Establishing a strong link between the paper medium and the data represented on it is an interesting alternative to defeat unauthorised copy and content modification attempts. Many applications would benefit from it, such as show tickets, contracts, banknotes or medical prescripts. In this study, the authors present a low-cost solution that establishes such a link by combining digital signatures, physically unclonable functions and fuzzy extractors. The proposed protocol provides two levels of security that can be used according to the time available for verifying the signature and the trust in the paper holder. In practice, this solution uses ultra-violet fibres that are poured into the paper mixture. Fuzzy extractors are then used to build identifiers for each sheet of paper and a digital signature is applied to the combination of these identifiers and the data to be protected from copy and modification. The authors additionally provide a careful statistical analysis of the robustness and amount of randomness reached by the extractors. The authors conclude that identifiers of 72 bits can be derived, which is assumed to be sufficient for the proposed application. However, more randomness, robustness and unclonability could be obtained at the cost of a more expensive process, keeping exactly the same methodology.

Forward-Secure Signatures (FSS) prevent forgeries for past time periods when an attacker obtains full access to the signer’s storage by evolving the private key in a one-way fashion. To simplify the integration of these primitives into standard security architectures, Boyen et al. [2006] recently introduced the concept of forward-secure signatures with untrusted updates where private keys are additionally protected by a second factor (derived from a password). Key updates can be made on encrypted version of signing keys so that passwords only come into play for signing messages and not at update time (since update is not user-driven). The scheme put forth by Boyen et al. relies on bilinear maps and does not require the random oracle. They also suggest the integration of untrusted updates in the Bellare-Miner forward-secure signature. Their work left open the problem of endowing other existing FSS systems with the same second factor protection, and a natural second question is whether the method can apply to other key-evolving paradigms. This article solves the first problem by showing an efficient generic construction that does not require to set a bound on the number of time periods at key generation. The article then extends the unprotected update model to other key-evolving primitives such as forward-secure public key encryption and key-insulated cryptosystems.

In wireless roaming a mobile device obtains a service from some foreign network while being registered for the similar service at its own home network. However, recent proposals try to keep the service provider role behind the home network and let the foreign network create a tunnel connection through which all service requests of the mobile device are sent to and answered directly by the home network. Such Wireless Roaming via Tunnels (WRT) offers several (security) benefits but states also new security challenges on authentication and key establishment, as the goal is not only to protect the end-to-end communication between the tunnel peers but also the tunnel itself.

The rapid advancement and the wide-spread use of the Internet and wireless communications in our professional endeavors and personal lives are making ubiquitous authenticated connectivity for mobile users indispensable. Individuals and groups may roam within a network or across networks, either in infrastructure or ad hoc mode. In any case, uninterrupted authenticated communication would be required for numerous applications, in particular real-time multimedia applications. In this paper, we propose an imbricated protocol suite for authentication in different mobility contexts at both the intra-and inter-network levels. To the best of our knowledge, this is the first comprehensive treatment of authentication in mobile networks. We demonstrate that our solution supports seamless secure mobility while incurring low overhead in the authentication process.

Checking data possession in networked information systems such as those related to critical infrastructures (power facilities, airports, data vaults, defense systems, etc.) is a matter of crucial importance. Remote data possession checking protocols permit to check that a remote server can access an uncorrupted file in such a way that the verifier does not need to know beforehand the entire file that is being verified. Unfortunately, current protocols only allow a limited number of successive verifications or are impractical from the computational point of view. In this paper, we present a new remote data possession checking protocol such that: i) it allows an unlimited number of file integrity verifications; ii) its maximum running time can be chosen at set-up time and traded off against storage at the verifier.

Forward-secure signatures (FSS) prevent forgeries for past time periods when an attacker obtains full access to the signer’s storage. To simplify the integration of these primitives into standard security architectures, Boyen, Shacham, Shen and Waters recently introduced the concept of forwardsecure signatures with untrusted updates where private keys are additionally protected by a second factor (derived from a password). Key updates can be made on encrypted version of signing keys so that passwords only come into play for signing messages. The scheme put forth by Boyen et al. relies on bilinear maps and does not require the random oracle. The latter work also suggested the integration of untrusted updates in the Bellare-Miner forward-secure signature and left open the problem of endowing other existing FSS systems with the same second factor protection. This paper solves this problem by showing how to adapt the very efficient generic construction of Malkin, Micciancio and Miner (MMM) to untrusted update environments. More precisely, our modified construction- which does not use random oracles either- obtains a forward-secure signature with untrusted updates from any 2-party multi-signature in the plain public key model. In combination with Bellare and Neven’s multi-signatures, our generic method yields implementations based on standard assumptions such as RSA, factoring or the hardness of computing discrete logarithms. Like the original MMM scheme, it does not require to set a bound on the number of time periods at key generation.

The deployment of wireless networks is in permanent growth. To exploit their intrinsic mobility advantages, collaborative networks such as first responder networks (FRNs) have recently adopted wireless networking technologies, Albiet at a small scale. FRNs require the collaboration of heterogeneous and mobile groups. Impeding the wide-scale use of wireless networking in FRNs are the many security challenges like user authentication, information flow and wireless media management. In this paper, we propose a solution that enables authenticated communication among multiple FRNs which is especially needed during critical events such as intervention in disaster situations. Our solution uses a two-level hierarchical proxy signature to decentralize the authentication process across different administrative networks. To the best of our knowledge, this is the first construction of two-level signature delegation applied to wireless environments. Security and performance analysis and comparison with other works demonstrate the viability and advantages of our solution.

This work explores a hardware design alternative and a cost assessment of an FPGA-based brute force attack against the challenge RC5-72. The aim is to develop an alternative to software-based solutions for distributed.net. Hardware platforms, particularly reconfigurable hardware, can offer significant cost, flexibility and performance advantages, while significantly reducing environmental energy costs and impacts. Implementation results show that an 80 US$ FPGA can yield a throughput of 145 Mkeys/sec with a power consumption of 10 Watts. This is roughly an order of magnitude faster, cheaper and lower power, when compared with fully dedicated general purpose computers.

Currently, the best known algorithm for factorizing modulus of the RSA public key cryptosystem is the Number Field Sieve. One of its important phases usually combines a sieving technique and a method for checking smoothness of mid-size numbers. For this factorization, the Elliptic Curve Method (ECM) is an attractive solution. As ECM is highly regular and many parallel computations are required, hardware-based platforms were shown to be more cost-effective than software solutions. The few papers dealing with implementation of ECM on FPGA are all based on bit-serial architectures. They use only general-purpose logic and low-cost FPGAs which appear as the best performance/cost solution. This work explores another approach, based on the exploitation of embedded multipliers available in modern FPGAs and the use of high-performances FPGAs. The proposed architecture - based on a fully parallel and pipelined modular multiplier circuit - exhibits a 15-fold improvement over throughput/hardware cost ratio of previously published results.

RSA cryptosystem is one of the most widely used algorithms nowadays. However when it is implemented in embedded devices such as smart cards, it can be vulnerable to power analysis attacks and fault attacks. To defeat all known side channel attacks and fault attacks, several countermeasures should be used together. However due to the low computation capability of the embedded devices, we have to find the best solution or combination among countermeasures. Furthermore, we should be careful since a countermeasure may produce another new vulnerability such as Yen et. al.'s safe-error attack in a simple power analysis (SPA) countermeasure. In 2005, Giraud proposed a scheme secure against simple power analysis as well as fault attack (FA). Afterwards, Fumaroli and Vigilant proposed an exponentiation algorithm secure against differential power analysis (DPA) as well as simple power analysis and fault attack with almost 1.5 times increase in time complexity compared to Giraud's. To the authors' best knowledge, it was a first trial to prevent SPA, DPA, and FA simultaneously on exponentiation with one solution. In this paper we show Fumaroli and Vigilant's scheme can be broken by fault attacks and propose a direction to construct efficient countermeasures secure against all known side channel analyses and fault attacks on RSA-CRT with low time complexity.

Encryption is the basic means to enforce confidentiality in digital communications. This work explores a hardware design alternative and a cost assessment of an FPGA-based brute force attack against RSA Secret-Key Challenge RC5-72. The aim is to develop an alternative to software-based solutions for distributed. net. Implementation results show that an 80 US$ FPGA can yield a throughput of 145 Mkeys/sec with a power consumption of 10 Watts. This is roughly an order of magnitude faster, cheaper and lower power, when compared with fully dedicated general purpose computers.

This paper proposes different low-cost coprocessors for public key authentication on 8-bit smart cards. Elliptic curve cryptography is used for its efficiency per bit of key and the Elliptic Curve Digital Signature Algorithm is chosen. For this functionality, an area constrained coprocessor is probably the best approach to perform the most computer-intensive operations at an acceptable speed considering the limited memory and power of the selected platform. For that purpose, the scalar point multiplication in GF(2m) in both affine and projective coordinates was implemented in order to compare their performances with the same level of optimization and the same technology. A hardware/ software co-design strategy was also used to avoid the need of a dedicated register file.

This paper presents FPGA implementations of the DES and Triple-DES with improved security against power analysis attacks. The proposed designs use Boolean masking, a previously introduced technique to protect smart card implementations from these attacks. We demonstrate that recent reconfigurable devices offer excellent opportunities to implement a masked DES. In particular, we use the large embedded memories available in the Xilinx Virtex-II proreg FPGAs to store precomputed and masked substitution tables. Compared to an unprotected DES design, our proposal only requires 45% more logic resources and 128 Kbit of memory and yields a throughput of about 1 Gbit/sec

The A-GDH.2 and SA-GDH.2 authenticated group key agreement protocols showed to be flawed in 2001. Even though the corresponding attacks (or some variants of them) have been rediscovered in several different frameworks, no fixed version of these protocols has been proposed until now. In this paper, we prove that it is in fact impossible to design a scalable authenticated group key agreement protocol based on the same design assumptions as the A-GDH ones. We proceed by providing a systematic way to derive an attack against any A-GDH-type protocol with at least four participants and exhibit protocols with two and three participants which we cannot break using our technique. As far as we know, this is the first generic insecurity result reported in the literature concerning authentication protocols.

Since their introduction by Kocher in 1998, power analysis attacks have attracted significant attention within the cryptographic community. While early works in the field mainly threatened the security of smart cards and simple processors, several recent publications have shown the vulnerability of hardware implementations as well. In particular, field programmable gate arrays are attractive options for hardware implementation of encryption algorithms,but their security against power analysis is a serious concern, as we discuss in this paper. For this purpose, we present recent results of attacks attempted against standard encryption algorithms, provide a theoretical estimation of these attacks based on simple statistical parameters and evaluate the cost and security of different possible countermeasures.

<?Pub _touchup WordspNominal="1.6" WordspMinimum="1.3" WordspMaximum="2.9"?>The image compression standard JPEG 2000 proposes a large set of features that is useful for today's multimedia applications. Unfortunately, it is much more complex than older standards. Real-time applications, such as digital cinema, require a specific, secure, and scalable hardware implementation. In this paper, a decoding scheme is proposed with two main characteristics. First, the complete scheme takes place in a field-programmable gate array without accessing any external memory, allowing integration in a <?Pub /_touchup?>secured system. Second, a customizable level of parallelization allows to satisfy a broad range of constraints, depending on the signal resolution. The resulting architecture is therefore ready to meet upcoming digital cinema specifications.

This paper presents a hardware implementation of a decoder for Digital Cinema images. This decoder enables us to deal with image size of 2K with 24 frames per second and 36 bits per pixels. It is the first implementation known nowadays that perfectly fits in one single Virtex-II® FPGA and includes AES decryption, JPEG 2000 decompression and fingerprinting blocks. This hardware offers therefore high-quality image processing as well as robust security.

Modular multiplication and inversion/division are the most common primitives in today's public key cryptography. Elliptic curve public key cryptosystems (ECPKC) are becoming increasingly popular for use in mobile appliances where bandwidth and chip area are strongly constrained. For the same level of security, ECPKC use much smaller key length than the commonly used RSA but need modular inversion/division. This work presents an improved algorithm for prime field Montgomery modular inversion. The first important contribution lies in the reduction of the number of operations needed. Resource sharing is also used to lighten the control part of the algorithm. The second contribution is the minimization of the set of different instructions to enable powerful FPGA implementations. Resulting 256-bit circuit achieves a ratio throughput/area improved by at least 70% compared to the only known Montgomery inverse design in FPGA technology. Though the implementations are first oriented towards FPGA, some improvements are generic. So, they could prove to be also efficient for ASIC designs in terms of area and power consumption.

As intelligent electronic systems pervade all aspects of our lives, capturing. storing, and communicating a wide range of sensitive and personal data, security is emerging as a critical concern that must be addressed in order to enable several current and future applications. Mobile appliances, which will play a critical role in enabling the visions of ubiquitous computing and communications, and ambient intelligence, are perhaps the most challenging to secure - they often rely on a public medium for (wireless) communications, are easily lost or stolen due to their small form factors and mobility, and are highly constrained in cost and size, as well as computing and battery resources. This paper presents an introduction to security concerns in mobile appliances, and translates them into challenges that confront system architects, HW engineers, and SW developers, including how to bridge the processing and battery gaps, efficient tamper-proofing of devices, content protection, etc. Recent innovations and emerging commercial technologies that address these issues are also highlighted. We envision that. for a large class of embedded systems, security considerations will pervade all aspects of system design, driving innovations in system architecture, software, circuits, and design methodologies.

We propose a new mathematical DES description that allows optimized implementations. It also provides the best DES and triple-DES FPGA implementations known in term of ratio throughput/area, where area means the number of FPGA slices used. First, we get a less resource consuming unrolled DES implementation that works at data rates of 21.3 Gbps (333 MHz), using VIRTEX II technology. In this design, the plaintext, the key and the mode (encryption/decrytion) can be changed on a cycle-by-cycle basis with no dead cycles. In addition, we also propose sequential DES and triple-DES designs that are currently the most efficient ones in term of resources used as well as in term of throughput. Based on our DES and triple-DES results, we also set up conclusions for optimized FPGA design choices and possible improvement of cipher implementations with a modified structure description.

Reprogrammable devices such as Field Programmable Gate Arrays (FPGA's) are highly attractive options for hardware implementations of encryption algorithms and this report investigates a methodology to efficiently implement block ciphers in CLB-based FPGA's. Our methodology is applied to the new Advanced Encryption Standard RIJNDAEL and the resulting designs offer better performances than previously published in literature. We propose designs that unroll the 10 AES rounds and pipeline them in order to optimize the frequency and throughput results. In addition, we implemented solutions that allow to change the plaintext and the key on a cycle-by-cycle basis with no dead cycles. Another strong focus is placed on low area circuits and we propose sequential designs with very low area requirements. Finally we demonstrate that RAM-based implementations implies different constraints but our methodology still holds.

We present a new identity based scheme using pairings over elliptic curves. It combines the functionalities of signature and encryption and is provably secure in the random oracle model. We compare it with J. Malone-Lee's scheme from the points of view of security and efficiency. We give a proof of semantic security under the decisional bilinear Diffie-Hellman assumption for this new scheme.

Boneh, Ding, Tsudik and Wong recently proposed a way for obtaining fast revocation of RSA keys. Their method consists in using security mediators that keep a piece of each user's private key in such a way that every decrytion or signature operation requires the help of the mediator for the user. Revocation is achieved by instructing the mediator to stop helping the user to sign or decrypt messages. This security architecture, called SEM, gave rise to an identity based mediated RSA scheme (IB-mRSA) that combines the advantages of fast revocation and identity based public keys. We show that, in opposition to what was stated in [9], this revocation method can be applied to several existing public key encryption and signature schemes (all those for which a secure practical threshold adaptation exists) including the Boneh-Franklin identity based encryption scheme and a pairing based digital signature schemes. We first describe a threshold adaptation of the Boneh-Franklin identity based encryption scheme and, then, we compare the mediated versions of these schemes with IB-mRSA from security and efficiency points of view.

During the last few years, a number of authenticated group key agreement protocols have been proposed in the literature. We observed that the efforts in this domain were mostly dedicated to the improvement of their performance in term of bandwidth or

In its basic version, linear cryptanalysis is a known-plaintext attack that uses a linear relation between input-bits, output-bits, and key-bits of an encryption algorithm that holds with a certain probability. If enough plaintext-ciphertext pairs are provided, this approximation can be used to assign probabilities to the possible keys and to locate the most probable one. Matsui (1993) applied it to DES, becoming the best known attack against DES. Knudsen (2000) proposed three chosen-plaintext linear attacks, the third one becoming the best chosen-plaintext attack. This paper presents two original FPGA implementations of a DES encryption/decryption core that work at data rates up to 21.3 Gbps (333 MHz). We believe that our implementations are the fastest ones known nowadays. In our design, the plaintext, the key, and the mode (encryption/decryption) can be changed with no dead cycles. Based on one of our fast DES implementations, we present an FPGA implementation of the known-plaintext linear cryptanalysis of DES. The resulting design is deployed on eight FPGAs and allows us to find 12+1 key bits in about 2.3 hours. As a comparison, the fastest software implementation known so far (in 2000) used the idle time of 18 Intel Pentium III MMX and broke a DES key in 4.32 days. Our fast linear cryptanalysis implementation made the performing of practical tests possible, allowing a comparison with Matsui's theoretical estimations.

Group Diffie-Hellman protocols for Authenticated Key Exchange (AKE) are designed to provide a pool of players with a shared secret key which may later be used, for example, to achieve multicast message integrity. Over the years, several schemes have been offered. However, no formal treatment for this cryptographic problem has ever been suggested. In this paper, we present a security model for this problem and use it to precisely define AKE (with "implicit" authentication) as the fundamental goal, and the entity-authentication goal as well. We then define in this model the execution of an authenticated group Diffie-Hellman scheme and prove its security.

Secure group protocols are not easy to design: this paper will show new attacks found against a protocol suite for sharing key. The method we propose to analyse these protocols is very systematic, and can be applied to numerous protocols of this type. The A-GDH.2 protocols suite analysed throughout this paper is part of the Cliques suites that propose extensions of the Diffie-Hellman key exchange protocol to a group setting. The A-GDH.2 main protocol is intended to allow a group to share an authenticated key while the other protocols of the suite allow to perform dynamic changes in the group constitution (adding and deleting members, fusion of groups,...). We are proposing an original method to analyse these protocols and are presenting a number of unpublished flaws with respect to each of the main security properties claimed in protocol definition (key authentication, perfect forward secrecy, resistance to known-keys attacks). Most of these flaws arise from the fact that using a group setting does not allow to reason about security properties in the same way as when only two (or three) parties are concerned. Our method has been easily applied on other Cliques protocols and allowed us to pinpoint similar flaws. 1.

Article On the importance of securing your bins: the garbage-man-in-the-middle attack Share on Authors: Marc Joye UCL Crypto Group, Dép. de Math., Université de Louvain, Belgium UCL Crypto Group, Dép. de Math., Université de Louvain, BelgiumView Profile , Jean-Jacques Quisquater UCL Crypto Group, Dép. d'Électricité, Université de Louvain, Belgium UCL Crypto Group, Dép. d'Électricité, Université de Louvain, BelgiumView Profile Authors Info & Claims CCS '97: Proceedings of the 4th ACM conference on Computer and communications securityApril 1997 Pages 135–141https://doi.org/10.1145/266420.266449Online:01 April 1997Publication History 7citation635DownloadsMetricsTotal Citations7Total Downloads635Last 12 Months11Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

This paper presents an interesting application of the Tillich–Zémor function TZ . In particular, we emphasize the concatenation property of this one-way hash function. i.e., TZ ( S | T ) = TZ ( S ) TZ ( T ) where S and T are two binary strings. This

Digital TV broadcasting needs new cryptological tools for conditional access, copyright protection and image authentication. The aim of this paper is to overview the corresponding systems' features. The description of a conditional access system is given. It is shown that equitable systems need the use of a trusted third party. The design of efficient copyright protection by watermarking images and image authentication by signatures are also briefly discussed.>