Temporary keyword search on confidential data in a cloud environment is the main focus of this research. The cloud providers are not fully trusted. So, it is necessary to outsource data in the encrypted form. In the attribute-based keyword search (ABKS) schemes, the authorized users can generate some search tokens and send them to the cloud for running the search operation. These search tokens can be used to extract all the ciphertexts which are produced at any time and contain the corresponding keyword. Since this may lead to some information leakage, it is more secure to propose a scheme in which the search tokens can only extract the ciphertexts generated in a specified time interval. To this end, in this paper, we introduce a new cryptographic primitive called key-policy attribute-based temporary keyword search (KP-ABTKS) which provide this property. To evaluate the security of our scheme, we formally prove that our proposed scheme achieves the keyword secrecy property and is secure against selectively chosen keyword attack (SCKA) both in the random oracle model and under the hardness of Decisional Bilinear Diffie-Hellman (DBDH) assumption. Furthermore, we show that the complexity of the encryption algorithm is linear with respect to the number of the involved attributes. Performance evaluation shows our scheme's practicality.

Concurrent signatures allow two entities to generate two signatures in such a way that both signatures are ambiguous till some information is revealed by one of the parties. This kind of signature is useful in auction protocols and in a wide range of scenarios in which involving participants are mutually distrustful. In this study, to have quantum‐attack‐resistant concurrent signatures as recommended by National Institute of Standards and Technology (NISTIR 8105), the first concurrent signature scheme based on coding theory is proposed. Then, its security is proved under Goppa Parameterized Bounded Decoding and the Goppa Code Distinguishing assumptions in the random oracle model. In addition, performance evaluation shows that the proposal is approximately as efficient as Dallot scheme. The authors should highlight that their proposal can be a post‐quantum candidate for fair exchange of signatures without a trusted third party in an efficient way (without a high degree of interactions).

Abstract In this paper, we propose the first provable secure certificate‐based proxy signature (CBPS) with message recovery without bilinear pairing. In 2003, Gentry introduced the concept of certificate‐based cryptography to solve certificate management and key escrow problems in public key infrastructure and identity‐based cryptosystems, respectively. Because the overall cost of pairing computation is higher than scalar multiplication (e.g., over elliptic curve group), consequently, the CBPS schemes without pairings would be more efficient. According to the available research in this regard, our scheme is the first provable secure CBPS scheme with message recovery that is based on the elliptic curve discrete logarithm problem. We prove the security of the presented scheme in the random oracle model against existential forgery under adaptive chosen message and ID attacks. Moreover, the paper will also show how it would be possible to convert this scheme to the CBPS scheme without message recovery. This scheme has more applications in cases with constrain power and restricted bandwidth. Copyright © 2016 John Wiley & Sons, Ltd.

The notions of identity-based multi-proxy signature, proxy multi-signature and multi-proxy multi-signature have been proposed to facilitate public key certificate management of these kinds of signatures by merely employing signer's identities in place of the public keys and their certificates. In the literature, most identity-based multi-proxy signature, proxy multi-signature and multi-proxy multi-signature schemes are based on bilinear pairings. Without incorporating bilinear pairings, Tiwari and Padhye proposed an identity-based proxy multi-signature scheme in 2011. Subsequently, an identity-based multi-proxy multi-signature scheme was proposed by Tiwari et al. in 2012. First, we review identity-based (multi)-proxy multi-signature schemes without bilinear pairings and show that unfortunately, they are insecure in their security models. Secondly, we propose an identity-based multi-proxy multi-signature scheme without bilinear pairings, where identity-based multi-proxy signature and proxy multi-signature schemes are its special cases. Then, we prove that they are secure under Rivest, Shamir and Adleman (RSA) assumption in the random oracle model by presenting a new Forking Lemma. The proposal and its special cases are the first identity-based multi-proxy signature, proxy multi-signature and multi-proxy multi-signature from RSA assumption.

In this study, the authors evaluate the security of the lightweight block cipher KLEIN‐64 using biclique cryptanalysis. They first point out some new weaknesses of the diffusion layer and key schedule of this algorithm. Then they exploit them to cryptanalyst the full round version of KLEIN‐64 using an asymmetric biclique. The (worst case) computations and data complexity of this cryptanalysis are 2 62.84 and 2 39 , respectively. A modified version of this cryptanalysis is also presented which is slightly faster at the expense of the data required.

Abstract Proxy signatures allow an entity to delegate its signing capability to a proxy which can sign messages on behalf of the delegator. We examine identity‐based versions of proxy signatures which employ identity strings in place of randomly generated public keys. First, we give a new generic construction of identity‐based proxy signatures from identity‐based standard signatures and show that our generic construction is secure if the underlying identity‐based standard signature is secure. In addition, we present the first identity‐based proxy signature from Rivest, Shamir and Adleman (RSA), secure under the one‐wayness of RSA in the random oracle model. We should highlight that the proxy key exposure attack cannot be applied to our proposed constructions. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract Proxy ring (anonymous proxy) signatures allow an entity to delegate its signing capability to a group of entities (proxy group) such that only one of the members in the proxy group can generate a proxy signature on behalf of the delegator, while privacy of the proxy signer is protected. Identity‐based versions of proxy ring signatures employ identity strings in place of randomly generated public keys. Our contribution is twofold. First, we formalize a security model foridentity‐basedproxy ring signatures. We note that there exists no formal security model foridentity‐basedproxy ring signatures prior to our work. Second, we presentthe firstprovably secureidentity‐basedproxy ring signature scheme using a new paradigm called sequential aggregation. The construction is proved secure, under the one‐wayness assumption of RSA, in the random oracle model by presenting a new forking lemma. We should highlight that the proxy key exposure attack cannot be applied to our scheme. Further, in contrast to the existing schemes that are based on pairings, our scheme is based on RSA; therefore, it outperforms the existing schemes in terms of efficiency and practicality. Copyright © 2014 John Wiley & Sons, Ltd.

In order to provide anonymity, universal cryptosystems have been used in various applications, including mixnets with multiple receivers. Unlike ordinary re-encryption cryptosystems, universal cryptosystems for re-encryption of ciphertexts do not require knowledge of the public key of the receiver. Golle et al. introduced universal cryptosystems for public key cryptography. Contrary to public key cryptography, in ID-based cryptography, a public key infrastructure is not needed, which makes it suitable for situations where it is not cost-effective to distribute certificates or establish a public key infrastructure. In this paper, we first generalize the definition of universal cryptosystems and the notion of universal semantic security to ID-based cryptography, then we propose two ID-based universal cryptosystem schemes, and lastly we prove the security of these two schemes. The first scheme has higher efficiency in terms of computation and communication while the second scheme has proof of security in the standard model and has a tighter security band. Copyright © 2015 John Wiley & Sons, Ltd.

Recently, AIDA/cube testers have been revealed to be useful in building distinguishers for several cryptography schemes. χ 2 tests, on the other hand, are well known and extensively used for distinguishing purposes. In this study, the notion of multi‐χ 2 test and AIDA/cube testers are utilised to introduce the superpoly algebraic normal form monomial test through which the output of reduced round Trivium is distinguished from being random. The test successfully distinguishes the keystream of Trivium with 830 out of 1152 initialisation rounds with a complexity of 2 39 operations, which is the most effective distinguisher on reduced Trivium thus far. Applying algebraic IV differential attack (AIDA)/cube testers to a system, one of the main concerns is the appropriate choice of the superpoly variables, in the sense that the complexity of distinguishing the system output becomes near minimal. In an effort to discover appropriate superpoly variables, the authors propose a heuristic method that determines weak combination set of bits. The notion of weak combinations is defined in this study as a property ofthe cube variables whose corresponding superpoly is distinguishable. This heuristic method is performed on reduced round Trivium and its strength on determining appropriate superpoly variables is verified for 730 and 760 rounds Trivium.

A secret key agreement framework involving three users is considered in which each of the users 1 and 2 intends to share a secret key with user 3 and users 1 and 2 are eavesdroppers with respect to each other. There is a generalized discrete memoryless multiple access channel (GDMMAC) from users 1 and 2 to user 3 where the three users receive outputs from the channel. Furthermore, there is a feedback channel from user 3 to users 1 and 2 through which user 3 sends information extracted from the received output from the GDMMAC to increase the key rates. We consider both noiseless and noisy feedback. In the case of noiseless feedback, a public channel of unlimited capacity from user 3 to users 1 and 2 is used only once. In the case of noisy feedback, a noisy broadcast channel (BC) from user 3 to users 1 and 2 can be repeatedly used, like GDMMAC. In both setups, inner bounds of the secret key capacity region are derived. The secret key capacity region is derived in some special cases where the channel inputs and outputs form Markov chains in certain orders. For illustration, the corresponding results are also derived and discussed for Gaussian channels. The cases with noiseless feedback, noisy feedback, and no feedback at all are compared with each other.

ABSTRACT In pseudonym systems, users by means of pseudonyms anonymously interact with organizations to obtain credentials. The credential scheme constructed by Lysyanskaya and Camenisch is among the most complete credential systems, in which “all‐or‐nothing” sharing scheme is used to prevent users sharing their credentials. If a user cannot directly show a credential issued by an organization, she or he has to give her or his own secret key to someone else as a proxy; afterward, the proxy can show the credential on behalf of the user. Thus, according to the all‐or‐nothing property of the system, having the user's secret key, the proxy can use all credentials of the user for itself. To solve this problem, in this paper, we present proxy zero‐knowledge proof and utilize it in Lysyanskaya and Camenisch anonymous credential system. In our proposed system, instead of giving the secret key to the proxy, the user generates a proxy key based on the desired credential particularly for the proxy. Therefore, the proxy neither is the owner of the user's credential nor uses his or her other credentials. Copyright © 2012 John Wiley & Sons, Ltd.

Privacy is faced with serious challenges in the ubiquitous computing world. In order to handle this problem, some researchers in recent years have focused on design and analysis of privacy-friendly ultralightweight authentication protocols. Although the majority of these schemes have been broken to a greater or lesser extent, most of these attacks are based on ad-hoc methods that are not extensible to a large class of ultralightweight protocols. So this research area still suffers from the lack of structured cryptanalysis and evaluation methods. In this paper, we introduce new frameworks for full disclosure attacks on ultralightweight authentication protocols based on new concepts of recursive linear and recursive differential cryptanalysis. The recursive linear attack is passive, deterministic, and requires only a single authentication session, if it can be applied successfully. The recursive differential attack is more powerful and can be applied to the protocols on which the linear attack may not work. This attack is probabilistic, active in the sense that the attacker suffices only to block some specific messages, and requires a few authentication sessions. Having introduced these frameworks in a general view, we apply them on some well-known ultralightweight protocols. The first attack can retrieve all the secret data of Yeh and SLMAP authentication protocols and the second one can retrieve all the secret data of LMAP++, SASI, and David-Prasad authentication protocols.

In this paper, the effect of using an insecure and noiseless feedback channel in increasing secret key rates is investigated. There is a generalized discrete memoryless multiple access channel (GDMMAC) between two transmitters and a receiver where, in addition to the receiver, both of the transmitters receive noisy channel outputs. Furthermore, an insecure and noiseless feedback channel exists from the receiver to the transmitters. Each of the transmitters intends to share a secret key with the receiver while keeping it concealed from the other transmitter. For this setup, an inner bound of the secret key capacity region is derived. For some special cases, the secret key capacity region is obtained, and the effect of the feedback channel usage is discussed through a binary-erasure example as well as in the Gaussian case.

A source model for secret key generation between terminals is considered. Two users, namely users 1 and 2, at one side communicate with another user, namely user 3, while at the other side via a public channel where three users can observe i.i.d. outputs of correlated sources. Each of users 1 and 2 intends to share a secret key with user 3 where user 1 acts as a wiretapper for user 2 and vice versa. In this model, two situations are considered: communication from users 1 and 2 to user 3 (the forward key strategy) and from user 3 to users 1 and 2 (the backward key strategy). In both situations, the goal is sharing a secret key between user 1 and user 3 while leaking no effective information about that key to user 2, and simultaneously, sharing another secret key between user 2 and user 3 while leaking no effective information about the latter key to user 1. This model is motivated by wireless communications when considering user 3 as a base station and users 1 and 2 as network users. For both the forward and backward key strategies, inner and outer bounds of secret key capacity regions are derived. In special situations where one of users 1 and 2 is only interested in wiretapping and not key sharing, the results agree with that of Ahlswede and Csiszar. Also, the authors investigate some special cases in which the inner bound coincides with the outer bound and secret key capacity region is deduced.

In this paper, a generalized multiple access channel (MAC) model for secret key sharing between three terminals is considered. In this model, there are two transmitters and a receiver where all three terminals receive noisy channel outputs. In addition, there is a one-way public channel from the transmitters to the receiver. Each of the transmitters intends to share a secret key with the receiver by using the MAC and the public channel, where the transmitters are eavesdroppers with respect to each other. Two strategies for secret key sharing are considered, namely, the pregenerated key strategy and the two-stage key strategy. For both of them, inner and outer bounds of the secret key capacity region are derived. Furthermore, the effect of the public channel is discussed and the two strategies are compared. In both strategies, it is assumed that the channel outputs at the transmitters are only used for eavesdropping and not as inputs to the encoders. The effect of this assumption in the presence of the public channel is analyzed for some Gaussian MACs.

A channel model for secret key generation between three terminals is considered. In this model, there is a two-user generalized multiple access channel (MAC) in which, in addition to the receiver, both transmitters receive noisy channel outputs. There is also a one-way public channel from the transmitters to the receiver. In this model, each of the transmitters intends to share a secret key with the receiver using the MAC and the public channel where the transmitters are eavesdroppers with respect to each other. In this setup, the channel outputs at the transmitters are only used for eavesdropping and not as inputs to the encoders. For the secret key rate pair, we derive the inner bound of the secret key capacity region. Thorough an example, it is shown that unlike the broadcast channel model, using a one-way public channel from the transmitters to the receiver is beneficial.

In this paper, we propose information theoretic schemes that achieve the rate-equivocation regions for the multiple-access relay channel with confidential messages. This channel consists of two users that play the role of eavesdropper for each other's message and a relay that helps them to have a reliable and secure communication. The relay can itself be an eavesdropper of the users messages. The first coding scheme used for achievability is noise forwarding strategy and the second is the combination of noise forwarding with the compress and forward strategy. In the first one, relay cooperates with the users to have a confidential communication by sending codewords independent of the secret messages. In the second one, in addition to sending independent codewords, relay also sends compressed version of the received signals. Using these schemes, we derive the inner bounds for the capacity-equivocation region of the described model.

New inner and outer bounds on the achievable compression–equivocation rate region for generalised secure data compression with side information are given that do not match in general. In this setup, two senders, Alice and Charlie intend to transmit information to Bob via channels with limited capacity so that he can reliably reconstruct their observations. The eavesdropper, Eve, has access to one of the channels at each instant and is interested in the source of the same channel at the time. Bob and Eve also have their own observations, which are correlated with Alice's and Charlie's observations. In this model, two equivocation and compression rates are defined with respect to the sources of Alice and Charlie. Furthermore, different special cases are discussed where the inner and outer bounds match. Our model covers the previously obtained results as well.

The charge recovery logic families have been designed several years ago not in order to eliminate the side-channel leakage but to reduce the power consumption. However, in this article we present a new charge recovery logic style not only to gain high energy efficiency but also to achieve the resistance against side-channel attacks especially against differential power analysis attacks. Our approach is a modified version of a classical charge recovery logic style namely 2N-2N2P. Simulation results show a significant improvement in DPA-resistance level as well as in power consumption reduction in comparison with 2N-2N2P and other DPA-resistant logic styles.