We propose a new Lee-metric code-based signature scheme (called LMQCS) based on 2-quasi-cyclic codes (2QC-codes) and assuming the hardness of the Lee metric syndrome decoding problem for 2QC-codes (2QC-SDP). Furthermore, we also give a detailed security analysis and a brief security proof of the LMQCS signature scheme. Based on the complexities of solving the underlying 2QC-SDP problem, the public key size and signature size of the LMQCS signature scheme are 2217 bytes and 4434 bytes respectively at 128-bit security level.

This article is devoted to Boolean and vectorial bent functions and their duals. Our ultimate objective is to increase such functions’ corpus by designing new ones covering many previous bent functions’ constructions. To this end, we provide several new infinite families of bent functions, including idempotent bent functions of any algebraic degree, bent functions in univariate trace form, and self-dual bent functions. Those bent functions are of great theoretical and practical interest because of their special structures and relationship with self-dual codes. In particular, many well-known bent functions are special cases of our bent functions. Moreover, we extend our results to vectorial bent functions and obtain three new infinite classes of vectorial bent functions of any possible degree by determining the explicit duals of three classes of well-known bent functions.

Abstract In 2012, Carlet et al. developed two secondary constructions of bent functions (Advances in Mathematics of Communications, 6: 305‐314) and proposed some applications for their constructions. However, the duals of bent functions in their constructions were not presented. In order to find more general applications to these constructions and obtain new classes of bent functions, an open problem was proposed by Carlet in 2014. Hence, in this study, a class of vectorial bent functions for answering that open problem, which also addresses another open problem on vectorial bent functions proposed by Mesnager in 2014, is constructed. In addition, a new secondary construction of bent functions that generalises one of Carlet et al.'s constructions in 2012 is presented. Based on that, two new classes of bent functions were obtained and their duals were presented explicitly. In particular, some self‐dual bent functions are constructed. Moreover, it can be proved that our bent functions can be EA‐inequivalent to those constructed by Carlet et al. in 2012.

We propose a rank metric code-based signature scheme constructed via the Schnorr approach. We define a new problem in rank metric coding theory, namely the Rank Vector Decomposition problem and analyze its solving complexity. The hardness of our signature scheme is based on the Rank Syndrome Decoding problem, Rank Support Basis Decomposition problem and Rank Vector Decomposition problem. We also give detailed analysis for the structural security of our signature scheme. Then, we provide parameters for our constructed signature scheme and compare our scheme with other existing secure rank metric signature schemes. Our signature scheme requires only public key size of 443 bytes and signature size of 4.03 kilobytes for 128-bit security level.

MDS matrices are excellent candidate for providing diffusion properties in block ciphers. While MDS matrices over F2(k)are more commonly used, the paper [12] suggested to consider the use of MDS matrices over Galois ringGR(2n,k). In this paper, we explore some constructions of MDS matrices overGR(2n,k) with special properties (e.g, Hadamard, almost orthogonal) from given MDS matrices over F2(k). We show that 2r× 2renabling Hadamard (1, -1) -matrices do not exist forr≥ 4. We also give an algorithm to construct almost orthogonal MDS matrices overGR(2n,k).

We propose a rank metric code-based signature scheme based on the rank syndrome decoding problem, and analyze its security. We also provide necessary conditions for being MRD codes. Then, we provide parameters for the constructed signature scheme based on random linear codes constructed from Cauchy matrix. We also compare the signature scheme with those code-based signature schemes submitted to the NIST call for Post-Quantum Cryptography Standardization. The comparison shows that our signature scheme performs better than those schemes in terms of public key size and secret key size. The public key size and secret key size of our signature scheme are more than 3 times and 40 times smaller than those of the signature schemes submitted to the NIST call for Post-Quantum Cryptography Standardization.

Feedback with carry shift registers (FCSRs) were introduced by Klapper and Goresky in 1994, and they can be used to design stream ciphers. In 2011, Lee and Park [10] put forward a software implementation for word-based FCSRs, and the sequences generated by those FCSRs are half-l-sequences. In SETA 2014, Gu and Klapper [7] investigated the imbalance properties of half-l-sequences and gave two bounds for the one symbol and two consecutive symbol cases. In this paper, we revisit the imbalance properties of half-l-sequences and deduce two new bounds which improve upon the bounds given by Gu and Klapper largely.

To resist those known attacks, Boolean functions used in stream ciphers should have large input size (e.g. 32-variable). However, up to now, for n > 20, very few n-variable Boolean function with good cryptographic properties can be implemented efficiently. This paper tries to solve this problem, and puts forward a method to construct cryptographically significant Boolean functions with large input size. The functions constructed by us have good cryptographic properties, and thus can resist all the main attacks. Moreover, they can be implemented efficiently. Hence, they can be used to design the real-life cipher.

Since Edwards curves were introduced to elliptic curve cryptography by Bernstein and Lange in 2007, they have received a lot of attention due to their very fast group law operation. Pairing computation on such curves is slightly slower than on Weierstrass curves. However, in some pairing-based cryptosystems, they might require a number of scalar multiplications which is time-consuming operation and this can be advantageous to use Edwards in this scenario. In this paper, we present a variant of Miller’s algorithm for pairing computation on Edwards curves. Our approach is generic, it is able to compute both Weil and Tate pairings on pairing-friendly Edwards curves of any embedding degree. Our analysis shows that the new algorithm is faster than the previous algorithms for odd embedding degree and as fast as for even embedding degree. Hence, the new algorithm is suitable for computing optimal pairings and in situations where the denominators elimination technique is not possible.

Almost perfect nonlinear (APN) functions on ${\mathbb F}_{2^n}$ are functions achieving the lowest possible differential uniformity. All APN functions discovered until now are either power or quadratic ones, except for one sporadic multinomial nonquadratic example on ${\mathbb F}_{2^6}$ due to Edel and Pott. It is well known that certain binary codes with good properties can be obtained from APN functions, and determining their (Hamming) weight distribution is equivalent to determining the Fourier spectra of the corresponding functions. The Fourier spectra of all known infinite families of quadratic APN functions discovered through 2010 have been determined, and it was found that they are the same as the ones of the Gold APN functions, i.e., a $5$-valued set when $n$ is even and a $3$-valued set when $n$ is odd, while a sporadic example on ${\mathbb F}_{2^6}$ found by Dillon has a $7$-valued Fourier spectrum. In 2011, two new generic constructions of APN functions were presented in [Y. Zhou and A. Pott, Adv. Math., 234 (2013), pp. 43--60] and [C. Carlet, Des. Codes Cryptogr., 59 (2011), pp. 89--109]. In this paper, we determine the Fourier spectra of the APN functions obtained from them and show that their Fourier spectra are again the same as those of the Gold APN functions. Moreover, since the APN functions in [C. Bracken, C. H. Tan, and Y. Tan, On a Class of Quadratic Polynomials with No Zeros and Its Applications to APN Functions, preprint, arXiv:1110.3177v1, 2011], which are demonstrated to exist when $n\equiv 0\mod 4$ and $3\nmid n$, are covered by the construction in [C. Carlet, Des. Codes Cryptogr., 59 (2011), pp. 89--109], a positive answer to the conjecture proposed in the former paper on determining their Fourier spectrum is given in this paper.

Many block ciphers use permutations defined on F(22k) with low differential uniformity, high nonlinearity, and high algebraic degree as their S-boxes to provide confusion. It is well known that, for a function on F(2n), the lowest differential uniformity is 2 and the functions achieving this lower bound are called almost perfect nonlinear (APN) functions. However, due to the lack of knowledge on APN permutations on F(22k), differentially 4-uniform permutations are usually chosen as S-boxes. For example, the currently endorsed Advanced Encryption Standard chooses one such function, the multiplicative inverse function, as its S-box. By a recent survey on differentially 4-uniform permutations over F(22k), there are only five known infinite families of such functions, and most of them have small algebraic degrees. In this paper, we apply the powerful switching method to discover many CCZ-inequivalent infinite families of such functions on F(22k) with optimal algebraic degree, wherekis an arbitrary positive integer. This greatly expands the list of differentially 4-uniform permutations and hence provide more choices for the S-boxes. Furthermore, lower bounds for the nonlinearity of the functions obtained in this paper are presented and they imply that some infinite families have high nonlinearity.

In this paper, we introduce a new time-memory-data trade-off attack which can perform better than existing ones by Biryukov-Shamir (BS-TMD [1]), Hong-Sarkar (HS-TMD [8]) and Dunkelman-Keller (DK-TMD [5]). Current Estream ciphers are resistant to these attacks because the state size is too big for the BS-TMD attack, while the pre-processing is at least as expensive as exhaustive search for the HS-TMD and DK-TMD attacks.

In certificateless cryptography, a user secret key is derived from two partial secrets: one is the identity-based secret key (corresponding to the user identity) generated by a Key Generation Center (KGC), and the other is the user self-generated secret key (corresponding to a user self-generated and uncertified public key). Two types of adversaries are considered for certificateless cryptography: a Type-I adversary who can replace the user self-generated public key (in transmission or in a public directory), and a Type-II adversary who is an honest-but-curious KGC. In this paper, we present a formal study on certificateless key exchange (CLKE). We show that the conventional definition of Type-I and Type-II security may not be suitable for certificateless key exchange when considering the notion of forward secrecy which is important for key exchange protocols. We then present a new security model in which a single adversary (instead of Type-I and Type-II adversaries) is considered. We also construct a strongly secure certificateless key exchange protocol without expensive pairing operations. As far as we know, our proposed protocol is the first proven secure CLKE protocol without pairing.

In a recent paper, Dutta and Barua presented a group key agreement protocol in dynamic setting. The protocol allows users to efficiently join or leave a group and was believed to be provably secure. In this letter, we point out a flaw in the Dutta-Barua dynamic group key agreement protocol.

In this paper, we propose a signcryption key encapsulation (KEM) scheme and show that the proposed scheme is insider-secure against adaptive chosen ciphertext attack without random oracles and against strongly existential forgery without random oracles. In addition, by simple transformation of the proposed signcryption KEM scheme, we construct an insider-secure signcryption Tag- KEM scheme without random oracles, which responds to the calling from Yoshida and Fujiwara in 2007 on the construction of signcryption Tag-KEM scheme.

Confidentiality and authenticity are two important security requirements in most secure systems. To efficiently provide data privacy (confidentiality) and (data/user) authenticity simultaneously, the notion of signcryption scheme was first introduced by Zheng in 1997. The security model for signcryption scheme was proposed by Baek et al. and An et al. in 2002 independently. Since then, many signcryption schemes were proposed; they are either a public-key signcryption or a hybrid signcryption. But, only few proposed signcryption schemes were supposed to be in the insider security, for example, Libert-Quisquater's signcryption schemes at PKC'2004 and SCN'2004 respectively and Yang-Wong-Deng's signcryption scheme at ISC'2005. Although all the above mentioned signcryption schemes were proved insider-secure against adaptive chosen ciphertext attack in the random oracle models, Tan showed that all the above mentioned signcryption schemes were not insider-secure against adaptive chosen ciphertext attack in 2005 and 2006 respectively. Up to our knowledge, it seems that none of insider-secure hybrid signcryption scheme is constructed without random oracles. In this paper, we proposed a hybrid signcryption scheme and showed that the proposed scheme is insider-secure without random oracles

Heterogeneous wireless networks (HWNs) are gaining popularity due to its convenience for mobile users to be connected to the network even when "on the move". Group key agreement (GKA) protocols are used to secure group communications in these networks. However, most of the GKA protocols in current literature do not consider protection against denial-of-service (DoS) attacks that can disrupt GKA services. In this paper, we present an authenticated, energy efficient and scalable GKA protocol that provides protection against DoS attacks and key confirmation properties. Unlike current communication energy analysis that uses only a single energy per bit value for transmission and reception, our communication energy analysis separates point-to-point (P2P) and broadcast communications to provide more detailed study on communications in GKA. Both the complexity and energy costs analysis shows that our proposed protocol is efficient and suitable for HWNs.

One useful application of wireless networks is for secure group communication, which can be achieved by running a group key agreement (GKA) protocol. One well-known method of providing authentication in GKA protocols is through the use of digital signatures. Traditional certificate-based signature schemes require users to receive and verify digital certificates before verifying the signatures but this process is not required in ID-based signature schemes. In this paper, we present an energy-efficient ID-based authenticated GKA protocol and four energy-efficient ID-based authenticated dynamic protocols, namely join, leave, merge and partition protocol, to handle dynamic group membership events, which are frequent in wireless networks. We provide complexity and energy cost analysis of our protocols and show that our protocols are more energy-efficient and suitable for wireless networks.

Digital signature is commonly used for authentication. So, it is important to design a signature with a security proof. In 1999, Gennaro et al. and Cramer et al. respectively proposed practical and provably secure signature schemes under the standard assumption without the random oracle model. Since then, some provably secure signature schemes in the standard model were constructed, for example, Camenisch-Lysyanskaya scheme in 2002; Fischlin scheme and Tan-Yi-Siew scheme in 2003. In this paper, we construct a new provably secure signature scheme based on the strong RSA assumption against existential forgery under adaptive chosen message attack in the standard model. The proposed scheme is also more efficient than other provable secure schemes in the standard model.

Heterogeneous wireless networks are gaining popularity as users can be connected to these networks without any cables and even when they are mobile. The high power nodes in heterogeneous wireless networks do not have energy constraints but the user nodes, which can be large in numbers, are usually low power energy constrained devices. Therefore, the GKA protocol used to secure group communications in these networks has to take into consideration both the low power nature of the user nodes and the network size. In this paper, we present an energy efficient and scalable GKA protocol, which uses our proposed Contributory Ring-Centralized (ContRi-Central) group model. Besides providing complexity analysis, we also show the computational and communication energy consumption costs analysis of all nodes running our proposed scheme and four other efficient GKA protocols. Both the complexity analysis and energy consumption costs analysis indicate that our proposed scheme is more efficient and suitable for heterogeneous wireless networks.

One useful application of wireless networks is for secure group communication. The members in the group first run a group key agreement (GKA) protocol to establish a common group key that can be used to encrypt messages to be broadcast to the group. Authentication is necessary in GKA protocols to prevent adversaries from masquerading as group members and obtaining the group key. One way of providing authentication is to sign all the messages sent and verify all the messages received; some other techniques may require an extra round of communications. We propose a more efficient authenticated GKA protocol that does not increase the number of communication rounds and is based on the Schnorr signature scheme and the Burmester-Desmedt (BD) GKA protocol. The proposed protocol requires only one signature generation and one signature verification for each member, regardless of the group size.

A growing application area in mobile communications is mobile teleconference in which a group of mobile users collaborate in an interactive procedure, such as a board meeting, a task force, a scientific discussion, or even a virtual classroom. Wireless communications transmit conversations via radio, making them more susceptible to eavesdropping and unauthorized access than are conversations carried via wires. Therefore, it is crucial to ensure confidentiality and authenticity in a mobile teleconference. The authors design a new secure conference scheme for mobile communications. Based on a modular square root technique, this scheme is secure against eavesdropping, impersonating, and tracking attacks and allows a participant to join or quit a mobile teleconference dynamically.