, information management and e-commerce. Importance of proxy signatures has been repeatedly highlighted by applied cryptographers through different variations, namely threshold proxy signatures, blind proxy signatures and so forth. Unfortunately, most recent constructions of proxy signatures only improve on minor weaknesses of previously built schemes, and most often do not deliver formal security guarantees. In this study, the authors propose a technique to construct provably secure proxy signature schemes using trapdoor hash functions that can be used to authenticate and authorise agents acting on behalf of users in agent-based computing systems. They demonstrate the effectiveness of their approach for creating practical instances by constructing a discrete log-based instantiation of the proposed generic technique that achieves superior performance in terms of verification overhead and signature size compared with existing proxy signature schemes. Formal definitions, security specifications and a detailed theoretical analysis, including correctness, security and performance, of the proposed proxy signature scheme have been provided.

Aggregate signatures can be a crucial building block for providing scalable authentication of a large number of users in several applications like building efficient certificate chains, authenticating distributed content management systems, and securing path vector routing protocols. Aggregate signatures aim to prevent resources (signature and storage elements, and computation) from growing linearly in the number of signers participating in a network protocol. In this paper, we present an efficient and scalable quasi-aggregate signature scheme, CLFSR, based on third-order linear feedback shift register (cubic LFSR) sequences that can be instantiated using both XTR and GH public key cryptosystems. In the proposed CLFSR construction, signers sign messages sequentially; however, the verfier need not know the order in which messages were signed. The proposed scheme offers constant length signatures, fast signing, aggregation, and verification operations at each node, and requires the least storage elements (public keys needed to verify the signature), compared to any other aggregate signature scheme. To the best of our knowledge, CLFSR is the first aggregate signature scheme to be constructed using LFSR sequences. We believe that the CLFSR signature scheme can be catalytic in improving the processing latency as well as reducing space requirements in building secure, large-scale distributed network protocols. We perform extensive theoretical analysis including correctness and security of CLFSR and also present a performance (computation and communication costs, storage overhead) comparison of the proposed scheme with well-known traditional constructions.