Search

The mechanism for traditional searchable symmetric encryption (SSE) is pay-then-use. This situation is not fair to user because the cloud server may return wrong results. Besides, the user needs to verify these results locally. In order to ensure fairness and reduce user’s calculations, we combined blockchain with SSE, and proposed a fair SSE scheme based on blockchain. Our scheme can guarantee fairness for both parties. That is, if the user is not honest, he cannot get right results from the server, and at the same time the server cannot get any information related to the plaintexts during this search process. If the server is not honest, except for the service charge, it will be punished automatically. Moreover, the user in our scheme does not need to verify the results locally. The security and performance analyses showed our scheme was semantic secure and feasible.

Digital currency regulation is a hot topic. Traditional privacy-enhanced digital currency system, like the CryptoNote, seeks to protect the privacy of senders and receivers. This paper presents a digital currency system based on the group signature scheme of Boneh et al. The system can protect users’ privacy and enable regulations. The system uses the one-time address technology of the CryptoNote to achieve unlinkability. It uses the group signature and an “OR” proof of the equality of two discrete logarithms to achieve untraceability. The group manager in a group signature can open a problematic transaction, restore the real identity of the sender, and revoke the private key of the sender if needed, which makes the digital currency regulatable.

Digital currency regulation is a hot topic. Traditional privacy-enhanced digital currency system, like the CryptoNote, seeks to protect the privacy of senders and receivers. This paper presents a digital currency system based on the group signature scheme of Boneh et al. The system can protect users’ privacy and enable regulations. The system uses the one-time address technology of the CryptoNote to achieve unlinkability. It uses the group signature in a ring style to achieve untraceability. The group manager in a group signature can open a problematic transaction, restore the real identity of the sender, and revoke the private key of the sender if needed, which makes the digital currency regulatable.

Currently, the technique choices of issuing digital fiat currencies include RSCoin, Corda and Quorum etc. RSCoin is specially designed for central banks based on Bitcoin. Corda and Quorum are permissioned distributed ledger techniques based on Bitcoin and Ethereum, respectively. There lacks a framework specially for central banks based on Ethereum. We here introduce AFCoin: a framework based on the account model and smart contract of Ethereum. AFCoin shows a possible way to issue and manage fiat currencies by central banks. It can be deployed in an evolutionary way and enjoys good efficiency, regulation and privacy properties.

The developments of cryptocurrencies push central banks of many countries to consider their own digital fiat currencies. As banks are usually taken as a trusted third party, it is unnecessary to rebuild a blockchain system to rebuild trust. However, cryptocurrencies provide many interesting features except the basic financial functions. It is naturally to absorb the interesting parts of cryptocurrencies to the centralized bank system. We here extract a stateful authentication mechanism from the practice of Ethereum and show how to run puzzle and payment channel templates in a centralized system, based on which we may build a fiat currency lighting network to support direct exchanges of users.

Medical data are important in diagnosis, treatment, recovery, and medical accident investigation. The integrity and availability of medical data are the basic guarantee for the smooth operation of these activities. The privacy of medical data is a natural demand from the sensitivity of medical data. At present, there are mainly two ways to protect the privacy of medical data. One way is to store medical data in a local database and set up an access control strategy of the database. The other way is to encrypt medical data with the patient's key and to share the key when needed. The problem with the first method is that the data in the local database may be modified or deleted. The problem with the second method is that the key cannot be shared when the patient dies during the diagnosis and treatment. These two problems will damage the availability of data. This paper proposes to establish a shared key that could be reconstructed by the legitimate parties before the process of diagnosis and treatment begins. The data in the diagnosis and treatment process is encrypted and stored in a blockchain using the shared key. The proposal meets the integrity, availability and privacy requirements of medical data. It uses the sibling intractable function families (SIFF) to establish a shared key, and uses the Hyperledger Fabric to store encrypted data. The simulation shows that the system has good efficiency. Additionally, it is the first time to introduce SIFF to a blockchain application.

Bitcoin is the most popular decentralized digital currency now in use. Block chain is the basic technology of Bitcoin, providing a trustable ledger that can be publicly verified. Research on distributed applications based on block chain has become a new trend. We propose an electronic voting scheme based on block chain and prime numbers, which can support voting situations for multiple candidates. We design protocols for the Bitcoin voting situation, in which there are n voters and k candidates. Each voter will vote for one candidate. The proposed protocols could guarantee that the candidate who gets the majority voting wins the game and no individual voting information is disclosed. Due to the nature of the block chain, the voting results could not be tampered. It is transparent since the block chain is open to the public for verification.

Recently, Zhao and Chan proposed a Bitcoin voting protocol where n voters could fund Bitcoins to one of two candidates determined by majority voting. Their protocol preserves the privacy of individual ballot while they cast ballots by Bitcoin transactions. However, their protocol supports only two candidates and relies on a threshold signature scheme. We extend their method to produce a ballot by a voter selecting at least \(k_{min}\), at most \(k_{max}\) from L candidates. We also redesign a vote casting protocol without threshold signatures to reduce transaction numbers and protocol complexities. We also introduce new polices to make the Bitcoin Voting protocol more fair.

We envision a scenario where contract signers put their portable document format (PDF) contract into a blockchain application that outputs a signed contract, while blockchain nodes don’t know the contract content, contract signers’ identities and contract signatures. Comparing to current centralized online contract signing services, blockchain applications could avoid single point of failure, internal attacks and data loss. More importantly, the application also provides fairness and privacy properties. By fairness, we mean that contract signers obtain a signed contract simultaneously, or obtain nothing, or some signer obtains a singed contract at the cost of paying contract coins. By privacy, we mean that contract contents, signatures, and signers’ identities are hidden from blockchain nodes. At last, we support RSA signatures whose verification is embedded in most PDF readers, which makes the whole solution practical.

The notion of chameleon hash function without key exposure plays an important role in designing secure chameleon signatures. However, all of the existing key-exposure free chameleon hash schemes are presented in the setting of certificate-based systems. In 2004, Ateniese and de Medeiros questioned whether there is an efficient construction for identity-based chameleon hashing without key exposure. In this paper, we propose the first identity-based chameleon hash scheme without key exposure based on the three-trapdoor mechanism, which provides an affirmative answer to the open problem. Moreover, we use the proposed chameleon hash scheme to design an identity-based chameleon signature scheme, which achieves all the desired security properties.

A non-delegatable strong designated verifier signature (NSDVS) enforces verification of a signature by a designated verifier only. The concept is useful in various commercial cryptographic applications such as copyright protection, e-voting, and e-libraries. This paper reports the shortest NSDVS so far that consists of only two elements. The scheme is inspired by an identification scheme and Cramer et al.'s OR-proof technique where a prover can prove that he knows at least one out two secrets. It is solidified by a symmetric key based group to group encryption algorithm. Two implementations of the algorithm are reported. The scheme is provably secure with respect to its properties of unforgeability, non-transferability, privacy of signer's identity, and non-delegatability.

Non-delegatability is an interesting property of designated verifier signatures (DVS) as it technically makes a signer responsible for the signer’s actions and protects the privacy of the signer. This property is critical for some financial scenarios when a user is required to do something by itself. As more financial applications are running in a mobile and ubiquitous computing environment, an efficient scheme with a non-delegatability property is desirable. This paper proposes such a scheme in an identity-based setting with detailed proofs. Technically, the scheme combines an identity-based Schnorr style signature and an identification method with an OR proof technique gluing the two parts. It is the second scheme secure in a strict model proposed by Huang et al. And it saves about half the communication and computation costs of the first one.

Deniability and forward secrecy are two properties of authenticated key exchange (AKE) protocols. Considering one-round AKE, Cremers and Feltz at ESORICS 2012 defined a security model with perfect forward secrecy. Based on their model, we consider different levels of deniability, and reveal some relationships of the session-key security and the deniability properties. The observations result in a simple method to give a deniable protocol with forward secrecy.

Strong designated verifier signature (SDVS) provides secret authentication service to entities in a computing task. The primitive assures that an entity's signature is verified only by a designated service provider. It also assures that a transcript about a computing task can be produced by both the entity and its service provider independently. Then neither can prove to a third party that an entity is involved in a task. Currently, most SDVS schemes without random oracles have no strong unforgeability and privacy of signer's identity. This paper proposes a systematic method to design SDVS schemes without random oracles. It provides a basic scheme with unforgeability and non-transferability properties. Then provides it an SDVS scheme with strong unforgeability and privacy of signer's identity properties and based on standard assumptions. Finally, a more efficient SDVS scheme is shown based on a non-black box assumption.

This study shows how to use signature schemes for deniable authentication. Deniable authentication means that a message receiver R, although receiving a message m from a sender S, cannot convince a third party that the sender S has sent R the message m. If signature schemes are secure against selective forgery, the authors can construct a full deniable authentication protocol. The protocol is presented in the extension framework of Raimondo et al. as a deniable message transmission authenticator.

A group key agreement protocol allows a set of users to establish a common symmetric key via open networks. Dynamic asymmetric group key agreement means that a dynamic set of users form a temporary group and negotiate to share a public encryption key, so that anyone can send message securely and efficiently to the temporary group. Users can join or leave the group efficiently without triggering a completely new key agreement protocol, which will greatly benefit the users in ad hoc networks. We describe a generic construction of dynamic asymmetric group key agreement by combining a conventional authenticated group key agreement, a public key encryption and a multi-signature. Then we give out an instance with constant rounds of interactions and constant transmission cost for each participant.

It is considered to be the most suitable solution for large scale elections to design an electronic voting scheme using blind signatures and anonymous channels. Based on this framework, Okamoto first proposed a receipt-free voting scheme [30] for large scale elections. However, in the following paper, Okamoto [31] proved that the scheme [30] was not receipt-free and presented two improved schemes. One scheme requires the help of the parameter registration committee and the other needs a stronger physical assumption of the voting booth. In this paper, we utilize the double-trapdoor commitment to propose a new receipt-free voting scheme based on blind signatures for large scale elections. Neither the parameter registration committee nor the voting booth is required in our scheme. We also present a more efficient zero-knowledge proof for secret permutation. Therefore, our scheme is much more efficient than Okamoto's schemes [30,31] with the weaker physical assumptions. Moreover, we prove that our scheme can achieve the desired security properties.

This paper presents a deniable authenticated key agreement protocol. This protocol can provide an authenticated session key while the sender and the receiver can deny their involvement in such a protocol if the protocol is executed successfully. Then both can deny their transmitted messages protected by the authenticated session key. If this protocol fails, no authenticated session key can be established and no protected messages can be transmitted. The protocol can be proved secure against key compromise impersonation attack. The protocol employs a new method to isolate a session key from confirmation keys.

This paper studies a hybrid system of the public key infrastructure (PKI) and the identity based cryptosystem (IBC). In the hybrid system, an organization runs a private key generator (PKG) and requests a certificate authority to vouch the binding of the PKG's parameters and the organization's distinguished name. Then an authentication scenario is considered where a member of an organization is authenticated by an application server. The whole design pays attention to scalability and adopts caches and password-based protocols for a scalable service and an easy deployment.

A certificateless strong designated verifier signature (CL-SDVS) may provide more convenient deployment than other SDVS schemes since user's public keys can be published freely and no key-escrow problem needed to be worried about. However, there are only several CL-SDVS schemes and their security is doubtable. This paper provides general CL-SDVS schemes and instances, and discusses their security briefly.

Considering one-round AKE, Cremers and Feltz at ESORICS 2012 defined a security model with perfect forward secrecy (PFS). However, in that model Boyd and and Nieto's general attack about PFS is unworkable. This paper extends their model to capture the general attack and shows that a compiled one-round AKE protocol does not achieve the PFS in the extended model. It suggests to withstand the general attack by extra assumptions.

The deniably information-hiding encryption (DIHE) is a type of deniable encryption which can hide an additional information in encrypting a normal message. Even if the sender or the receiver is coerced to show the plaintext and the random coins in the encryption, a DIHE scheme behaves like only an innocent message is encrypted. Because it protects privacy against malicious coercer, the DIHE scheme is very useful in communication systems such as the cloud storage system when the communication channel is eavesdropped by a coercer. Previous DIHE schemes only concern the security under the adversary's chosen plaintext attack (CPA). This paper proposes the first DIHE construction with deniability and indistinguishability against adaptive chosen cipher text attack (CCA) which is stronger than the CPA attack. Our construction is simple and easy to implement. Furthermore, it achieves simultaneous sender and receiver deniability with negligible detection advantage.

We propose a scheme for non-delegatable strong designated verifier signature. The scheme is based on pairings, and utilizes an OR proof technique and a method of ensuring the integrity of a signature. In a standard model, the unforgeability property of the scheme is reducible to a computational Co-Diffie-Hellman problem. The scheme is perfect non-transferable, and its properties of privacy of signer's identity and non-delegatability are reducible to the correctness of two variants of a knowledge of exponent assumption.

This paper gives a security model for non-interactive deniable authentication (NIDA) protocols. This model captures a session-state-reveal attack and a key-compromise-impersonation attack. We analyze some NIDA protocols in the model, and we find that no one is satisfactory. We give a new paradigm to construct an NIDA protocol, which is provably secure in the model.

A strong multiple designated verifiers signature (SMDVS) enables a signer to convince a set of verifiers by generating one signature, of which the verification needs the private key of a verifier. After a brief survey of the current SMDVS schemes, we find no schemes suitable to the broadcast propagation, where the simulation needs only one verifier's private key. Motivated by this discovery, we propose a broadcast SMDVS scheme. The new scheme is proven secure in the random oracle model.

Chameleon signatures simultaneously provide the properties of non-repudiation and non-transferability for the signed message. However, the initial constructions of chameleon signatures suffer from the key exposure problem of chameleon hashing. This creates a strong disincentive for the recipient to forge signatures, partially undermining the concept of non-transferability. Recently, some specific constructions of key-exposure free chameleon hashing based on various assumptions are presented. In this paper, we present some security flaws of the key-exposure free chameleon hash scheme based on factoring [10]. Besides, we propose an improved chameleon hash scheme without key exposure based on factoring which enjoys all the desired security notions of chameleon hashing.

The notion of chameleon hash function without key exposure plays an important role in designing chameleon signatures. However, all of the existing key-exposure free chameleon hash schemes are presented in the setting of certificate-based systems. In 2004, Ateniese and de Medeiros questioned whether there is an efficient construction for identity-based chameleon hashing without key exposure. In this paper, we propose the first identity-based chameleon hash scheme without key exposure based on the three-trapdoor mechanism, which provides an affirmative answer to the open problem.

We introduce the novel notion of Verifiable Encryption of Chameleon Signatures (VECS), and then use it to design a three-round abuse-free optimistic contract signing protocol.

We present an attack to current interface copy protection systems and a new framework to restrict contents flowing within legal devices. The attack is named as interface replacement attack, which is motivated by the fact that a damaged interface usually can be replaced with a small cost. The new framework deploys security mechanisms in both interior part of a consumer electronic device and interfaces on it. We name it as deep copy protection framework to distinguish the current interface-centric copy protection frameworks. We believe that this viewpoint is novel and can be further studied to develop new copy protection system.

A third party-based data storage audit service is a developing branch where a user may use its mobile devices with limited energy to trigger a third party to audit the user's data in a cloud service provider. A basic tool for a third party to check the integrity of a user's data is the designated verifier signature DVS, which allows a designated verifier to simulate a signer's signatures. However, the cloud computing is a technique that may be used a long time in the future, the development of quantum computation shows threats to basic building blocks of cloud computing services. It is then desirable to design DVS schemes potentially secure against quantum attacks. We here give a lattice-based DVS scheme to satisfy the requirement. It is based on Lyubashevsky's signature scheme in EUROCRYPT 2012 and has a shorter signature size.

A Strong Multiple Designated Verifiers Signature (SMDVS) enables a signer to convince a set of verifiers by generating one signature, of which the verification needs the private key of a verifier. After a brief survey of the current SMDVS schemes and attacks, we found that there were reported or applicable attacks on many schemes, and some schemes needed group communications in the signature verification algorithm. We propose a new SMDVS scheme which is secure against current attacks and needs no extra group communications in the verification algorithm. The scheme is proven secure in the random oracle model.

In this paper, we first introduce the notion of identity-based trapdoor mercurial commitment which enjoys the advantages of both the identity-based trapdoor commitment and trapdoor mercurial commitment, while using the idea of “Customized Identity”. Inherently, an identity-based trapdoor mercurial commitment is an underlying building block for constructing identity-based (non-interactive) zero-knowledge sets. That is, a prover can commit to a set S in a way that reveals nothing about S and prove to a verifier, in zero-knowledge, statements of the form x ∈ S and x ∉ S . Besides, although the (non-interactive) proof is publicly verifiable, it is also bound to the identity of the prover in a way which is recognizable to any verifier.