TLS 1.3 is widely used to realize secure communication over the Internet. Existing security analyses of TLS 1.3 primarily focus on its handshake protocol which is indeed an authenticated key exchange (AKE) protocol, and implicitly neglect the so-called subversion attacks (e.g., breaking TLS via Dual EC) in the real world. Reverse firewall (RF) is a prevalent approach to defend against subversion attack. To the best of our knowledge, the only two subversion-resilient AKE protocols with RFs are proposed by Dodis et al. (CRYPTO'16) and Bossuat et al. (ESORICS'20). The security of both protocols is proved under game-based model which is insufficient for the concurrent execution of multiple TLS instances in practice. In this paper, we propose$\mathsf {srTLS}$, a variant of the TLS 1.3 full one round-trip time (1-RTT) handshake protocol with RFs under the universally composable (UC) model. In particular, we first present the ideal functionality of unilateral AKE$\mathcal {F}_{\mathsf {uaKE}}$. Then, we use RFs with outer transparency to circumvent the difficulty in sanitizing the messages of handshake protocol, and prove that$\mathsf {srTLS}$UC-realizes$\mathcal {F}_{\mathsf {uaKE}}$in the presence of subversion attacks. Finally, we integrate$\mathsf {srTLS}$and existing subversion-resilient AKE protocols into TLS 1.3. The evaluation result demonstrates that$\mathsf {srTLS}$achieves at least a 44.86% efficiency improvement over other subversion-resilient AKE protocols.

To address the confidentiality concerns of malicious adversaries that fully compromise the message broker in pub/sub based IoT systems, several researchers use proxy re-encryption (PRE) to realize end-to-end encrypted message distribution (from publisher to subscriber). However, the all-or-nothing share feature of PRE poses a problem that the share cannot be efficiently revoked. The only way for publishers to revoke the access rights of subscribers is to pick a new public-private key pair and re-generate the re-encryption keys for all the remaining subscribers, which hampers the scalability in practice. To realize efficient user revocation, we present REEDS, an efficient revocable end-to-end encrypted message distribution system for IoT. The core of REEDS is a novel proxy-aided identity-based conditional proxy re-encryption (PIB-CPRE) scheme. Essentially, we use a binary-tree structure to organize re-encryption keys, so that the update of re-encryption keys is reduced from linear to logarithmic in the number of subscribers. We show that REEDS satisfies confidentiality, efficient immediate revocation, decentralized authorization, and maintains low overhead for publishers and subscribers. The prototype system is implemented and its performance is evaluated. The results show that REEDS is not only easy to deploy over existing message brokers but also highly efficient.

The Snowden revelations in 2013 showed that user machines running cryptographic protocols might be stealthily corrupted by attackers (e.g., manufacturers and supply-chain intermediaries) who could tamper cryptographic implementations to insert backdoors to undermine cryptographic tools. To formalize such attacks, in CRYPTO 2014, Bellareet al.proposed the notion of Algorithm-Substitution Attack (ASA) which has been extensively studied since then. In this work, we turn to investigate the security of anonymous communication (AC) protocol—a well-known tool to protect user privacy on the Internet—in the case when user machines are corrupted. Specifically, we give a formal treatment of ASAs on the universal mixnet-based AC ($\mathsf{U\text{-}Mix\text{-}AC}$) protocols. We show that ASAs on$\mathsf{U\text{-}Mix\text{-}AC}$protocols could be more dangerous than previously thought by presenting attacks that are extremely powerful. As countermeasure, we adopt cryptographic reverse firewall (CRF), originally proposed by Mironov and Stephens-Davidowitz in EUROCRYPT 2015, to restore the security of$\mathsf{U\text{-}Mix\text{-}AC}$protocols in the presence of ASAs. We also implement proposed AC protocol, ASAs and CRFs for experimental evaluations, and the results show that the execution time of subverted algorithms is almost the same as that of faithful ones and our designed CRFs are effective to guard the security of$\mathsf{U\text{-}Mix\text{-}AC}$protocol.

In vehicular ad hoc networks (VANETs), conditional privacy preserving authentication (CPPA) scheme is widely deployed to solve security and privacy issues. Existing CPPA schemes usually require ideal tamper-proof devices (TPDs) on vehicles which, however, might be infeasible or do not exist in reality due to high security requirements. To address this problem, we propose a practical framework of CPPA scheme that supports more realistic TPDs which are less secure correspondingly. We demonstrate that this framework also manages to achieve nonframeability in addition to other security objectives including nonrepudiation, conditional privacy preserving, and unlinkability. Moreover, performance analysis shows that our framework has better efficiency in authentication. All these features make our framework practical for VANETs.

Revocable Identity-Based Encryption (RIBE) allows feasible key revoke to enable dynamic user management in certificateless system. The existing RIBE schemes fail to keep receivers anonymity, or short parameters, or adaptive security. Hence, we overcome the drawbacks of previous schemes and contribute to an Anonymous RIBE (ARIBE) scheme with two advantages: (1) the provable full security under the adaptive-ID attack in the standard model and (2) the sufficient efficiency in optimal parameters-the secret subkey and the update subkey are one group element each and decryption only requires two pairings. To our best knowledge, our construction is the first IBE scheme that simultaneously achieves efficient revocability, anonymity and full security in the exponent-inversion IBE family.