The sharing of Internet of Things (IoT) data plays an extensive role in our everyday lives. Exploring secure and efficient methods for data sharing is a prominent area of research. Proxy re-encryption (PRE) in the cloud provides a solution. However, traditional PRE schemes are vulnerable to algorithm substitution attacks (ASA). Moreover, in most PRE schemes, the proxy can know the relevant identity information of the data owner or the data recipient through the re-encryption key, and some current PRE schemes cannot guarantee strong resistance to collision. To address the limitations of traditional PRE schemes and offer a robust solution for secure and efficient data sharing in IoT application, we propose a reverse firewall for proxy re-encryption (PRE-RF) scheme, which is implemented by JPBC library. Security analysis shows that our PRE-RF scheme provides effective resistance to ASA, along with strong collision security, chosen plaintext attack security, and key-private security. Compared with similar state-of-the-art PRE schemes, our scheme reduces the length of the re-encryption keys and ciphertext, thereby reducing the storage cost of the system. Meanwhile, our scheme’s computational cost is lower, thereby improving the operational efficiency of the system. Furthermore, the amount of time devoted to the reverse firewall in our scheme decreases as security level increases. As a result, these advantages make it a secure and efficient choice for sharing IoT data in unreliable cloud environments.

Abstract Multivariate public‐key cryptography (MPKC) is considered a leading candidate for post‐quantum cryptography (PQC). It is based on the hardness of the multivariate quadratic polynomial (MQ) problem, which is a problem of finding a solution to a system of quadratic equations over a finite field. In this paper, we survey some recent progress in the security analysis of MPKC. Among various existing multivariate schemes, the most important one is the Rainbow signature scheme proposed by Ding et al. in 2005, which was later selected as a finalist in the third round of the PQC standardization project by the National Institute of Standards and Technology. Under the circumstances, some recent research studies in MPKC have focussed on the security analysis of the Rainbow scheme. In this paper, the authors first explain efficient algorithms for solving the MQ problem and the research methodology for estimating their complexity in MPKC. Then, the authors survey some recent results related to the security analysis of the Rainbow scheme. In particular, the authors provide a detailed description of the complexity analysis for solving the bi‐graded polynomial systems studied independently by Nakamura et al. and Smith‐Tone et al., and then expound the rectangular MinRank attack against Rainbow proposed by Beullens.

As an efficient multiplication method for polynomial rings, Number Theoretic Transform (NTT) is a fundamental algorithm that is both practically useful and theoretically established. Chung et al. proposed a method to perform NTT-based polynomial multiplication for NTT-unfriendly rings that do not have suitable primitive roots. They applied their proposal to lattice-based cryptography using NTT-unfriendly rings and speeded up several schemes. At ARITH 2021, Plantard proposed a modular multiplication algorithm that improves the speed of NTT if moduli are not large (a few dozen of bits), which is the case for typical lattice-based cryptography. It is natural to expect that Plantard's method improves Chung et al.‘s NTT when applied to them, however, this is not possible as Chung et al. requires the use of signed integers while Plantard's method assumes unsigned integers. A simple fix would cause a slowdown and a non-constant-time operation. To overcome this problem, we propose an efficient method for calculating the modular multiplication for signed integers based on Plantard's method. Our proposal generally incurs no overhead from the original and works in a constant-time fashion. To show the effectiveness of our proposal, we provide experimental implementation results on a lattice-based cryptographic scheme Saber. Currently, NIST is selecting candidates for standardization of post-quantum cryp-tography in preparation for the compromise of current public key cryptography by quantum computers, and has completed the selection of the final candidates. Saber is one of the finalists for the NIST standardization project,

Abstract The lattice‐based encryption scheme has high efficiency and reliability, and it can be run on small devices with limited memory capacity and computational resources such as sensor nodes or smart cards. The first implementation is presented of the original ring–learning‐with‐errors‐based encryption scheme on a standard Java Card platform by combining the number theoretic transform with improved Montgomery modular multiplication. Without any cryptographic coprocessor support, the decryption running time is around 7 s, corresponding to the AES‐128 security level. Two efficient discrete Gaussian sampling approaches, known at the discrete Ziggurat sampling algorithm and Knuth–Yao algorithm, were implemented on the Java Card and resulted in a reduction in running times. More important, polynomial modular multiplication is shown to perform efficiently on a standard Java Card platform even when the big integers and floating‐point number operations are not supported. The results show the feasibility of implementing more lattice‐based cryptosystems on existing memory‐constrained Java Cards. A preliminary version of this paper appeared with the title ‘Memory‐constrained implementation of lattice‐based encryption scheme on standard Java Card’ in Proceedings of the 2017 IEEE International Symposium on Hardware Oriented Security and Trust (HOST) .

At SAC2017, Akiyama et al. proposed the indeterminate equation encryption scheme whose security is based on a solution problem of indeterminate equation. It is an extension of algebraic surface encryption scheme. A public key X for this scheme is a polynomial in two variables over a finite ring. Akiyama et al. also proposed two attacks, the linear algebraic attack (LAA) and the key recovery attack (KRA), by using the lattice structure associated with this scheme. In this paper, we give an improvement on LAA. Also we explain the relation between our improvement and the improvement on LAA proposed by Xagawa and examine parameters that those attacks fail by experiments. As a result, we conclude that if the total degree of the public key X is one, then KRA is more efficient than LAA and if that of X is two, then LAA is more efficient than KRA.

Quantum computers have the potential to solve some difficult mathematical problems efficiently and thus will inevitably exert a more significant impact on the traditional asymmetric cryptography. The National Institute of Standards and Technology (NIST) has opened a formal call for the submission of proposals of quantum-resistant public-key cryptographic algorithms to set the next-generation cryptography standards. Compared to powerful machines with ample amount of hardware resources such as racks of servers and IoT devices, including the massive number of microcontrollers, smart terminals, and sensor nodes with limited computing capacity, should also have some postquantum cryptography features for security and privacy. To ensure the correct execution of encryption algorithms on any platforms, the portability of implementation becomes more important. As distinguished from C/C++, JavaScript is a popular cross-platform language that can be used for the web applications and some hardware platforms directly, and it could be one of the solutions of portability. Therefore, we investigate and implement several recent lattice-based encryption schemes and public-key exchange protocols including Lizard, ring-Lizard, Kyber, Frodo, and NewHope in JavaScript, which are the active candidates of postquantum cryptography due to their applicabilities and efficiencies. We show and compare the performance of our JavaScript implementation on web browsers, embedded device Tessel2, Android phone, and several JavaScript-enabled platforms on PC and Mac. Our work shows that implementing lattice-based cryptography on JavaScript-enabled platforms is achievable and results in desirable portability.

Provable security is an important research area in modern cryptography. Cryptographic primitives or protocols without rigorous proofs cannot be regarded as secure even in practice. In fact, many schemes were originally thought as secure but were broken subsequently. This clearly indicates the necessity of formal security analysis. For real-world applications, provable security provides us with a strong confidence in using cryptographic solutions. For a theoretical study, provable security sometimes provides a clear answer to the (in)feasibility issue of a certain security mechanism. This special issue offers a platform for security researchers and practitioners to exchange their new ideas for studying information systems in provably secure manners. We have included eighteen high-quality papers. Among them, six papers were selected from accepted papers at the 6th International Conference on Provable Security (ProvSec 2012), and the remaining 12 papers were selected from new invited submissions. All of them have gone through stringent reviews in two rounds. Further, any selected paper that has a preliminary version at ProvSec 2012 or somewhere else must have been extensively expanded to include new contributions. The included articles highlight recent advances in provable security by presenting many novel techniques in this area. We now give a short summary of them, through six categories. The first category is public-key encryption (PKE). It considers the formal models, constructions, and analysis of PKE under various security concerns. In the leakage-resiliency model, one considers the security of PKE when a partial secret key has been leaked (e.g., through a side-channel attack). Paper “continual key-leakage tolerant encryption from extensible-set delegation functionality” by Bo Yang and Mingwu Zhang proposes a leakage-resilient functional encryption and shows that its provable security under a continual leakage of the secret key. Motivated by the threat from malware such as RAM scrapers, the paper “stronger public key encryption system withstanding RAM scraper like attacks” by S. Sree Vivek, S. Sharmila Deva Selvi, Akshayaram Srinivasan and C. Pandu Rangan proposes a public-key security notion that is stronger than adaptive chosen-ciphertext (CCA2) security. They show that the traditionally CCA2 secure schemes are no longer secure in the new model. They also propose a new scheme that is provably secure in the new model without a random oracle. The paper “a limitation on security evaluation of cryptographic primitives with fixed keys” by Yutaka Kawai, Goichiro Hanaoka, Kazuo Ohta, and Noboru Kunihiro studies the security of public-key system when the public key is fixed. They have obtained some impossibility results for this setting. A key encapsulation mechanism is an efficient tool to construct a public-key encryption through a paradigm of a hybrid encryption. The paper “efficient key encapsulation mechanisms with tight security reductions to standard assumptions in the two security models” by Yoshikazu Hanatani, Goichiro Hanaoka, Takahiro Matsuda, and Takashi Yamakawa presents two constructions of efficient key encapsulation mechanisms. Their schemes can be proven CCA secure under a strong hardness assumption without random oracle or under a weaker assumption in the random oracle model. A hash proof system is a general cryptographic structure proposed by Cramer-Shoup in Eurotypt 2002 to construct public-key systems. The paper “generalized (identity-based) hash proof system and its applications” by Yu Chen, Zongyang Zhang, Dongdai Lin, and Zhenfu Cao generalizes this concept to admit an anonymity property. They use this generalized structure to propose public-key encryptions with leakage resilience and anonymity. They further study it in the identity-based setting. The second category is searchable encryption. It considers the public key or the symmetric key cryptosystems that allow keywords search over encrypted data. Usually, the search encryption requires a complete match on the keyword during the search. The paper “character-based symmetric searchable encryption and its implementation on mobile devices” by Takanori Suga, Takashi Nishide, and Kouichi Sakurai proposes a scheme that admits a partial keyword match for the search, and their scheme uses a symmetric encryption. They also have implemented the solution over a mobile device. The paper “searchable symmetric encryption capable of searching for an arbitrary string” by Yoshinao Uchide and Noboru Kunihiro further studies the partial keyword match problem and proposes a searchable encryption that admits a search query of an arbitrary string. Their main technique is an oblivious cross tag protocol by Cash et al. at CRYPTO 2013. The third category is a re-encryption. This considers to re-encrypt a ciphertext without using a decryption key. This is to reuse the ciphertext for a certain security or privacy purpose. The paper “strongly average-case secure obfuscation: achieving input privacy and circuit obscurity” by Mingwu Zhang, Yi Mu, Yixin Su, and Xinyi Huang studies the obfuscation for a re-encryption program with strong security such that an attacker, when executing an obfuscated re-encryption program, cannot obtain any information about the private key and the plaintext. Here, an obfuscation is an algorithm that converts a program into another with the same functionality while difficult to understand. An attribute-based encryption is a public-key cryptosystem that classifies a user using attributes such that a user can decrypt a ciphertext if and only if his attribute collection satisfies the desired requirement in the ciphertext. This achieves the access control functionality for the encryption. Attribute-based proxy re-encryption (PRE) is a useful technique for a delegation of access rights to encrypted data, which is useful in a public cloud storage. The paper “verifiable attribute-based proxy re-encryption for secure public cloud data sharing” by Suqing Lin, Rui Zhang, and Mingsheng Wang proposes a generic construction for attribute-based PRE and presents three realizations for it. The paper “on the application of generic CCA-secure transformations to proxy re-encryption” by David Nuñez, Isaac Agudo, and Javier Lopez studies the generic transformation for PRE from weak security to CCA security. For a regular public-key encryption, it is well known that a Fujisaki–Okamoto technique can transform a chosen-plaintext secure scheme into a CCA2 secure scheme. But the authors found out that this does not work for PRE. Instead, they achieve a weak form of CCA security for PRE using a generalized Fujisaki–Okamoto. The paper “proxy re-encryption via indistinguishability obfuscation” by Satsuya Ohata and Kanta Matsuura presents a technique for achieving PRE from obfuscation. Their idea is to carefully modify the public-key encryption scheme of Sahai and Waters at STOC 2014. The fourth category is a digital signature. This studies the models, constructions, and their analysis under various security concerns. A nominative signature is a signature that is generated by a signer A and a user B jointly. When the signature is to be verified by a user C, C will run a disavowal/confirmation protocol with B. The paper “one-move convertible nominative signature in the standard model” by Dennis Y. W. Liu and Duncan S. Wong proposes an efficient nominative signature that is provably secure in the standard model with a constant size of key for any party in the system. A ring signature is a signature, where a signer remains fully anonymous among a group of members (called a ring). The paper “non-interactive deniable ring signature without random oracles” by Shengke Zeng and Qinyi Li considers a variant of a ring signature, where the signer anonymity is conditional in the sense that a signer can confirm the authorship of the signature while a non-signer can disprove the authorship of a signature. They propose a new scheme for this model using the Boneh and Boyen signature and shows its security in the standard model. A blind signature is a special signature that allows one to obtain a signature on a message from a signature without leaking the message to the latter. This primitive has many applications in systems such as e-cash and e-voting schemes. The paper “a lattice based partially blind signature” by Haibo Tian, Fangguo Zhang, and Baodian Wei proposes the first latticed-based blind signature with partial blindness using the technique of Lyubashevsky from EUROCRYPT 2012 and the technique of Abe and Okamoto from CRYPTO 2000. The paper “generic transformations for existentially unforgeable signature schemes in the bounded leakage model” by Yuyu Wang and Keisuke Tanaka studies how to obtain strongly secure digital signatures. They propose two transformations that convert a regular weakly secure signature into a strongly secure signature in the bounded leakage model. The fifth category is a key exchange. A key exchange is a procedure that allows two or more parties to share a secret key securely. The paper “authenticated key exchange with entities from different settings and varied groups” by Yanfei Guo and Zhenfeng Zhang proposes several key exchange protocols with an initiator being identity based and the responder being certificate based. They consider the constructions with an identity-based system from a bilinear group and a prime residue group both. The last category is the symmetric key cryptography. It studies the cryptographic structure that does not use any public-key tool. A lightweight cryptographic primitive is such an example. It only incurs a very small computation cost. A lightweight primitive with provable security has a very important impact in the real world. The paper “two new message authentication codes based on APN functions and stream ciphers” by Teng Wu and Guang Gong proposes two lightweight message authentication codes and quantifies the insecurity upper bounds against a substitution attack. The paper “two-level security for message streams” by Mohsen Alimomeni and Reihaneh Safavi-Naini studies the information theoretic security of a private key encryption. They formalize a new model to quantify the security of many ciphertexts, where they require the message in the most recent ciphertext to be perfectly secure while messages in older ciphertexts have a lower level of security. They propose a non-trivial construction with provable security under their model. We would like to thank editor-in-chiefs Prof. Hsiao-Hwa Chen and Prof. Hamid R. Sharif for agreeing to this special issue and supporting us throughout the process. We also would like to thank all authors who submitted their papers to this special issue and reviewers who spent their precious time on the submissions and provided us with their insights that help us in an essential way to make the decisions.

Abstract Revocation functionality is crucial for the practicality of the public key cryptosystems, especially for that of identity‐based cryptosystems. When some users lose their private keys, the cryptosystems must support an efficient revocation method to revoke such users. On the other hand, strong unforgeability provides stronger security than existential unforgeability and ensures the adversary cannot even produce a new signature for a previously signed message. However, existing revocable identity‐based signature schemes can support neither efficient key revocation nor strong unforgeability. In this paper, we propose a strongly unforgeable identity‐based signature scheme with efficient revocation. In the proposed scheme, the master key is randomly divided into two parts: one is used to construct the initial secret key, the other is used to generate the key update. Furthermore, they are used to periodically and re‐randomly produce signing keys for non‐revoked users. Thus, the proposed scheme can efficiently revoke users and resist key exposure attacks. In the standard model, our scheme is proven to be strongly unforgeable under the CDH hardness assumption. Copyright © 2016 John Wiley & Sons, Ltd.

Recently, based on the homomorphic signatures, the authentication schemes, such as homomorphic subspace signature (HSS) and key predistribution-based tag encoding (KEPTE), have been proposed to resist against pollution attacks in network coding. In this paper, we show that there exists an efficient multi-generation pollution attack on HSS and KEPTE. In particular, we show that using packets and their signatures of different generations, the adversary can create invalid packets and their corresponding signatures that pass the verification of HSS and KEPTE at intermediate the nodes as well as at the destination nodes. After giving a more generic attack, we analyze the cause of the proposed attack. We then propose the improved key distribution schemes for HSS and KEPTE, respectively. Next, we show that the proposed key distribution schemes can combat against the proposed multi-generation pollution attacks. Finally, we analyze the computation and communication costs of the proposed key distribution schemes for HSS and KEPTE, and by implementing experiments, we demonstrate that the proposed schemes add acceptable burden on the system.

Confidentiality and authentication are two main security goals in secure electronic mail (e-mail). Pretty good privacy (PGP) and secure/multipurpose internet mail extensions (S/MIME) are two famous secure e-mail solutions. Both PGP and S/MIME use digital envelope to provide message confidentiality and digital signature to provide message authentication. However, these methods have the following two weaknesses: 1) digital signature provides non-repudiation evidence of sender that is not desired in some e-mail applications and 2) efficiency is low, since these methods use two kinds of public key cryptographic primitives: public key encryption and digital signature. To overcome the above two weaknesses, we introduce a new concept called deniably authenticated encryption that can achieve confidentiality, integrity, and deniable authentication in a logical single step. We first propose a deniably authenticated encryption scheme and prove its security in the random oracle model. Then, we design a secure e-mail protocol using the proposed deniably authenticated encryption scheme. The deniable authentication property protects senders' privacy.

Functional encryption (FE) systems provide a flexible and expressive encryption mechanism that private keys and ciphertexts are associated with attributes and predicate formulae Γ and decryption are possible whenever keys and ciphertexts are related, i.e. ⁠. In this work, we put forward a leakage-resilient FE scheme against the amount of leakage output over a hard-to-invert function family. In our scheme, the encryption policy is specified as an arbitrary monotonic formula, and the adversary can learn the arbitrary length output of the master key and the private key from any computationally irreversible function with the input (master) keys. To improve the efficiency, we employ the set of minimal sets to describe the predicate formula or access structure, and initiate the formal model of leakage-resilient FE, which is a generic extension of identity-based encryption and attribute-based encryption in the presence of key leakage with auxiliary inputs. We provide the concrete construction in bilinear groups of composite order, and prove the adaptively leakage-resilient security in the standard model based on static assumptions. Our hard-to-invert leakage resilience employs the Goldreich–Levin theorem and its extension as a hard-core value over large fields. We also give an extensional construction in the case of obtaining the hard-to-invert randomness leakage of the encryption, which uses a strong extractor to prevent leakage of randomness and a hard-to-invert encryption to prevent the leakage of the key. Finally, we analyze and discuss the stepped-up security on master leakage and continual leakage, and the lower bound of the irreversible leakage function.

Recently, Jung and Li [1] propose a highly efficient privacy-preserving product calculation scheme without requiring secure communication channels. Then, they present secure approaches to solve several application problems using the product calculation protocol. In this work, we observe several security flawsin their privacy-preserving product calculation scheme and some application protocols. We show the security vulnerabilities will result in the disclosure of private data. In two application protocols, almost all the private numbers will be revealed. We further suggest solutions to fix the security problems.

In privacy‐carrying email systems, the authors should guarantee that the email content is confidential and sometimes the sender/receiver identities are hidden. Also, they require that the key generation is flexible and manageable. In this study, first, they propose an anonymous encryption scheme that supports a partial‐order subset delegatable ability. The proposed scheme achieves the security properties of confidentiality against adaptive chosen‐plaintext attacks, anonymity against adaptive chosen‐subset attacks and computational delegation indistinguishability. Secondly, they provide a deployment application of their anonymous encryption in an interdisciplinary group email management system with flexible and fine‐grained key delegation. The deployment can achieve the privacy of message confidentiality, receiver anonymity and delegation obliviousness, which has fine‐grained security in secure email systems. Finally, they provide an extension for the chosen‐ciphertext secure scheme, and discuss the efficiency for decryption and the security level.

ABSTRACT Document clustering is a practical and powerful data mining technique to analyze large amount of documents and large sets of text or hypertext documents. However, it also brings the problem of sensitive information leaking in disregard of privacy, especially when it is executed in distributed environment. In this paper, we propose a cryptography‐based framework to realize privacy‐preserving document clustering among the users under the distributed environment; there are two parties, each having his private document database, want to collaboratively execute agglomerative document clustering without disclosing their private contents. We provide two implementations of such a framework, one is with more precision and stronger security but requires more computational resources. The other is a simplified version with less computational complexity and achieves higher processing speed. Additionally, we provide the security proofs and experimental analysis of precision and scalability of our proposal. Copyright © 2013 John Wiley & Sons, Ltd.

ABSTRACT Modern cryptographic schemes are constructed under the fundamental assumption that secret keys are perfectly hidden from all possible attackers. In practice, however, keys and internal states may partially be leaked. Recently, cryptographic construction with key‐leakage resilience has been a crucial research topic. In this work, we proposed an anonymous hierarchical identity‐based encryption that can tolerate partial leakage of secret keys. Our results were as follows. First, we provided a tolerance for continual key leakage that can capture both memory leakage and continual leakage. We extended a dual‐system encryption mechanism in orthogonal subgroups to achieve key‐leakage resilience and implicitly employed an update algorithm to guard against continual leakage. Second, the delegation depth is unbounded, which means that no predetermined depth was imposed in the setup algorithm, thus making the scheme very flexible in practice. We employed a secret‐sharing approach to split the master key into multiple shares in key components corresponding to the elements. Third, we analyzed and discussed the performance of allowable leakage‐tolerance bounds and the leakage rate of the proposed scheme and gave an evaluation that attains about 40–70% leakage rate under the Advanced Encryption Standard 112 security level. Copyright © 2013 John Wiley & Sons, Ltd.

In a recent paper at Asiacrypt'2012, Jain et al point out that Veron code-based identification scheme is not perfect zero-knowledge. In particular, this creates a gap in security arguments of proof of plaintext knowledge (PPK) and verifiable encryption for the McEliece public key encryption (PKE) proposed by Morozov and Takagi at ACISP'2012. We fix the latter result by showing that PPK for the code-based Niederreiter and McEliece PKE's can be constructed using Stern zero-knowledge identification scheme, which is unaffected by the above mentioned problem. Since code-based verifiable encryption uses PPK as a main ingredient, our proposal presents a fix for the McEliece verifiable encryption as well. In addition, we present the Niederreiter verifiable encryption.

Recent research shows that many public-key or identity-based encryption schemes are vulnerable to side-channel attacks on the keys by the interaction of an adversary with a physical device. To tolerate the possible key leakage, leakage-resilient cryptography models a class of leakage output by allowing the adversary to be able to specify a computable leakage function and obtaining the partial keys or other possibly internal states from the output of function. In this article, we propose a leakage-resilient hidden-vector encryption (HVE) scheme that supports the predicate operators such as conjunction, disjunction, comparison, range query and subset query, etc. The proposed scheme is leakage-resilient attribute-hiding secure in the sense that the adversary cannot only obtain the tokens of non-match vectors but also learn amount of key information of the vector that matches the challenge vector. To the best of our knowledge, this is the first HVE that supports token-leakage resilience. We prove the security with a series of computationally indistinguishable games that uses the dual system encryption mechanism. We also analyze and discuss the performance of leakage bound parameters and leakage fraction in the practical security level. Finally, we also give an extensive scheme to achieve the security of both attribute-hiding and payload-hiding, and analyze the performance in larger alphabets.

SUMMARY Signcryption is a cryptographic primitive that performs simultaneously both the functions of digital signature and public‐key encryption, at a cost significantly lower than that required by the traditional signature‐ then‐encryption approach. In this paper, we provide a positive answer to the question of if it is possible to construct signcryption based on lattice problems. More precisely, we design an efficient signcryption scheme that can send a message of length l one time. We prove that the proposed scheme has the indistinguishability against adaptive chosen ciphertext attacks under the learning with errors assumption and strong unforgeability against adaptive chosen messages attacks under the inhomogeneous small integer solution assumption in the random oracle model. Copyright © 2012 John Wiley & Sons, Ltd.

ABSTRACT Broadcast encryption is an effective way to broadcast a message securely such that more than one privileged receiver can decrypt it. The well‐known constructions of identity‐based broadcast encryption only support bounded broadcast users that had to deploy the maximum user number in advance. This is somewhat inefficient and impractical if the broadcast user number is predetermined. In this paper, we propose an adaptively secure identity‐based broadcast encryption in the standard model that supports arbitrary number of users in broadcast set, which eliminates the size of public parameters with a constant number of group elements and obtain short ciphertexts, secret keys, and public parameters. We use the techniques of semi‐functional ciphertexts and semi‐functional keys in orthogonal subgroups to implement the boundless broadcast set and adaptive security by means of dual‐system encryption mechanism in a composite‐order group, and we prove the scheme to be fully secure without the random oracles in the static assumptions. The proposed scheme captures the properties of confidentiality, adaptive security, constant key, and short ciphertext. We also evaluate the computational costs and communication overheads and give the deployment in secure set‐top box broadcast systems. Copyright © 2012 John Wiley & Sons, Ltd.

SUMMARY Signcryption is a cryptographic primitive that fulfills both the functions of digital signature and public key encryption simultaneously, at a cost significantly lower than that required by the traditional signature‐then‐encryption approach. The performance advantage of signcryption over the signature‐then‐encryption method makes signcryption useful in many applications, such as electronic commerce, mobile communications, and smart cards. In this paper, we propose an efficient signcryption scheme in the standard model. We prove that our scheme satisfies the confidentiality and strong unforgeability. Compared with the Tan's scheme, our scheme has | G | + | p | (320) bits shorter ciphertext, 2 | p | − | G | (160) bits shorter private key, and | GT | + | G | (1184) bits shorter public key. In addition, in the Tan's scheme, a user must hold two public key/private key pairs at one time if it were both sender and receiver. Our scheme only needs a public key/private key pair, which is more practical for application. Copyright © 2011 John Wiley & Sons, Ltd.

ABSTRACT Signcryption is a cryptographic primitive that offers both confidentiality and authentication simultaneously, which combines the functionalities of signature and encryption in a provably secure manner. Indistinguishability against adaptive chosen‐ciphertext attacks (ind‐cca2) and unforgeability against adaptive chosen‐message attacks (euf‐cma2) are two important security requirements of a signcryption protocol. In a multi‐receiver signcryption with a threshold decryption scheme, the ciphertext can be decrypted and verified when arbitrary t or more receivers among the n candidate decrypters work together. Recently, Qin et al. [Security and Communication Networks, 2011] proposed an identity‐based multi‐receiver signcryption scheme with threshold decryption, and they declared that the scheme achieves ind‐cca2 and euf‐cma2 security. In this paper, we first indicate that Qin et al.'s scheme is not secure, that is, Qin et al.'s scheme is neither semantically secure against ind‐cca2 nor unforgeable against euf‐cma2. After that, we present an improved scheme to capture the security requirements. Furthermore, we construct an anonymous version that can preserve the identity privacy of the sender and receiver, and we give the performance evaluation to indicate that our scheme has lower communication overhead although it provides the identity privacy preservation. Copyright © 2012 John Wiley & Sons, Ltd.

Signcryption is a cryptographic primitive that fulfills both the functions of digital signature and public key encryption simultaneously, at a cost significantly lower than that required by the traditional signature-then-encryption approach. In this paper, we address a question whether it is possible to construct a hybrid signcryption scheme in identity-based setting. This question seems to have never been addressed in the literature. We answer the question positively in this paper. In particular, we extend the concept of signcryption key encapsulation mechanism to the identity-based setting. We show that an identity-based signcryption scheme can be constructed by combining an identity-based signcryption key encapsulation mechanism with a data encapsulation mechanism. We also give an example of identity-based signcryption key encapsulation mechanism.

This paper shows the first practical semantically secure public-key encryption scheme such that its one-wayness is equivalent togeneralfactoring in thestandardmodel [in the sense of indistinguishability against chosen-plaintext attack (IND-CPA)]. Next our proof technique is applied to the Rabin-Paillier encryption scheme and a variant of the RSA-Paillier encryption scheme to prove their one-wayness under the factoring assumption via tight security reductions.

Radio frequency identification (RFID) has been widely deployed for manufacturing, supply chain management, etc. Unfortunately, RFID may cause privacy and security problems. To solve these problems, researchers have studied extensively on RFID security systems. Ateniese et al. proposed an RFID protocol using insubvertible encryption based on the universal re-encryption. Although this protocol achieves the integrity of ciphertexts randomized by authorized users, it still leaves security problems. In this paper, we propose a secure RFID protocol based on insubvertible encryption involving guardian proxy. The guardian proxy is a personal RFID-privacy device which may be integrated into cellular phones or PDAs. By introducing the guardian proxy and other basic cryptographic primitives into RFID systems, our protocol is secure against the tag spoofing and swapping attacks. Moreover, our protocol enables ownership transfer.

The sensitive information leakage and security risk is a problem from which both individual and enterprise suffer in massive data collection and the information retrieval by the distrusted parties. In this paper, we focus on the privacy issue of data clustering and point out some security risks in the existing data mining algorithms. Associated with cryptographic techniques, we initiate an application of random data perturbation (RDP) which has been widely used for preserving the privacy of individual records in statistical database for the distributed data clustering scheme. Our scheme applies linear transformation of Gaussian distribution perturbed data and general additional data perturbation (GADP) schemes to preserve the privacy for distributed kernel density estimation with the help of any trusted third party. We also show that our scheme is more secure against the random matrix-based filtering attack which is based on analysis of the distribution of the eigenvalues by using two RDP methods.

Since their introduction in constructive cryptographic applications, pairings over (hyper)elliptic curves are at the heart of an ever increasing number of protocols. Software implementations being rather slow, the study of hardware architectures became an active research area. In this paper, we discuss several algorithms to compute the ηT pairing in characteristic three and suggest further improvements. These algorithms involve addition, multiplication, cubing, inversion, and sometimes cube root extraction over GF(3m). We propose a hardware accelerator based on a unified arithmetic operator able to perform the operations required by a given algorithm. We describe the implementation of a compact coprocessor for the field GF(397) given by GF(3)[x]/(x97+x12+2), which compares favorably with other solutions described in the open literature.

This paper presents a scalar multiplication method for Koblitz curves. Koblitz curves are elliptic curves where the scalar multiplication can be computed in a much faster way than with other curves, allowing designs and implementations without arithmetic coprocessor. The new method is as fast as the fastest known techniques on Koblitz curves but requires much less memory; therefore, it is of particular interest for environments with low resources. Our technique is well suited for both hardware and software implementations. In hardware, we show that a normal basis implementation reduces memory consumption by 85 percent compared to conventional methods, but this still has exactly the same computational cost. In software, thanks to a mixed normal-polynomial bases approach, our technique allows memory savings up to 70 percent and, depending on the instruction set of the CPU, can be as fast as the fastest known scalar multiplication methods or can even beat them by a large margin. Therefore, in software and in hardware, our scalar multiplication technique offers high performance without sacrifice in view of memory.

In this paper, we propose a modified etaTpairing algorithm in characteristic three which does not need any cube root extraction. We also discuss its implementation on a low cost platform which hosts an Altera Cyclone II FPGA device. Our pairing accelerator is ten times faster than previous known FPGA implementations in characteristic three.

Elliptic curve cryptosystems (ECC) are suitable for memory-constraint devices like smart cards due to their small key-size. A standard way of computing elliptic curve scalar multiplication, the most frequent operation in ECC, is window methods, which enhance the efficiency of the binary method at the expense of some precomputation. The most established window methods are sliding window on NAF (NAF+SW), wNAF, and wMOF, where NAF and MOF are acronyms for nonadjacent form and mutually opposite form, respectively. A common drawback of these schemes is that only a small portion of the numbers is possible sizes for precomputation tables. Therefore, in practice, it is often necessary to waste memory because there is no table fitting exactly the available storage. In the case of wNAF, there exists a variant that allows arbitrary table sizes, the so-called fractional wNAF (Frac-wNAF). In this paper, we give a comprehensive proof using Markov theory for the estimation of the average nonzero density of the Frac-wNAF representation. Then, we propose the fractional wMOF (Frac-wMOF), which is a left-to-right analogue of Frac-wNAF. We prove that Frac-wMOF inherits the outstanding properties of Frac-wAF. However, because of its left-to-right nature, Frac-wMOF is preferable as it reduces the memory consumption of the scalar multiplication. Finally, we show that the properties of all discussed previous schemes can be achieved as special instances of the Frac-wMOF method. To demonstrate the practicability of Frac-wMOF, we develop an on-the-fly algorithm for computing elliptic curve scalar multiplication with a flexibly chosen amount of memory.

This paper describes a module-based behavior selection architecture for a personal robot intended for a real world environment. We adopt the Emotional GrOunded architecture for a basis, and define and describe a behavior module and an associated tree structure for controlling many behavior modules. Also we discuss the requirements and approach for controlling the behavior module tree. Through experimentation and implementation on QRIO SDR4X-II, we confirm the feasibility and design of the behavior selection system.

This paper focuses OD the design and evaluation of behavior module selection and motion modulation based on emotion in the emotionally grounded (EGO) architecture that is applied in autonomous robot QRIO SDR-4 X II. In the EGO architecture, a behavior module is selected based on homeostasis in order for the robot to regulate its internal state within a certain range. Each behavior module has a value called activation level (AL) that is composed of motivation value (Mot) and releasing value (Rel). Mot determines the degree that the instinct drives the behavior module. It is derived from internal state. Rel is the degree that reflects how much external stimuli would satisfy an internal state as a result of the behavior. It is derived from the internal state and external stimuli. Each behavior module competes in AL to select a behavior module. Emotion is a key for motion modulation. It is derived from the internal state, its change, and the expected change of internal state associated with external stimuli in long-term memory. Through the implementation and experiments on QRIO SDR-4X II, we confirm the behavior selection and motion modulation processes in the EGO architecture.

Presents a method for creating high-fidelity models of animal behavior for use in robotic systems based on a behavioral systems approach, and describes in particular how an ethological model of a domestic dog can be implemented with AIBO, the Sony entertainment robot.