Abstract Verifiable encryption enables the decryption to be taken on properly generated ciphertexts, by making the encryptor provide a zero-knowledge proof. To meet the quantum-safe application requirements, such as key escrow, Lyubashevsky et al. proposed a one-shot verifiable encryption (LN17 scheme) based on the hardness of lattice problems. In their scheme, the FSwA-type zero-knowledge proof was obtained using rejection sampling on a discrete Gaussian distribution. In this paper, we present a construction of verifiable encryption that utilizes rejection sampling on bimodal Gaussian to get the associated zero-knowledge proof. Our new construction, while exhibiting a weaker soundness property than LN17 scheme, benefits from a smaller proof size, leading to a reduced size of the verifiable ciphertext. As for the weaker soundness property, it supports some applications such as key escrow where honestly generated verifiable ciphertexts are more useful to be decrypted out in the hope of doing some further computation tasks. We provide the efficiency comparison of the new construction by instantiating it with several sets of concrete parameters.

Fast reduction is a powerful modular reduction method for many ECC curves using NIST-style prime modulus. Based on fast reduction, existing vectorized modular multiplication schemes (such as MR and SMCOS) were constructed in succession. However, these schemes are only applicable to those NIST-style primes with just subtraction items. The vector design on fast reduction for ones with addition items (including certain well-known curves, NIST P-256 and SM2, etc.) rarely holds in practice because of the possible borrow situation. In this work, we fill this gap and propose a pipelined and vectorized fast reduction that, with the aid of pre-processing and post-processing, eliminates all potential borrow during the reduction. Based on the proposed reduction, we successfully construct a vectorized modular multiplication, namely Borrowless, which works with all NIST-style primes, including the ones with addition items. Using NIST P-256, SM2, and NIST P-224 curves as case studies, on the 32-bit ARM NEON platform, we demonstrate the effectiveness of Borrowless and its significant performance advantage over existing vector designs (e.g., CICOS and MR) and widely-used algorithm libraries (e.g., OpenSSL and GMP).

The security, privacy, and trust are the critical concerns in Vehicular Ad Hoc Networks (VANETs). The Security Credential Management System (SCMS) is one of the most promising PKI-based solutions, which adopts linkage-based pseudonym certificates and has been standardized by IEEE. This paper aims to address the issues of certificate revocation in the SCMS architecture. We propose ESCORT, achieving: (i) a privacy-preserving revocation transparency for linkage-based pseudonym certificates, enhancing the reliability of the SCMS architecture; (ii) an efficient certificate status check for vehicles, eliminating complicated computations in checking CRLs. We analyze the security and feasibility of ESCORT, and experimental results indicate its superior efficiency.

Recently, a series of vulnerabilities occurred to divulge or forge single sign-on tickets, such as the famous SolarWinds incident Once malicious attackers obtain fraudulent tickets, they can pry into user privacy as well as compromise the system by impersonating the victim user. Inspired by certificate transparency, a ticket transparency (TT) framework for detecting fraudulent tickets is proposed. However, it suffers from inefficiency and potential failure. In this paper, we further propose an enhanced ticket transparency (eTT) scheme, which ensures that all fraudulent tickets can be detected efficiently through a novel dual-backup structure to store ticket entries in the public log. Meanwhile, we design specific calculations for pairwise pseudonymous identifiers (PPIDs), to support fraudulent-detection towards tickets in which user identifiers are pseudonyms. We implemented the prototype system, and the experimental evaluation shows that eTT framework introduces acceptable overheads in the sign-on process.

Terminal users can deploy verification tools to verify Windows code-signing signatures and check their details (signing time, certificate chain, etc). Some representative verification tools are also adopted in related studies, which take tools’ outputs as contributing factors to analyse malicious software or certificate ecosystems. However, as code-signing signature verification is related to multiple dimensions, such as certificate status and system policies, getting accurate signature status and details is essential but rather complicated. And performance of different tools in verifications has not been well studied and compared with.We provide a novel methodology to inspect Windows code-signing verification tools, checking that if they print consistent results and details. We choose four representative tools to verify massive samples (more than 26 million) and collect their outputs. During the verification, we deploy a two-step verification method, which efficiently excludes 78.8% of samples (not signed). We write scripts to read each line of outputs, learning tools’ output structures. Then we can precisely locate and extract interested code-signing fields from outputs. After that, we compare these essential fields from different tools, and analyze inconsistent cases. Finally, we present three types of inconsistent cases: verifying neglect, timestamp disturbance, and compatibility/robustness issues. We find some verification tools may assert code-signing signatures as invalid due to external factors, such as unexpected signing or invalid timestamp.

Let$p=ef+1$be an odd prime for some$e$and$f$, and let$F_{p}$be the finite field with$p$elements. In this paper, we explicitly describe the trace representations of the binary characteristic sequences (of period$p$) of all the cyclic difference sets$D$which are some union of cosets of$e$th powers$H_{e}$in$F_{p}^{\ast }(\triangleq F_{p}\backslash \{0\})$for$e\leq 12$. For this, we define$e$th power residue sequences of period$p$, which include all the binary characteristic sequences mentioned above as special cases, and reduce the problem of determining their trace representations to that of determining the values of the generating polynomials of cosets of$H_{e}$in$F_{p}^{\ast }$at some primitive$p$th root of unity, and some properties of these values are investigated. Based on these properties, the trace representation and linear complexity not only of the characteristic sequences of all the known$e$th residue difference sets, but of all the sixth power residue sequences are determined. Furthermore, we have determined the linear complexity of a nonconstant$e$th power residue sequence for any$e$to be either$p-1$or$p$whenever$(e,(p-1)/n)=1$, where$n$is the order of 2 mod$p$.

Shamir proposed the first (t, n) threshold secret sharing scheme. Shamir's scheme is ideal and perfect. In this paper, we propose two modifications of Shamir's secret sharing scheme. In our first modification, each shareholder keeps both x-coordinate and y-coordinate of a polynomial as private share. In our second modification, dealer uses polynomial with degree larger than the threshold value t to generate shares for a (t, n) threshold scheme. We show that these two modified schemes are ideal and perfect. Using these two modifications, we design a multilevel threshold secret sharing schemes (MTSS). We prove that the proposed scheme is secure.

Predicate encryption provides fine-grained control over encryption and decryption. In a predicate encryption scheme, message is encrypted with a set of attributes, and decryption key is incorporated with a predicate. Only when the predicate evaluates to true over these attributes, the message can be correctly decrypted. We propose an extension to predicate encryption named delegate predicate encryption. In our extension, a user generates a encryption capability of a set of attributes, then sends the capability to a encryption proxy. Using this capability, the proxy can encrypt arbitrary message with these attributes without knowing anything about these attributes. We give a concrete construction from a predicate encryption scheme which supports the widest range of predicate known to date. Then, using our extension, we are able to construct an anonymous authentication scheme. In our anonymous authentication scheme, authentication rules can be described in an very expressive way, while the anonymity of user is protected and the authentication rules are also hidden.