Traditional machine learning algorithms face challenges in assessing flood susceptibility reliably due to their low robustness and the inherent 'black-box' nature. This paper utilizes five hyperparameter optimization algoirthms (HPO), namely grid search (GS), random search (RS), gauss process (GP), tree-structured parzen estimator (TPE) and simulated annealing (SA), to tune the traditional random forest’s (RF) hyperparameters to improve the robustness of flood hazard mapping (FHM) models at Ningxiang City Hunan Province, China. Additionally, SHapley Additive exPlanations (SHAP) method were used to interpret the decision-mechanisms of these flood hazard models. This study considers 19 pluvial flood influencing factors and 2064 flood locations to create a geospatial database. The performance of each hybrid model was evaluated by area under the receiver operating characteristic (ROC) curve (AUC) and several validation methods. The results demonstrate that the developed hybrid models demonstrated good performance, with RF-TPE achieving the highest AUC (0.9660), followed by RF-GP (0.9648), RF-SA (0.9624), RF-GS (0.9612), RF-RS (0.9600), and RF (0.9539). The RF-TPE model exhibits superior robustness than other models, and the FHM constructed using it is more reliable. HPO is an effective approach to improve the predictive accuracy and robustness of FHM models. When considering limited computational resources, Bayesian optimization (TPE) should be prioritized for optimizing FHM models, followed by metaheuristic algorithms and model-free algorithms. Moreover, the study revealed that distance from river, peak rainfall intensity , continuous rainfall, antecedent effective rainfall, and terrain relief, are the most significant for pluvial FHM modeling in this region.

Summary Attribute‐based encryption (ABE) has been regarded as a promising solution in cloud computing services to enable scalable access control without compromising the security. Despite of the advantages, efficient user revocation has been a challenge in ABE. One suggestion for user revocation is using the binary tree in the key generation phase of an ABE scheme, which enables a trusted key generation center to periodically distribute the key update information to all nonrevoked users over a public channel. This revocation approach reduces the size of key updates from linear to logarithmic in the number of users. But it requires each user to keep a private key of the logarithmic size, and asks each nonrevoked user to periodically update his/her decryption key for each new time period. To further optimize user revocation in ABE, a server‐aided revocable ABE (SR‐ABE) scheme has been proposed, in which almost all workloads of users incurred by the user revocation are outsourced to an untrusted server, and each user only needs to store a private key of the constant size. In addition, SR‐ABE does not require any secure channel for the key transmission, and a user only needs to perform a small amount of calculations to decrypt a ciphertext. In this paper, we revisit the notion of SR‐ABE, and present a generic construction of SR‐ABE, which can transform a revocable ABE (RABE) scheme to an SR‐ABE scheme. In addition, we give an instantiation of SR‐ABE by applying the generic construction on a concrete RABE scheme, and implement an instantiation of SR‐ABE and an RABE scheme to evaluate the performance of SR‐ABE.

Double-authentication-preventing signature (DAPS) is a novel signature notion proposed at ESORICS 2014. The double-authentication-preventing property means that any pair of signatures on two different messages with the same subject will result in an immediate collapse of the signature system. A few potential applications of DAPS have been discussed by its inventors, such as providing a kind of self-enforcement to discourage certificate authority (CA) from misbehaving in public key infrastructure and offering CA some cryptographic arguments to resist legal coercion. In this study, we focus on some fundamental issues on DAPS. We propose a new definition, which is slightly weakened but still reasonable and strong enough to capture the DAPS concept. We develop the new notion of invertible chameleon hash functions with key exposure. Then we propose a generic DAPS scheme, which is provably secure if the underlying invertible chameleon hash function with key exposure is secure. We instantiate this general construction to obtain the DAPS schemes respectively based on the well-known assumptions of integer factorization, Rivest-Shamir-Adleman (RSA), and computational Diffie-Hellman (CDH). They are more efficient than previous DAPS schemes. Furthermore, unlike previous constructions, the trusted setup condition is not needed by our DAPS schemes based on RSA and CDH.

In this paper, we introduce an attribute-based framework to achieve secure communications in vehicular ad hoc networks (VANETs), which enjoys several advantageous features. The proposed framework employs attribute-based signature (ABS) to achieve message authentication and integrity and protect vehicle privacy, which greatly mitigates the overhead caused by pseudonym/private key change or update in the existing solutions for VANETs based on symmetric key, asymmetric key, and identity-based cryptography and group signature. In addition, we extend a standard ABS scheme with traceability and revocation mechanisms and seamlessly integrate them into the proposed framework to support vehicle traceability and revocation by a trusted authority, and thus, the resulting scheme for vehicular communications does not suffer from the anonymity misuse issue, which has been a challenge for anonymous credential-based vehicular protocols. Finally, we implement the proposed ABS scheme using a rapid prototyping tool called Charm to evaluate its performance.

Searchable encryption allows a cloud server to conduct keyword search over encrypted data on behalf of the data users without learning the underlying plaintexts. However, most existing searchable encryption schemes only support single or conjunctive keyword search, while a few other schemes that are able to perform expressive keyword search are computationally inefficient since they are built from bilinear pairings over the composite-order groups. In this paper, we propose an expressive public-key searchable encryption scheme in the prime-order groups, which allows keyword search policies (i.e., predicates, access structures) to be expressed in conjunctive, disjunctive or any monotonic Boolean formulas and achieves significant performance improvement over existing schemes. We formally define its security, and prove that it is selectively secure in the standard model. Also, we implement the proposed scheme using a rapid prototyping tool called Charm [37], and conduct several experiments to evaluate it performance. The results demonstrate that our scheme is much more efficient than the ones built over the composite-order groups.

PAKE protocols, for Password-Authenticated Key Exchange, enable two parties to establish a shared cryptographically strong key over an insecure network using a short common secret as authentication means. After the seminal work by Bellovin and Merritt, with the famous EKE, for Encrypted Key Exchange, various settings and security notions have been defined, and many protocols have been proposed.

Authenticated key exchange (AKE) protocol allows a user and a server to authenticate each other and generate a session key for the subsequent communications. With the rapid development of low-power and highly-efficient networks, such as pervasive and mobile computing network in recent years, many efficient AKE protocols have been proposed to achieve user privacy and authentication in the communications. Besides secure session key establishment, those AKE protocols offer some other useful functionalities, such as two-factor user authentication and mutual authentication. However, most of them have one or more weaknesses, such as vulnerability against lost-smart-card attack, offline dictionary attack, de-synchronization attack, or the lack of forward secrecy, and user anonymity or untraceability. Furthermore, an AKE scheme under the public key infrastructure may not be suitable for light-weight computational devices, and the security model of AKE does not capture user anonymity and resist lost-smart-card attack. In this paper, we propose a novel dynamic ID-based anonymous two-factor AKE protocol, which addresses all the above issues. Our protocol also supports smart card revocation and password update without centralized storage. Further, we extend the security model of AKE to support user anonymity and resist lost-smart-card attack, and the proposed scheme is provably secure in extended security model. The low-computational and bandwidth cost indicates that our protocol can be deployed for pervasive computing applications and mobile communications in practice.

Provable security is an important research area in modern cryptography. Cryptographic primitives or protocols without rigorous proofs cannot be regarded as secure even in practice. In fact, many schemes were originally thought as secure but were broken subsequently. This clearly indicates the necessity of formal security analysis. For real-world applications, provable security provides us with a strong confidence in using cryptographic solutions. For a theoretical study, provable security sometimes provides a clear answer to the (in)feasibility issue of a certain security mechanism. This special issue offers a platform for security researchers and practitioners to exchange their new ideas for studying information systems in provably secure manners. We have included eighteen high-quality papers. Among them, six papers were selected from accepted papers at the 6th International Conference on Provable Security (ProvSec 2012), and the remaining 12 papers were selected from new invited submissions. All of them have gone through stringent reviews in two rounds. Further, any selected paper that has a preliminary version at ProvSec 2012 or somewhere else must have been extensively expanded to include new contributions. The included articles highlight recent advances in provable security by presenting many novel techniques in this area. We now give a short summary of them, through six categories. The first category is public-key encryption (PKE). It considers the formal models, constructions, and analysis of PKE under various security concerns. In the leakage-resiliency model, one considers the security of PKE when a partial secret key has been leaked (e.g., through a side-channel attack). Paper “continual key-leakage tolerant encryption from extensible-set delegation functionality” by Bo Yang and Mingwu Zhang proposes a leakage-resilient functional encryption and shows that its provable security under a continual leakage of the secret key. Motivated by the threat from malware such as RAM scrapers, the paper “stronger public key encryption system withstanding RAM scraper like attacks” by S. Sree Vivek, S. Sharmila Deva Selvi, Akshayaram Srinivasan and C. Pandu Rangan proposes a public-key security notion that is stronger than adaptive chosen-ciphertext (CCA2) security. They show that the traditionally CCA2 secure schemes are no longer secure in the new model. They also propose a new scheme that is provably secure in the new model without a random oracle. The paper “a limitation on security evaluation of cryptographic primitives with fixed keys” by Yutaka Kawai, Goichiro Hanaoka, Kazuo Ohta, and Noboru Kunihiro studies the security of public-key system when the public key is fixed. They have obtained some impossibility results for this setting. A key encapsulation mechanism is an efficient tool to construct a public-key encryption through a paradigm of a hybrid encryption. The paper “efficient key encapsulation mechanisms with tight security reductions to standard assumptions in the two security models” by Yoshikazu Hanatani, Goichiro Hanaoka, Takahiro Matsuda, and Takashi Yamakawa presents two constructions of efficient key encapsulation mechanisms. Their schemes can be proven CCA secure under a strong hardness assumption without random oracle or under a weaker assumption in the random oracle model. A hash proof system is a general cryptographic structure proposed by Cramer-Shoup in Eurotypt 2002 to construct public-key systems. The paper “generalized (identity-based) hash proof system and its applications” by Yu Chen, Zongyang Zhang, Dongdai Lin, and Zhenfu Cao generalizes this concept to admit an anonymity property. They use this generalized structure to propose public-key encryptions with leakage resilience and anonymity. They further study it in the identity-based setting. The second category is searchable encryption. It considers the public key or the symmetric key cryptosystems that allow keywords search over encrypted data. Usually, the search encryption requires a complete match on the keyword during the search. The paper “character-based symmetric searchable encryption and its implementation on mobile devices” by Takanori Suga, Takashi Nishide, and Kouichi Sakurai proposes a scheme that admits a partial keyword match for the search, and their scheme uses a symmetric encryption. They also have implemented the solution over a mobile device. The paper “searchable symmetric encryption capable of searching for an arbitrary string” by Yoshinao Uchide and Noboru Kunihiro further studies the partial keyword match problem and proposes a searchable encryption that admits a search query of an arbitrary string. Their main technique is an oblivious cross tag protocol by Cash et al. at CRYPTO 2013. The third category is a re-encryption. This considers to re-encrypt a ciphertext without using a decryption key. This is to reuse the ciphertext for a certain security or privacy purpose. The paper “strongly average-case secure obfuscation: achieving input privacy and circuit obscurity” by Mingwu Zhang, Yi Mu, Yixin Su, and Xinyi Huang studies the obfuscation for a re-encryption program with strong security such that an attacker, when executing an obfuscated re-encryption program, cannot obtain any information about the private key and the plaintext. Here, an obfuscation is an algorithm that converts a program into another with the same functionality while difficult to understand. An attribute-based encryption is a public-key cryptosystem that classifies a user using attributes such that a user can decrypt a ciphertext if and only if his attribute collection satisfies the desired requirement in the ciphertext. This achieves the access control functionality for the encryption. Attribute-based proxy re-encryption (PRE) is a useful technique for a delegation of access rights to encrypted data, which is useful in a public cloud storage. The paper “verifiable attribute-based proxy re-encryption for secure public cloud data sharing” by Suqing Lin, Rui Zhang, and Mingsheng Wang proposes a generic construction for attribute-based PRE and presents three realizations for it. The paper “on the application of generic CCA-secure transformations to proxy re-encryption” by David Nuñez, Isaac Agudo, and Javier Lopez studies the generic transformation for PRE from weak security to CCA security. For a regular public-key encryption, it is well known that a Fujisaki–Okamoto technique can transform a chosen-plaintext secure scheme into a CCA2 secure scheme. But the authors found out that this does not work for PRE. Instead, they achieve a weak form of CCA security for PRE using a generalized Fujisaki–Okamoto. The paper “proxy re-encryption via indistinguishability obfuscation” by Satsuya Ohata and Kanta Matsuura presents a technique for achieving PRE from obfuscation. Their idea is to carefully modify the public-key encryption scheme of Sahai and Waters at STOC 2014. The fourth category is a digital signature. This studies the models, constructions, and their analysis under various security concerns. A nominative signature is a signature that is generated by a signer A and a user B jointly. When the signature is to be verified by a user C, C will run a disavowal/confirmation protocol with B. The paper “one-move convertible nominative signature in the standard model” by Dennis Y. W. Liu and Duncan S. Wong proposes an efficient nominative signature that is provably secure in the standard model with a constant size of key for any party in the system. A ring signature is a signature, where a signer remains fully anonymous among a group of members (called a ring). The paper “non-interactive deniable ring signature without random oracles” by Shengke Zeng and Qinyi Li considers a variant of a ring signature, where the signer anonymity is conditional in the sense that a signer can confirm the authorship of the signature while a non-signer can disprove the authorship of a signature. They propose a new scheme for this model using the Boneh and Boyen signature and shows its security in the standard model. A blind signature is a special signature that allows one to obtain a signature on a message from a signature without leaking the message to the latter. This primitive has many applications in systems such as e-cash and e-voting schemes. The paper “a lattice based partially blind signature” by Haibo Tian, Fangguo Zhang, and Baodian Wei proposes the first latticed-based blind signature with partial blindness using the technique of Lyubashevsky from EUROCRYPT 2012 and the technique of Abe and Okamoto from CRYPTO 2000. The paper “generic transformations for existentially unforgeable signature schemes in the bounded leakage model” by Yuyu Wang and Keisuke Tanaka studies how to obtain strongly secure digital signatures. They propose two transformations that convert a regular weakly secure signature into a strongly secure signature in the bounded leakage model. The fifth category is a key exchange. A key exchange is a procedure that allows two or more parties to share a secret key securely. The paper “authenticated key exchange with entities from different settings and varied groups” by Yanfei Guo and Zhenfeng Zhang proposes several key exchange protocols with an initiator being identity based and the responder being certificate based. They consider the constructions with an identity-based system from a bilinear group and a prime residue group both. The last category is the symmetric key cryptography. It studies the cryptographic structure that does not use any public-key tool. A lightweight cryptographic primitive is such an example. It only incurs a very small computation cost. A lightweight primitive with provable security has a very important impact in the real world. The paper “two new message authentication codes based on APN functions and stream ciphers” by Teng Wu and Guang Gong proposes two lightweight message authentication codes and quantifies the insecurity upper bounds against a substitution attack. The paper “two-level security for message streams” by Mohsen Alimomeni and Reihaneh Safavi-Naini studies the information theoretic security of a private key encryption. They formalize a new model to quantify the security of many ciphertexts, where they require the message in the most recent ciphertext to be perfectly secure while messages in older ciphertexts have a lower level of security. They propose a non-trivial construction with provable security under their model. We would like to thank editor-in-chiefs Prof. Hsiao-Hwa Chen and Prof. Hamid R. Sharif for agreeing to this special issue and supporting us throughout the process. We also would like to thank all authors who submitted their papers to this special issue and reviewers who spent their precious time on the submissions and provided us with their insights that help us in an essential way to make the decisions.

Certificateless public key encryption (CLE) and certificate-based encryption (CBE) are motivated to simultaneously solve the heavy certificate management problem inherent in the traditional public key encryption (PKE) and the key escrow problem inherent in the identity-based encryption (IBE). Al-Riyami and Paterson proposed a general conversion from CLE to CBE, which is neat and natural. Kang and Park pointed out a flaw in their security proof. Wu et al. proposed another generic conversion from CLE to CBE which additionally involves collision resistant hash functions. It remains an open problem whether the generic conversion due to Al-Riyami and Paterson is provably secure or not. We are motivated to solve this open problem. Our basic idea is to enhance Type II adversary's power a little by allowing it to conditionally replace a user's public key. We first formalize a new security model of CLE in this way. Then, we succeed in proving that the Al-Riyami–Paterson generic conversion from CLE to CBE is secure, if the CLE scheme is secure in our new security model. Finally, a concrete provably secure CBE scheme is presented to demonstrate the applicability of our result.

SUMMARY In 2009, Wu and Lin introduced the concept of self‐certified proxy convertible authenticated encryption (SP‐CAE) by integrating self‐certified public‐key system and designated verifier proxy signature with message recovery. They also presented the first SP‐CAE scheme which is based the discrete logarithm problem. However, Wu‐Lin scheme is not secure as Xie et al. recently showed that this scheme is existentially forgeable under adaptive chosen warrants, unconfidentiable and verifiable under adaptive chosen messages and designated verifiers. In this paper, we first discuss the security requirements of SP‐CAE and then formally define unforgeability, message confidentiality, and unverifiability. Consequently, the first complete formal model of SP‐CAE is proposed. After that, we propose a provably secure SP‐CAE scheme by using two‐party Schnorr signature introduced by Nicolosi et al. in 2003. Finally, we prove the formal security of the proposed scheme in the random oracle model under the discrete logarithm assumption. Copyright © 2013 John Wiley & Sons, Ltd.

ABSTRACT Recently, Chen et al. proposed a practical authentication protocol for supporting anonymous roaming in wireless access networks, then the protocol is further improved by Hsieh and Leu. In this paper, we demonstrate the adversarial model of this type of protocols and show that Hsieh‐Leu scheme is not as secure as they originally claimed to be. In particular, we show that their protocol does not provide user privacy protection, and it is vulnerable to off‐line password guessing attack mounted by a side channel adversary who has compromised all the information stored in the user's smart card. To fix these weaknesses, a new practical authentication protocol with anonymity for wireless roaming is proposed. We use the formal verification tool ProVerif, which is based on applied pi calculus, to prove the security of the proposed scheme. The experimental results confirm that the new scheme not only achieves many desirable properties, such as strong anonymity, perfect forward secrecy and support of session key update, but also provides robustness against all those attacks that Hsieh–Leu protocol does not resist. Copyright © 2013 John Wiley & Sons, Ltd.

Optimistic fair exchange (OFE) is a type of cryptographic protocols aimed at solving the fair exchange problem over open networks with the help of a third party to settle disputes between exchanging parties. It is well known that a third party is necessary in the realization of a fair exchange protocol. However, a fully trusted third party may not be available over open networks. In this paper, the security of most of the proposed OFE protocols depends on the assumption that the third party is semitrusted in the sense that it may misbehave on its own but does not conspire with either of the main parties. The existing security models of OFE have not taken into account the case where the potentially dishonest third party may collude with a signer in the sense of sharing its secret key with the signer. In this paper, to reduce the trust level of the arbitrator and increase the security of OFE, we propose an enhanced security model that, for the first time, captures this scenario. We also show a separation between the existing model and our enhanced model with a concrete counter example. Finally, we revisit two popular approaches in the construction of OFE protocols, which are based on verifiably encrypted signature and conventional signature plus ring signature, respectively. Our result shows that the conventional signature plus ring signature approach approach remains valid in our enhanced model. However, for schemes based on verifiably encrypted signature, slight modifications are needed to guarantee the security.

Remote authentication has been widely studied and adapted in distributed systems. The security of remote authentication mechanisms mostly relies on one of or the combination of three factors: 1) something users know—password; 2) something users have—smart card; and 3) something users are—biometric characteristics. This paper introduces an efficient generic framework for three-factor authentication. The proposed generic framework enhances the security of existing two-factor authentication schemes by upgrading them to three-factor authentication schemes, without exposing user privacy. In addition, we present a case study by upgrading a secure two-factor authentication scheme to a secure three-factor authentication scheme. Furthermore, implementation analysis, formal proof, and privacy discussion are provided to show that the derived scheme is practical, secure, and privacy preserving.

Single sign-on (SSO) is a new authentication mechanism that enables a legal user with a single credential to be authenticated by multiple service providers in a distributed computer network. Recently, Chang and Lee proposed a new SSO scheme and claimed its security by providing well-organized security arguments. In this paper, however, we demonstrative that their scheme is actually insecure as it fails to meet credential privacy and soundness of authentication. Specifically, we present two impersonation attacks. The first attack allows a malicious service provider, who has successfully communicated with a legal user twice, to recover the user's credential and then to impersonate the user to access resources and services offered by other service providers. In another attack, an outsider without any credential may be able to enjoy network services freely by impersonating any legal user or a nonexistent user. We identify the flaws in their security arguments to explain why attacks are possible against their SSO scheme. Our attacks also apply to another SSO scheme proposed by Hsu and Chuang, which inspired the design of the Chang–Lee scheme. Moreover, by employing an efficient verifiable encryption of RSA signatures proposed by Ateniese, we propose an improvement for repairing the Chang–Lee scheme. We promote the formal study of the soundness of authentication as one open problem.

Nowadays, data collection and processing becomes ubiquitous in social and business areas, especially in Internet of Things. However, sensitive information leakage is a critical issue. To solve problem, privacy-preserving techniques are strongly needed. Jiang {\em et al.} proposed a protocol of finding frequent item in accountable computing (AC) framework which enables two parties to conduct collaborative computation on their transactional databases to find out the common frequent items without disclosing their private data to the other party. Their scheme was proposed in a secure two-party computation model against malicious adversaries. In this paper, we analyze the implementation details of AC-framework and identify some security weaknesses in their scheme. Furthermore, we clarify the security requirements for the AC-framework and present an augmented solution to enhance security.

Distributed systems and networks have been adopted by telecommunications, remote educations, businesses, armies and governments. A widely applied technique for distributed systems and networks is the single sign-on (SSO) which enables a user to use a unitary secure credential (or token) to access multiple computers and systems where he/she has access permissions. However, most existing SSO schemes have not been formally proved to satisfy credential privacy and soundness of credential based authentication. To overcome this drawback, we formalise the security model of single sign-on scheme with authenticated key exchange. Specially, we point out the difference between soundness and credential privacy, and define them together in one definition. Also, we propose a provably secure single sign-on authentication scheme, which satisfies soundness, preserves credential privacy, meets user anonymity, and supports session key exchange. The proposed scheme is very efficient so that it suits for mobile devices in distributed systems and networks.

Certificateless cryptography shares many features of identity-based cryptography and partially solves the problem of key escrow. Three certificateless signature schemes without random oracles were found in the literature. However, all the schemes suffer from some common drawbacks. First, by obtaining a signature on a message and replacing the public key of a signer, an adversary can forge valid signatures on the same message under the replaced public key. Secondly, all the schemes require a relatively large size of public parameters. The authors propose a new certificateless signature scheme, which exhibits an improvement on the existing schemes. Compared with the previous schemes, the proposed scheme offers stronger security, shorter system parameters and higher computational efficiency.

As an important cryptographic primitive, designated confirmer signatures are introduced to control the public verifiability of signatures. That is, only the signer or a semi-trusted party, called designated confirmer, can interactively assist a verifier to check the validity of a designated confirmer signature. The central security property of a designated confirmer signature scheme is called invisibility, which requires that even an adaptive adversary cannot determine the validity of an alleged signature without direct cooperation from either the signer or the designated confirmer. However, in the literature researchers have proposed two other related properties, called impersonation and transcript simulatability, though the relations between them are not clear. In this paper, we first explore the relations among these three invisibility related concepts and conclude that invisibility, impersonation and transcript simulatability forms an increasing stronger order. After that, we turn to study the invisibility of two designated confirmer signature schemes recently presented by Zhang et al. and Wei et al. By demonstrating concrete and effective attacks, we show that both of those two scheme fail to meet invisibility, the central security property of designated confirmer signatures.

Proxy blind signature is an important cryptographic primitive and plays an essential role in construction of the electronic cash (e-cash). Recently, Tan (2001, An offline electronic cash scheme based on proxy blind signature. Comput. J., 54, 505–512) proposed a new proxy blind signature scheme and applied it to electronic cash. The scheme was claimed as being provably secure under the Discrete Log assumption, DBDH assumption and Chosen–Target CDH assumption in the random oracle model. In this paper, we show that Tan's proxy blind signature scheme is insecure by demonstrating several attacks in which a malicious original signer can forge both valid proxy signature keys of arbitrary proxy signers and a proxy blind signature on an arbitrary message with respect to any proxy signer directly. We also discuss some weaknesses in the e-cash scheme proposed by Tan.

Vehicular ad hoc networks (VANETs) allow wireless communications between vehicles without the aid of a central server. Reliable exchanges of information about road and traffic conditions allow a safer and more comfortable travelling environment. However, such profusion of information may allow unscrupulous parties to violate user privacy. On the other hand, a degree of auditability is desired for law enforcement and maintenance purposes. In this paper we propose a Threshold Anonymous Announcement service using direct anonymous attestation and one-time anonymous authentication to simultaneously achieve the seemingly contradictory goals of reliability, privacy and auditability.

Protecting cryptographic keys in hardware devices is challenging. In this work, we reinvestigate a family of key protection schemes proposed by Fung, Golin and Gray (2001), which use permutations to protect keys stored in Electrically Erasable Programmable Read-Only Memory (EEPROM). Our analysis discovers vulnerabilities in the use of mathematical permutations. Specifically, we successfully identify two practical attacks-batch card attack and relative probing attack-which allow an adversary to discover the secret key stored in the EEPROM. Contrary to the claims of Fung et al., these attacks are realizable with a relatively small number of probes. Moreover, we examine the rationale of their security assumptions, which are mainly based on the modification attack described by Anderson and Kuhn (1997), and conclude that recent advances in hardware security (w.r.t. both attacks and countermeasures) suggest a stronger adversary model on designing such secure devices.

A fair contract-signing protocol allows two potentially mistrusted parities to exchange their commitments (i.e., digital signatures) to an agreed contract over the Internet in afairway, so that either each of them obtains the other's signature, or neither party does. Based on the RSA signature scheme, a new digital contract-signing protocol is proposed in this paper. Like the existing RSA-based solutions for the same problem, our protocol is not only fair, but also optimistic, since the trusted third party is involved only in the situations where one party is cheating or the communication channel is interrupted. Furthermore, the proposed protocol satisfies a new property-abuse-freeness. That is, if the protocol is executed unsuccessfully, none of the two parties can show the validity of intermediate results to others. Technical details are provided to analyze the security and performance of the proposed protocol. In summary, we present the first abuse-free fair contract-signing protocol based on the RSA signature, and show that it is both secure and efficient.

Abstract It is very challenging on designing cryptographically strong security functions that can be incorporated into low‐cost radio frequency identification (RFID) tags. Some RFID authentication protocols were proposed using only ultra‐lightweight primitives, while the security of them must be scrutinized before being put forth into any real application. In this paper, we present two effective attacks, namelyde‐synchronization attackandfull‐disclosure attack, against an efficient ultra‐lightweight RFID mutual authentication protocol: LMAP 2 , which is recently proposed by Peris‐Lopezet al. These active attacks are so serious as they cannot only disable the authentication capability of an RFID tag by destroying synchronization between the tag and the RFID reader, but also disclose all secret values stored in the tag. We point out the design flaws of the protocol and based on that, we improve the protocol with a stateful variant (SLMAP). The improved protocol is more secure in sense of tag anonymity, man‐in‐the‐middle (MITM) resistance, and forgery prevention as shown in our analysis, and is more compact due to reduced operations and memory usage on implementing such a tag. Copyright © 2008 John Wiley & Sons, Ltd.

A non-repudiation protocol enables the fair exchange of an electronic message and an irrefutable digital receipt between two mistrusting parties over the Internet. That is, at the end of any execution instance of such a protocol, either both parties obtain their expected items or neither party does . In this paper, we first argue that it is really meaningful in practice to exploit generic fair non-repudiation protocols with transparent off-line trusted third party (TTP). Namely, in those protocols, each involved party could use any secure digital signature algorithm to produce non-repudiation evidences; and the issued evidences are the same regardless of whether the TTP is involved or not. Then, we present such a fair non-repudiation protocol to overcome some limitations and shortcomings in previous schemes. Technical discussions are provided to show that our protocol is not only secure but also the most efficient solution, compared with existing non-repudiation protocols. In addition, some potential extensions are also pointed out.

Most of previous research work in key management can only resist passive attacks, such as dropping the certificate request, and are vulnerable under active attacks, such as returning a fake reply to the node requesting the certification service. In this paper, we propose two algorithms to address both security and efficiency issues of certification services in ad hoc networks. Both of the algorithms can resist active attacks. In addition, simulation results show that, compared to the previous works, our second algorithm is not only much faster in a friendly environment, but it also works well in a hostile environment in which existing schemes work poorly. Furthermore, the process of generating partial certificates in our second algorithm is extremely fast. Such advantage is critical in ad hoc networks where by nature the less help a node requests from its neighbors, the higher is the chance of obtaining the help. Consequently, using our second algorithm, a node can easily find enough neighboring nodes which provide the certification service.

As security enhanced systems for standard e-mail, certified e-mail schemes guarantee the fair exchange of a digital message with the corresponding receipt between two mistrusted parties. That is, the intended receiver gets the e-mail content if and only if the e-mail sender obtains an irrefutable receipt issued by the receiver, which could be used to prove that the message has been delivered to the receiver. A number of such protocols have been proposed in recent years. However, most of them are not suitable for mobile networks, since many intricate cryptographic primitives are involved so that considerable overheads are introduced. In this paper, we present a novel simple protocol for certified e-mail delivery. Technical discussions are provided to show that our new solution is both secure and very efficient so that it is truly suitable for wireless mobile users, where the available devices usually have limited resources on computation, communication, storage, and power supply.

A fair contract signing protocol allows two potentially mistrusted parities to exchange their commitments (i.e., digital signatures) to an agreed contract over the Internet in a fair way, so that either each of them obtains the other's signature, or neither party does. Based on the RSA signature scheme, a new digital contract signing protocol is proposed in this paper. Like the existing RSA-based solutions for the same problem, our protocol is not only fair, but also optimistic, since the third trusted party is involved only in the situations where one party is cheating or the communication channel is interrupted. Furthermore, the proposed protocol satisfies a new property, i.e., it is abuse-free. That is, if the protocol is executed unsuccessfully, none of the two parties can show the validity of intermediate results to others. Technical details are provided to analyze the security and performance of the proposed protocol. In summary, we present the first abuse-free fair contract signing protocol based on the RSA signature, and show that it is both secure and efficient.

In a designated-verifier proxy signature scheme, a user delegates her/his signing capability to another user in such a way that the latter can sign messages on behalf of the former, but the validity of generated signatures can only be checked by the designated verifier. In this paper, we first point out one such scheme proposed recently by Dai et al. is insecure. To overcome the weaknesses in their scheme, based on the two-party Schnorr signature by Nicolosi et al., we present a new designated-verifier proxy signature scheme which is efficient and secure. Finally, we suggest to use our scheme in electronic commerce applications, such as sale of digital products (digital music, movies, and books etc.).

In a (t, n) threshold proxy signature scheme, the original signer can delegate his/her signing capability to n proxy signers such that any t or more proxy signers can sign messages on behalf of the former, but t-1 or less of them cannot do the same thing. Such schemes have been suggested for use in a number of applications, particularly, in distributed computing where delegation of rights is quite common. Based on the RSA cryptosystem, [M. -S. Hwang et al. (2003) recently proposed an efficient (t, n) threshold proxy signature scheme. We identify several security weaknesses in their scheme and show that their scheme is insecure.