Security protocols usually rely on public-key cryptographic algorithms, particularly, public-key signatures (digital signatures) to achieve integrity, authentication and non-repudiation. In real-world scenarios, the most widely used public-key signature schemes are RSA, DSA, and ECDSA. Since these traditional public-key cryptographic primitives are supposed to be broken by a large scale quantum computer capable of implementing Shor’s algorithm, these algorithms must be replaced by post-quantum primitives to ensure the overall security in the post-quantum era. The ID-based signature schemes without requiring public-key certificates and PKI infrastructure are suitable for achieving authenticity and integrity of transmitted data in IoT environments. In this paper, we propose practical post-quantum ID-based signature schemes based on post-quantum signature schemes, suitable for resource-constrained IoT devices. We evaluate their practical feasibility on Skylake/Haswell as a server side platform and Cortex-M4 as an IoT device. We then investigate generalization and the best choices of the proposed post-quantum ID-based signature schemes in terms of communication cost, performance and applications.

Public-key cryptography (PKC) provides confidentiality, data integrity, and user authentication. Particularly, nonrepudiation, authentication and integrity of transmitted messages are assured by public-key (PK) signature schemes. Since the presence of a large scale quantum computer would be a real threat to break currently used PK cryptographic algorithms, all security protocols based on the PK cryptographic algorithms are vulnerable to quantum-computer attacks. It needs to investigate possible alternatives, post-quantum cryptography (PQC), believed to be resistant to attacks from both classical and quantum computers. All the traditional PKC should be replaced with PQC for secure communications in post-quantum era. In this work, we evaluate the post-quantum signature schemes in terms of various metrics, performance, signature/key sizes, energy consumption, resistance to implementation attacks and adaptability to Internet protocols. We then investigate their suitability for Internet of Things based on these metrics.

Although the cloud-assisted Industrial Internet of Things (IIoT) is emerging as one of the promising technologies to improve personal lifestyles, security and privacy issues are still challenging. Secure certificateless signature (CLS) schemes without certificates for the authentication of public keys are considered suitable for the resource-constrained IIoT security and authentication. Recently, Wang et al. pointed out several security weaknesses on the existing CLS schemes and then constructed a novel efficient CLS scheme based on the blockchain technique and the smart contract. In this work, we show that Wang et al.’s scheme is broken by key recovery attacks: anyone can recover the entire private keys of any users. We then propose a new secure CLS scheme and prove its unforgeability against type I and type II adversaries under the hardness assumption of the Elliptic Curve Diffie-Hellman problem.

Basic security requirements such as confidentiality, user authentication and data integrity, are assured by using public-key cryptography (PKC). In particular, public-key signature schemes provide non-repudiation, integrity of transmitted messages and authentication. The presence of a large scale quantum computer would be a real threat to break the most widely used public-key cryptographic algorithms in practice, RSA, DSA, ECDSA signature schemes and Diffie-Hellman key exchange. Thus, all security protocols and applications where these public-key cryptographic algorithms are used are vulnerable to quantum-computer attacks. There are five directions of cryptographic primitives secure against a quantum computer: multivariate quadratic equation-based, hash-based, lattice-based, code-based and supersingular isogeny-based cryptography. These primitives could serve as replacements for current public-key cryptographic algorithms to prepare for post-quantum era. It is important to prioritize the fields to be replaced by post-quantum cryptography (PQC) since it is hard to replace the currently deployed PKC with PQC at the same time. The fields directly connected to human life such as vehicular communications should be the primary targets of PQC applications. This survey is dedicated to providing guidelines for adapting the most suitable post-quantum candidates to the requirements of various devices and suggesting efficient and physically secure implementations that can be built into existing embedded applications as easily as traditional PKC. It focuses on the five types of post-quantum signature schemes and investigates their theoretical backgrounds, structures, state-of-the-art constructions and implementation aspects on various platforms raging from resource constrained IoT devices to powerful servers connected to the devices for secure communications in post-quantum era. It offers appropriate solutions to find tradeoffs between key sizes, signature lengths, performance, and security for practical applications.

More than 98% of all microprocessors sold worldwide are used in embedded devices, and will continue to accelerate due to the emerging applications in Internet of Things (IoT). Cryptographic algorithms based on multivariate quadratic (MQ) equations are suitable for low-cost IoT-constrained devices since they require only modest computational resources. In this article, we describe the design and implementations of a new public-key signature scheme based on MQ equations highly optimized for practicability. The novel scheme is obtained as a result of the combination of solvable systems of quadratic equations and sparse polynomials. We provide a security analysis of our scheme against known algebraic attacks and derive a concrete parameter. Performance of our scheme on an 8-b AVR microprocessor is the fastest among known signature schemes: signing of our scheme is about 36.4× faster than that of ECDSA-256 (NIST P-256), the most widely deployed international standard signature scheme. The signing of our scheme is about 8.6× and 11.0× faster than those of Rainbow and BLISS-BI, respectively. The secret size of our scheme has reduced by a factor of 87% compared to Rainbow. Our scheme requires signatures of 80 B which is comparable to ECDSA-256 of 64 B. We also implement a protected version of our scheme on the 8-b microprocessor to prevent the current side-channel attacks presented in CHES 2018. Even our protected version is the fastest singing among the known signature schemes.

To solve security and privacy issues in wireless body area networks, several types of digital signature schemes have been adapted to a number of authentication protocols. Recently in IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY (TIFS) (DOI: 10.1109/TIFS.2015.2414399), Xiong and Qin proposed a revocable certificateless encryption (R-CLE) scheme against decryption key exposure, and a revocable certificateless signature (R-CLS) scheme against signing key exposure. Then they proposed a revocable and scalable certificateless remote authentication protocol with anonymity for wireless body area networks based on the combination of R-CLE scheme and R-CLS scheme. However, we show that their RCLS scheme is insecure against type I adversaries: a type I adversary who knows only a user's secret value can forge signatures on any messages in the same time period. Hence, their authentication protocol fails to meet the claimed security requirements.

A public-key cryptographic algorithm based on multivariate quadratic equations is one of promising post-quantum alternatives for current public-key cryptography. The security of multivariate quadratic schemes has been sufficiently analyzed mathematically, but few works have been devoted to implementation attacks. In this paper, we present algebraic fault analysis of two well-known multivariate quadratic schemes, UOV and Rainbow, which combines fault attacks with key recovery attacks using good keys. We focus on fault attacks which cause faults on random Vinegar values used in signing. Our fault models are divided into three cases according to the leakage types of the Vinegar values: reused, revealed and set to zero. We show that the equivalent key of UOV is completely recovered in polynomial time from (m+1), n and m signatures generated by the entire faulty Vinegar values in the three cases, respectively. Specifically, the equivalent key of UOV is completely recovered from 45, 103 and 44 signatures generated by 59 bytes of faulty Vinegar values in the three cases, respectively, at a 128-bit security level. The equivalent key of Rainbow is also recovered from 44, 79 and 43 signatures with 36 bytes of faulty Vinegar values in the three cases, respectively. This is the first result that leads to the full secret key recovery of UOV and Rainbow from the leakage of the Vinegar values. In the other cases, we show that complexities of the key recovery attacks on Rainbow and UOV are significantly weakened in terms of the number of faulty Vinegar values. Our attacks can be applied to Rainbow and LUOV selected to NIST Post-Quantum Cryptography Standardization Round 2. Countermeasures against our attacks are investigated.

Recently, in IEEE INTERNET OF THINGS JOURNAL (DOI: 10.1109/JIOT.2018.2876133), Saeed et al. proposed a lightweight online/offline certificateless signature scheme, L-OOCLS, and proposed a heterogeneous remote anonymous authentication protocol (HRAAP) based on L-OOCLS for remote wireless body area networks users to enjoy various healthcare services on Internet of Things applications. In this paper, we show that L-OOCLS is entirely broken: anyone can forge certificateless signatures on any messages for any identities from only publicly known information. Thus, the scheme is trivially insecure against the type I adversary who can replace user public keys and the type II adversary who knows the master secret key. Our result shows that their security proofs are also flawed.

Multi-user broadcast authentication is an important security service in wireless sensor networks (WSNs), as it allows a large number of mobile users of the WSNs to join in and broadcast messages to WSNs dynamically and authentically. To reduce communication cost due to the transmission of public-key certificates, broadcast authentication schemes based on identity (ID)-based cryptography have been proposed, but the schemes suffer from expensive pairing computations. In this paper, to minimize computation and communication costs, we propose a new provably secure pairing-free ID-based signature schemes with message recovery, MR-IBS, and PMR-IBS. We then construct an ID-based multi-user broadcast authentication scheme, BASIS, based on MR-IBS and PMR-IBS for broadcast authentication between users and a sink. We evaluate the practical feasibility of BASIS on WSN hardware platforms, MICAz and Tmote Sky are used in real-life deployments in terms of computation/communication cost and energy consumption. Consequently, BASIS reduces the total energy consumption on Tmote Sky by up to 72% and 17% compared with Bloom filter-based authentication scheme based on a variant of ECDSA with message recovery and IMBAS based on a ID-based signature scheme with message appendix, respectively.

Energy cost of transmitting a single bit of information is approximately the same as that needed for processing a thousand operations in a typical sensor node. Thus, a practical way to prolong a wireless sensor network lifetime is to reduce the sensor energy consumption in data transmissions. Data aggregation is an efficient way to minimize energy consumption on sensors. In this paper, we propose a practical secure data aggregation scheme, Sen-SDA, based on an additive homomorphic encryption scheme, an identity-based signature scheme, and a batch verification technique with an algorithm for filtering injected false data. We then investigate the feasibility of our scheme using low-cost microcontrollers choosing two popular IEEE 802.15.4-compliant wireless sensor network hardware platforms, MICAz and Tmote Sky, used in real-life deployments.

ABSTRACT Because wireless sensor network (WSN), which is composed of a large number of low‐cost and resource‐constrained devices, communicates on the basis of wireless protocols such as IEEE 802.15.4, ZigBee, and DASH‐7, it is easily vulnerable to eavesdropping, illegal modification, privacy infringement and denial‐of‐service attacks. These attacks destroy the data integrity, confidentiality, and authentication of the basic WSN security requirements and then the reliability and security of the WSN‐based applications are deteriorated. There have been many research efforts to make secure WSN environments. Among these efforts, TinyECC is one of outstanding works. It provides several security protocols such as Elliptic Curve Diffie–Hellman, Elliptic Curve Digital Signature Algorithm, and Elliptic Curve Integrated Encryption Scheme, based on the Elliptic Curve Cryptography (ECC). TinyECC is basically a well‐written TinyOS‐based code and is optimized to resource‐constrained environments. The Barrett reduction, hybrid multiplication, and several optimization techniques are also used for high performance even with low‐energy consumption. However, the hybrid multiplication technique used in TinyECC is known to be not suitable for 16‐bit processor, MSP430, which is a familiar processor for sensor node. This is due to the fact that the MSP 430 processor does not provide enough number of registers for hybrid multiplication techniques. Because the multiplication operation over the finite field is a major operation of the ECC, it causes a high latency of multiplication operations and eventually degrades the performance of the ECC operation. In this paper, we propose a novel multiplication operation based on the cached operands and reordered partial products. The proposed method shows that the latency of the polynomial multiplication, which is the core operation of the ECC, is 6% smaller than previously known results. Copyright © 2012 John Wiley & Sons, Ltd.

Jiang et al. proposed an authentication scheme for Vehicle-to-Infrastructure communications using a Binary Authentication Tree. The scheme can effectively eliminate the performance bottleneck when verifying a mass of signatures within a rigorously required interval and filtering bogus messages. In this paper, we show that Jiang et al.'s scheme is insecure against forgery attacks, replay attacks and Sybil attacks. To overcome the weaknesses, we reconstruct a conditional privacy-preserving authentication scheme, called sf CPP-BAT, for Vehicle-to-Infrastructure communications based on secure identity-based signature, aggregate signature schemes and the Binary Authentication Tree.

Recently, Xiong et al. and Selvi et al. proposed a certificateless signature scheme secure in the standard model and a certificateless multi-receiver signcryption scheme secure in the random oracle model, respectively. In this paper, we show that they are insecure against malicious-butpassive KGC attacks. More specifically, the former does not achieve unforgeability and the latter does not satisfy confidentiality against type II adversaries.