Search

To provide the security of digital data, many applications are using cryptographic algorithms that attackers are infeasible to break since the algorithms are based on hard mathematical problems. However, any single cryptographic algorithm has a limited lifespan due to the limited operational life cycle or increasing computational power of attackers. For many types of digital data, such as identity information, health records, history archives, etc, the security of data needs to be maintained for decades or even permanently, which is much longer than the lifetime of a single cryptographic algorithm. In this PhD thesis, we aim to study the solution for the long-term security of two specific applications: time-stamping services and blockchains, so that their security is not restricted by the lifetime of the underlying cryptographic algorithms. Overall, this thesis is comprised of five papers. The first three papers focus on the long-term security of traditional centralized time-stamping services. In specific, our first work reviews the ISO/IEC standard and discovers several issues that may lead to the failure of designed properties, and we provide a solution to each issue. Since the literature, the ISO/IEC, and ANSI standards only consider the solution of a long-term time-stamping scheme is to renew server-side algorithms, our second work explores a comprehensive long-term time-stamping scheme that addresses the renewal of both client-side hash functions and server-side algorithms. Then we notice that the ISO/IEC and ANSI standards totally specify five types of server-side algorithms, but only the long-term time-stamping schemes based on signatures and hash functions are formally defined and analyzed in the literature. Thus, we fill this gap by formally and analyze the other three types of long-term time-stamping schemes based on MACs, archives, and transient keys respectively as our third paper. The next two papers study the long-term security topic of a blockchain. Based on two existing designs of a long-term secure blockchain scheme, we found that these schemes are not formally analyzed and could be vulnerable to attacks. As one step further, we provide the first security model and construction of a long-term blockchain scheme. Finally, motivated by the decentralized concepts of blockchains, we propose the first long-term timestamping scheme based on a blockchain, which eliminates the trust assumption of a time-stamping authority.

A Trusted Platform Module (TPM), is a tamper-resistant hardware device that serves as a trust anchor for the host platform that it is embedded in. To do this, the TPM chip creates attestations about the state of the host system. These attestations convince a remote verifier that the platform it is communicating with is running on trusted hardware and using the correct software. Direct Anonymous Attestation (DAA) is an anonymous digital signature scheme that allows the TPM attestation service to hold the privacy-preserving property. That is, the verifier can check that those attestations originate from a certified TPM, but it does not learn the identity of the particular TPM. Another important feature of DAA is that it supports user-controlled linkability which is obtained by using a basename (bsn). If a platform uses a fresh or empty basename, the resulting attestations cannot be linked whereas using the same basename makes the corresponding transactions linkable. Currently standardised Direct Anonymous Attestation (DAA) schemes have their security based on the factoring and the discrete logarithm problems and are therefore insecure against quantum attackers as a result of Shor’s quantum algorithm. Thus, it is important to find alternatives for the currently used DAA signature schemes. Lattice-based cryptography is considered as a powerful candidate receiving lots of attention not only due to its conjectured quantum-attack resistance but also due to its security guarantee to provide worst-case hardness of average-case instances. This thesis contributes to a smooth transition of the current Direct Anonymous Attestation (DAA) and Enhanced Privacy ID (EPID) schemes, which can be seen as DAA with different linkability requirements, into the world of lattice-based cryptographic schemes. We also provide a novel solution for an outstanding authentication problem in the DAA join protocol. Our contributions are classified into three main parts. The first contribution of this work is constructing two quantum-safe lattice-based Direct Anonymous Attestation protocols from lattice assumptions. Compared to the only other lattice-based DAA scheme with conjectured post-quantum security available in the related art, the first proposed lattice-based DAA (LDAA) the protocol ensures that the storage requirements of the Trusted Platform Module (TPM) are reduced twofold and the signature sizes five times. Moreover, experimental results show that the signing and verification operations are accelerated 1.1 and 2.0 times, respectively. To achieve more efficiency, we constructed a compact quantum-safe lattice-based Direct Anonymous Attestation protocol whose signature size is around 2MB, which is (at least) two orders of magnitude smaller compared to existing post-quantum DAA schemes. The security of both proposed lattice-based DAA schemes is proved in the Universal Composability (UC) model under the assumed hardness of the Ring-Short Integer Solution (Ring-SIS) and the Ring-Learning With Errors (Ring-LWE) problems. This work is a contribution to the European H2020 FutureTPM project and the final result of this work may lead to a post-quantum DAA scheme that is suitable for inclusion in a future quantum-resistant TPM. The second contribution of this work is a new Lattice-based EPID (LEPID) protocol. Inspired by our work on lattice-based DAA schemes, we present the first Enhanced Privacy ID (EPID) scheme, supported on lattice primitives, that may benefit from future research developments in post-quantum cryptography. We also give a new security model for the EPID in the Universal Composability (UC) framework. The proposed LEPID scheme is proved secure under the new model. The third contribution deals with the DAA join protocol when the TPM uses two different keys for the purpose of user privacy. An Endorsement Key (EK) which is used to identify the TPM and an Attestation Key (AK) used for TPM attestation services. Using two different keys result with a problem of how to bind these two keys together. This is a crucial property in scenarios in which an issuer needs reliable information about AK-EK pairs before certifying the AK in the join interface of a DAA protocol. Thus we introduced a new security property of “key binding” in the process of issuing TPM Attestation Key (AK) certificates. Our analysis also showed that the DAA schemes that are supported by the TPM chips (either the TPM 1.2 version or TPM 2.0 version) can suffer from man-in-the-middle attacks from a malicious TPM and/or a malicious host, or cannot be implemented by following the TPM specifications. Finally, we present a novel solution for such an authentication problem with a rigorous security proof and implement this solution by using the existing TPM 2.0 commands with a real TPM 2.0 chip.

Mobile apps feed on variety of users' information to provide great services. Some of the features require more sensitive details such as contact list to connect with friends or a precise location to find a desired restaurant nearby. Handling per- sonal information is vital because the user would expect them to be processed in an appropriate manner. However, research has proven that some third-party apps accidentally or maliciously leak users' personal details. Thus, researchers made huge effort to come up with tools that detect leakage attempts. In this thesis, we targeted several gaps to improve user experience with mobile privacy leakage prob- lem. Initially, we designed a system that evaluates mobile privacy protection tools. This system can be useful for developers to assess their tools, and users to evaluate offered solutions. 165 selected Android privacy protection apps have been tested using our system, and it was established that the most effective approach of mobile privacy protection requires modification on mobile operating system level in order to capture explicit and implicit leakages. That requirement makes it difficult to find "off-the-shelve" protection tool. Therefore, it was decided to assist the user in selecting safe apps as a precaution step before problems occur. To achieve that, it is important to understand how mobile users form their decision when selecting apps. 1,100 crowdsourcing participants have been recruited to study their perceived trust of subjective and objective ratings of mobile apps' privacy. This experiment guided us to design new interfaces that could assist decision making towards more privacy-friendly mobile apps, which was our most recent work. A newly designed interface, which communicates objective privacy ratings to the user, has been pro- posed. We have also conducted several user-studies involving 300 participants to evaluate our proposed app's efficiency, the result ultimately showed that users were more motivated to engage in privacy-related decisions.