Search

Public Key Cryptosystem (PKC) completely relies under the assumption that user’s private key is absolutely secure. Exposure of private key may lead to disastrous situations in the communication network. To diminish the damage of private key exposure in PKC, key-insulation mechanism was introduced. In key-insulated cryptosystems, a user can update his private key with the help of a physically secure device from time to time. Identity-based cryptosystem alleviates the heavy certificate management problems in traditional PKC. Recently, many Identity-based key insulated signature schemes have been proposed in literature; however, most of the Identity-based schemes are designed based on the expensive bilinear pairing operation over elliptic curves. Due to the heavy computational cost of a pairing, the pairing based schemes are less efficient in practice. In order to improve the computational and communicational efficiency and to resist the problem of private key exposure in Identity-based signature schemes, we present a pairing-free key insulated signature scheme in identity based setting. We show that this scheme is unforgeable and achieves strong key insulation property with secure key updates, under the hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP). The performance analysis shows that our scheme is more efficient than the existing schemes.

Attribute-based encryption (ABE) provides a promising solution for enabling scalable access control over encrypted data stored in the untrusted servers (e.g., cloud) due to its ability to perform data encryption and decryption defined over descriptive attributes . In order to bind different components which correspond to different attributes in a user’s attribute-based decryption key together, key randomization technique has been applied in most existing ABE schemes. This randomization method , however, also empowers a user the capability of regenerating a newly randomized decryption key over a subset of the attributes associated with the original decryption key. Because key randomization breaks the linkage between this newly generated key and the original key, a malicious user could leak the new decryption key to others without taking any responsibility for the key abuse. To solve this problem, we think of key regeneration-free ABE to disallow a user from randomizing his/her decryption key in any manner, i.e., a user can only delegate his/her decryption key in exactly the same form without any modification so that any abused or pirated key can be traced back to its original owner. Motivated by strongly unforgeable signature, we first define a security notion called strong key unforgeability, and show that ABE schemes equipped with the strong key unforgeability are immune to key regeneration. We then provide a generic transformation to convert ciphertext-policy ABE (CP-ABE) schemes of certain type to key regeneration-free CP-ABE schemes, and show how the transformation works by presenting two concrete constructions.

This paper proposes a solution for low-cost consumer IoT devices to employ end-to-end security without requiring additional hardware. Manufacturers of consumer IoT devices often sacrifice security in favour of features, user-friendliness, time to market or cost, in order to stay ahead of their competitors. However, this is unwise, as demonstrated by recent hacks on consumer IoT devices. Low-cost embedded devices struggle to create suitable entropy for key generation; on the other hand, smartphones are both abundant and have multiple sources of entropy for strong key generation. The proposed architecture takes advantage of these properties and offloads key generation and transfer to the user's smartphone, removing the need for constrained IoT devices to perform public key infrastructure and generate symmetric keys. The authors implemented the design on a \$1 general-purpose microcontroller and then analysed the performance. The design allows all communication to and from the device to be encrypted while being simple to setup, low-cost and responsive without any additional manufacturing cost. The architecture presents a general solution, which could be implemented on any microcontroller. Since the architecture does not require any additional hardware, it can be retroactively applied to deployed devices through a firmware update.

As content is transmitted in content-driven manner in the content-centric network (CCN), it does not require any host address; therefore, it is infeasible to establish a traditional secure channel between hosts. Securing the content transmission in the CCN is a challenging problem. We solve this problem with the content-based encryption, where the encryption key is associated with the content itself, and the private decryption keys are distributed to the authorized consumers. To deal with the security requirements for content-based encryption, we define a security model that captures the key existential unforgeability and semantic security. We then propose a content-based encryption scheme with short ciphertexts, which is proven to be strong key existentially unforgeable and semantically secure in the standard model. We apply the scheme to construct a secure content transmission protocol in the CCN, which captures the security properties of content confidentiality, integrity, resistance to replay attacks and resistance to key forgery attacks. The performance analysis shows that our protocol is efficient for large content transmission.

Cryptography is a mechanism used for protection of valuable information from unacceptable users in the networking world. It’s a challenging task to protect such assets from illegal users. This necessitated for the development of Cryptographic techniques to provide security as large volumes of digital data traveling through the shared media. These techniques range from traditional security systems to crypto image techniques. This brings forward to focus on cryptographic techniques that have strong algorithm and strong key. The strength of any crypto algorithm depends on the strongness of the crypto key used. Therefore, both the algorithm technique and key generation methodology are equally important. This motivated to propose and concentrate on a novel scheme that includes crypto key generation and crypto key protection where the protected key and its methodology cannot be traced by an ineligible user.

To provide privacy protection in the cloud, cloud storage auditing with improved strong key-exposure resilient (CSA-ISKER) was proposed to solve key exposure problems during cloud auditing services. In this paper, Cloud Storage Integrity checking and Auditing- ISKER (CSIA-ISKER) is proposed to further enhance the performance of CSA-ISKER. The integrity of their outsourced files is remaining as the major concern for cloud users. Other variables such as cloud service providers do not have full confidence, and the storage information can be compromised due to their management failures on a cloud server, adversary attacks, or failure. Hence data integrity has become a primary concern in CSIA-ISKER. In CSIA-ISKER, the private key generator is introduced to generate keys for users by using the user’s identity information. It reduces the key exposure problem. Also, CSIA-identity-based privacy and traceability-ISKER (CSIA-IPT-ISKER) is proposed to preserve the privacy of user identity and ensures the traceability of user identity.

Secured storage system is a critical component in cloud computing. Cloud clients use cloud auditing schemes to verify the integrity of data stored in the cloud. But with the exposure of the auditing secret key to the Cloud Service Provider, cloud auditing becomes unsuccessful, however strong the auditing schemes may be. Therefore, it is essential to prevent the exposure of auditing secret keys, and even if it happens, it is necessary to minimize the damage caused. The existing cloud auditing schemes that are strongly resilient to key exposure are based on Public Key Infrastructure and so have challenges of certificate management/verification. These schemes also incur high computation time during integrity verification of the data blocks. The Identity-based schemes eliminate the usage of certificates but limit the damage due to key exposure, only in time periods earlier to the time period of the exposed key. Some of the key exposure resilient schemes do not provide support for batch auditing. In this paper, an Identity-based Provable Data Possession scheme is proposed. It protects the security of Identity-based cloud storage auditing in time periods both earlier and later to the time period of the exposed key. It also provides support for batch auditing. Analysis shows that the proposed scheme is resistant to the replace attack of the Cloud Service Provider, preserves the data privacy against the Third Party Auditor, and can efficiently verify the correctness of data.

Key exposure is one serious security problem for cloud storage auditing. In order to deal with this problem, cloud storage auditing scheme with key-exposure resilience has been proposed. However, in such a scheme, the malicious cloud might still forge valid authenticators later than the key-exposure time period if it obtains the current secret key of data owner. In this paper, we innovatively propose a paradigm named strong key-exposure resilient auditing for secure cloud storage, in which the security of cloud storage auditing not only earlier than but also later than the key exposure can be preserved. We formalize the definition and the security model of this new kind of cloud storage auditing and design a concrete scheme. In our proposed scheme, the key exposure in one time period doesn’t affect the security of cloud storage auditing in other time periods. The rigorous security proof and the experimental results demonstrate that our proposed scheme achieves desirable security and efficiency.

The PMIPv6 is vulnerable to various security threats such as the DoS or redirect attacks. In this paper, we analyzed the Kang–Park & ESS-FH scheme, and proposed an Enhanced Security scheme for FPMIPv6 (ESS-FP). Based on the CGA method and the public key Cryptography, ESS-FP provides a strong key exchange and key independence in addition to improving the weaknesses of FPMIPv6. The proposed scheme was formally verified based on Ban-logic, and its handover latency was analyzed and compared with that of the Kang–Park scheme & ESS-FH. In addition, we proposed an inter-domain fast handover scheme for PMIPv6 using the proxy-based FPMIPv6.

Key insulated mechanism mitigates the potential damages caused by secret signing key exposure in public key signature schemes. To minimize the impact of secret key exposure in group-oriented applications, in this paper, we propose a novel Pairing-free Identity-based Key-insulated Multi Signature (PF-IDKIMS) scheme. The strong key insulated security of our PF-IDKIMS primitive is reduced to the classical elliptic curve discrete logarithm problem in random oracle model. To the best of our knowledge, the proposed scheme is the first multi signature scheme without pairings in identity based framework dealing with key exposure problems by employing key insulation mechanism.

Security and privacy of patients’ information remains a major issue of concern among health practitioners. Therefore, measures must be put in place to ensure that unauthorized individual do not have access to this information. However, the adoption of digital alternative of retrieving and documenting medical information has further opened it up to more attacks. This article presents a modified blowfish algorithm for securing textual and graphical medical information. The F-function used in generating round sub-keys was strengthened so as to produce a strong key that could resist differential attacks. Number of Pixel Change Rate (NPCR) and Unified Average Changing Intensity (UACI) of 98.85% and 33.65% revealed that the modified algorithm is sensitive to changes in its key and also resistive to differential attacks. Furthermore, the modified algorithm demonstrated a better encryption and decryption time than the existing blowfish algorithm.

Hierarchical access control is for scenarios where some users have access to more organization data than others. In this paper, we propose an efficient key assignment scheme for dynamic hierarchies that features constant decryption cost and does not require any expensive operations like bilinear pairing. The proposed hierarchical key assignment scheme is secure against strong key distinguishability attacks. It also supports dynamic updates like addition and deletion of classes in the hierarchy with efficient procedures for preserving forward and backward secrecy. Another important highlight of the proposed scheme is that secret keys of none of the users have to be updated to preserve forward and backward secrecy in case of dynamic updates. Proposed is the first dynamic hierarchical key assignment scheme whose key derivation procedure has constant computation cost and is pairing-free with strong key indistinguishability.

Cryptography is one of the important and useful technique in which usually a particular file is converted into unreadable format by using public key and private key system called as public key cryptosystem. Then as per the user requirement that file is send to another user for secure data or file transmission between original sender and receiver. In this transmission file of unreadable format is send, after receiving this file receiver used the similar algorithm technique and private key for getting the original file data. In this procedure various algorithms are used as a processing function and depending on that algorithm, used the private key. The power or strength of any algorithm is depending on the secret key used in sender client and receiver side client. For this type of secure transmission we traditionally used RSA algorithm which is more secure for use so most of the system used the same type of algorithm for secure way of communication. Even most of the financial transaction is done by the use of this algorithm as it used the strong key while encryption and decryption. But In today‟s new digital world there is a numerous growth in the use of the Internet service. Behind every software generator there is lots of hacker present. So, very little amount of time will be enough to explore the security. Hence we require more strong and complex algorithms, which provide the security the Internet work of transmitting and receiving. So this proposed system enhanced the security of existing RSA algorithm by using elliptical curve cryptography (ECC) algorithm. This system secures the important data of the administrator and safely sends to the registered user by text encryption and image encryption. Also proposed system provide good authentication for the user.

Exposure of secret keys may be the most devastating attack on a public key cryptographic scheme since such that security is entirely lost. The key-insulated security provides a promising approach to deal with this threat since it can effectively mitigate the damage caused by the secret key exposure. To eliminate the cumbersome certificate management in traditional PKI-supported key-insulated signature while overcoming the key escrow problem in identity-based key-insulated signature, two certificateless key-insulated signature schemes without random oracles have been proposed so far. However, both of them suffer from some security drawbacks and do not achieve existential unforgeability. In this paper, we propose a new certificateless strong key-insulated signature scheme that is proven secure in the standard model. Compared with the previous certificateless strong proxy signature scheme, the proposed scheme offers stronger security and enjoys higher computational efficiency and shorter public parameters.

Password-based authenticated key agreement enables several parties to establish a shared cryptographically strong key over an insecure network using short low entropy passwords. This authenticated key agreement is definitely the most interesting in practice, since no additional device is required, but just a human-memorable password, for authenticating the players. Recently, Zhou et al. showed an efficient provably secure two-party pass-word-based authenticated key agreement (PAKA) protocol. In this paper, we propose an efficient two-party PAKA protocol and show a formal security proof. Our construction is more efficient than Zhou et al.’s.

International audience; PAKE protocols, for Password-Authenticated Key Exchange, enable two parties to establish a shared cryptographically strong key over an insecure network using a short common secret as authentication means. After the seminal work by Bellovin and Merritt, with the famous EKE, for Encrypted Key Exchange, various settings and security notions have been defined, and many protocols have been proposed.In this paper, we revisit the promising SPEKE, for Simple Password Exponential Key Exchange, proposed by Jablon. The only known security analysis works in the random oracle model under the CDH assumption, but in the multiplicative groups of finite fields only (subgroups of Z∗p), which means the use of large elements and so huge communications and computations. Our new instantiation (TBPEKE, for Two-Basis Password Exponential Key Exchange) applies to any group, and our security analysis requires a DLin-like assumption to hold. In particular, one can use elliptic curves, which leads to a better efficiency, at both the communication and computation levels. We additionally consider server corruptions, which immediately leak all the passwords to the adversary with symmetric PAKE. We thus study an asymmetric variant, also known as VPAKE, for Verifier-based Password Authenticated Key Exchange. We then propose a verifier-based variant of TBPEKE, the so-called VTBPEKE, which is also quite efficient, and resistant to server-compromise.

This letter presents a new color image encryption scheme based on the coupled chaos maps. First, the algorithm uses the coupled logistic map to generate random strong key stream, and then designed a kind of initial simple diffusion-joint scrambling-combined diffusion method from the point of the relationships of components R, G, B. The simulation results indicate that this algorithm has stronger security compared with the independent encryption of each color component.

The remote health monitoring system enables a doctor to diagnose and monitor health problems anywhere for a patient. However, since the patient health information is very sensitive and the Internet is unsecure and prone to many attacks, data can be easily compromised by adversaries. Worse, the mobile phone is also easy to be compromised. Clearly, these issues have brought different privacy and security requirements in wireless healthcare. To address these challenging issues, in this paper, we propose an efficient privacy-preserving authentication scheme with adaptive key evolution, which can prevent illegal access to the patient’s vital signs. Furthermore, we model the leakage process of the key information to set proper key renewal interval, which can adaptively control the key evolution to balance the trade-off between the communication efficiency and security level. The security analysis demonstrates that our scheme can achieve authenticated key agreement, perfect and strong key insulation, privacy preservation, and other important security goals, e.g. authenticity, integrity and freshness of transmitted messages. The performance evaluation shows that our scheme is computationally efficient for the typical mobile phone with limited resources, and it has low communication overhead.

The cloud offers increased efficiencies and cost savings, and the US Federal Government has taken notice. A massive migration to commercial cloud services is underway, and it's no mean feat. It necessitates the creation and implementation of a migration strategy that moves selected new and legacy functions to cloud technology without disruption - and with maximum security.In the US, FedRAMP was created to make the cost-saving cloud migration for federal agencies both safe and hopefully stress-free. But IT admins must make a commitment to strong key management and effective monitoring of their encrypted networks in order to build on FedRAMP's foundation, says Matthew McKenna of SSH Communication Security.

A hierarchical key assignment scheme distribute some private information and encryption keys to a set of classes in a partially ordered hierarchy, so that the private information of higher classes can be employed to derive the keys of classes lower down in the hierarchy. A hierarchical key assignment scheme for dynamic structures allows to make dynamic updates to the hierarchy, such as addition, deletion and modification of classes and relations among them, as well as the revocation of users. In this work we analyze security notions for hierarchical key assignment schemes supporting dynamic structures. In particular, we first propose the notion of key recovery for those schemes. Furthermore, we extend to such schemes the strong key indistinguishability and strong key recovery security definitions proposed by Freire et al. for hierarchical key assignment schemes. Finally, we investigate the relations occurring between all the state-of-the-art security notions for hierarchical key assignment schemes supporting dynamic structures, showing implications and separations which hold between such notions. In detail, we prove that also in the case of dynamic structures, security with respect to strong key indistinguishability is equivalent to the one with respect to key indistinguishability.

A hierarchical key assignment scheme is a method to assign some private information and encryption keys to a set of classes in a partially ordered hierarchy, in such a way that the private information of a higher class can be used to derive the keys of all classes lower down in the hierarchy. In this paper we analyze the security of hierarchical key assignment schemes according to different notions: security with respect to key indistinguishability and against key recovery , as well as the two recently proposed notions of security with respect to strong key indistinguishability and against strong key recovery . We first explore the relations between all security notions and, in particular, we prove that security with respect to strong key indistinguishability is not stronger than the one with respect to key indistinguishability. Afterwards, we propose a general construction yielding a hierarchical key assignment scheme offering security against strong key recovery, given any hierarchical key assignment scheme which guarantees security against key recovery.

Biometric cryptosystems and cancelable biometrics are both practical and promising schemes to enhance the security and privacy of biometric systems. Though a number of bio-crypto algorithms have been proposed, they have limited practical applicability because they lack of cancelability. Since biometrics are immutable, the users whose biometrics are stolen cannot use bio-crypto systems anymore. Cancelable biometric schemes are of cancelability; however, they are difficult to compromise the conflicts between the security and performance. By embedded a novel cancelable palmprint template, namely ''two dimensional (2D) Palmprint Phasor'', the proposed palmprint cryptosystem overcomes the lack of cancelability in existing biometric cryptosystems. Besides, the authentication performance is enhanced when users have different tokens/keys. Furthermore, we develop a novel dual-key-binding cancelable palmprint cryptosystem to enhance the security and privacy of palmprint biometric. 2D Palmprint Phasor template is scrambled by the scrambling transformation based on the chaotic sequence that is generated by both the user's token/key and strong key extracted from palmprint. Dual-key-binding scrambling not only has more robustness to resist against chosen plain text attack, but also enhances the secure requirement of non-invertibility. 2D Palmprint Phasor algorithm and dual-key-binding scrambling both increase the difficulty of adversary's statistical analysis. The experimental results and security analysis confirm the efficiency of the proposed scheme.

It is important to ensure the private key secure in cryptosystem. To reduce the underlying danger caused by the private key leakage, Dodis et al. (2003) introduced the notion of key-insulated security. To handle the private key leakage problems in certificateless signature schemes, we propose a new certificateless strong key-insulated signature scheme. Our scheme has two desirable properties. First, its security can be proved without utilizing the random oracle model. Second, it solves the key escrow problems in identity-based key-insulated signatures (IBKISs).

One of the most essential services of cloud computing is cloud storage. For cloud storage auditing, key exposure is a serious security problem which is solved by updating client secret keys regularly. However, this leads to local burdens to clients. A cloud source auditing with verifiable outsourcing of key updates paradigm was used to make the key updates as transparent for the client where Third Party Auditor (TPA) was played the role of authorized party. It holds only an encrypted version of client’s secret key. However, key exposure security problem is not fully solved by this scheme. So in this paper, improved strong key exposure resilient auditing is introduced to solve the key exposure security problem and improve the security of cloud storage. In the proposed paradigm, a novel key update technique is used where update message is created by TPA and it sends to the client. The client updates their signing secret key based on the update message and client’s private key. Moreover, public key is obtained from the client while updating a message which improves the security of cloud storage. Thus this scheme makes the malicious cloud unable to get the signing secret key in unexposed time periods.

This paper investigates the security model for authenticated key exchange protocols. We further enhance the enhanced Canetti-Krawczyk (eCK) model by introducing a notion called strong key compromise impersonation (SKCI) resilience which is first identified in this paper. SKCI resilience guarantees that the adversary cannot masquerade as another party B to communicate with party A even if the static private key and the ephemeral private key of party A are compromised. We point out that the three-pass authenticated key exchange protocol generically transformed from the two-pass one secure in the eCK model cannot resist the SKCI attack. Finally, we introduce a new authenticated key exchange protocol SIG-DH+ and prove that it satisfies our new definition. Copyright © 2010 John Wiley & Sons, Ltd.

International audience; Authenticated Key Exchange (AKE) protocols enable two parties to establish a shared, cryptographically strong key over an insecure network using various authentication means, such as cryptographic keys, short (i.e., low-entropy) secret keys or credentials. In this paper, we provide a general framework, that encompasses several previous AKE primitives such as (Verifier-based) Password-Authenticated Key Exchange or Secret Handshakes, we call LAKE for Language-Authenticated Key Exchange.We first model this general primitive in the Universal Composability (UC) setting. Thereafter, we show that the Gennaro-Lindell approach can efficiently address this goal. But we need smooth projective hash functions on new languages, whose efficient implementations are of independent interest. We indeed provide such hash functions for languages defined by combinations of linear pairing product equations.Combined with an efficient commitment scheme, that is derived from the highly-efficient UC-secure Lindell’s commitment, we obtain a very practical realization of Secret Handshakes, but also Credential-Authenticated Key Exchange protocols. All the protocols are UC-secure, in the standard model with a common reference string, under the classical Decisional Linear assumption.

Cryptography has become an essential for providing security in embedded system applications. The employed cryptographic primitives should provide strong protection such that the security of the system is not compromised at any point in the lifecycle of a secure operation. This particularly includes the secure generation and maintenance of cryptographic keys. In general this assumption is difficult to accomplish, since there are attacks that come under this umbrella ranging from brute force attacks on the key to capturing the node to extract the key. In this paper we investigate and analyze ICMetrics and its counterpart scheme referred to as the scheme for the generation of strong high entropy ICMetrics session key pairs. ICMetrics is a key technology that computes the secret key based on hardware/ software properties of a device, thereby providing resilience against node capture attacks, while high entropy key pair generation scheme is employed to strengthen the generated ICMetrics basis number, so as to safeguard the generated strong key pairs from brute force and rainbow table attacks.

International audience; Authenticated Key Exchange protocols enable several parties to establish a shared cryptographically strong key over an insecure network using various authentication means, such as strong cryptographic keys or short (i.e., low-entropy) common secrets. The latter example is definitely the most interesting in practice, since no additional device is required, but just a human-memorable password, for authenticating the players. After the seminal work by Bellovin and Merritt, many settings and security notions have been defined, and many protocols have been proposed, in the two-user setting and in the group setting.

The paper introduces a new secret data communication system that employs the usage of two state-of-the art cryptographic algorithms (RSA with asymmetric keys and AES with symmetric key) together with steganography. The joining of these three techniques builds a robust steganography-based communication system capable of withstanding multiple types of attacks, detection and reverse engineering. Our system was designed in a way that offers a solution to the major flaws presented in other steganographic communication systems [2][4][5][6]. The secret data is encrypted using AES with a strong key prior to being embedded using a steganographic algorithm [1]. The key used for the data encryption uses a combination between a random generated sequence and a hash of the cover image's color information that remains untouched throughout the entire embedding process. The secret data and the key used for encryption both pass multiple levels of security checks that assure the integrity, authenticity and security, making this a reliable communication channel for sensitive data. While all encryption stages assure that the secret data becomes obsolete without the proper decryption perquisites (keys), the steganographic algorithm introduces an additional level of security: stealth.

To mitigate the damages of key-exposure, Dodis, Katz, Xu, and Yung [3], in Eurocrypt 2002, proposed a new paradigm called key-insulated security which provides tolerance against key exposures. Recently many identity-based key insulated signatures schemes have been proposed, however the problem of key escrow is inherent in this setting. To overcome this problem, certificateless public key cryptography was introduced in 2003 [1]. In this paper, we extend ID-based key-insulated signatures to certificateless scenarios and propose a certificateless key-insulated signature scheme with secure key-updates. The proposed scheme is strong key-insulated and perfectly key-insulated in the random oracle model.

Key-insulation aims at minimizing (i.e., compartmentalizing) the damage of users from key exposures, and traditionally requires a private channel of communication between a user and a semi-trusted party called a helper to refresh the private keys. The configuration is highly suitable to architectures where the signer is a user application and the helper resides in the safer “trusted module,” yet the user wants to remain in control of the sensitive crypto operation. The private channel employed in the model, while acceptable in some settings, certainly limits the usage of key insulation schemes (in case the user sits across the network from the trusted environment). In 2009, Bellare, Duan, and Palacio (CT-RSA 2009) refined the model of key-insulation by considering public channels (namely, ones controlled by the adversary), and showed how to convert a key-insulated signature scheme from the private channel into the public one, using extra primitives such as key exchange protocols and symmetric encryption. In this paper, we show that the primitives may be redundant in specific cases. In particular, we revisit the original key-insulated signature scheme in the private channel given by Dodis, Katz, Xu, and Yung (PKC 2003), and show that, with a tweak, the scheme can be naturally proved secure in the public channel without any additional primitives. Next we consider the area of leakage resilient cryptographic schemes which has gained much interest recently. In particular, we consider the continual key leakage scenario of our design (which is more general than the model of key exposure), and argue that our proposal, while requiring an added helper component, nevertheless enjoys several advantages over the recent signature scheme of Faust et al. (TCC 2010) with the same purpose of allowing continual leakage. Our design demonstrates how when given a more complex architecture with some parts that are safer than others, a trade-off can be applied, exploiting the safer modules but keeping users in control; further we show how to do it while mitigating the effect of exposures and leakages.

Tamper-proof devices are pretty powerful. They can be used to have better security in applications. In this work we observe that they can also be maliciously used in order to defeat some common privacy protection mechanisms. We propose the theoretical model of trusted agent to formalize the notion of programmable secure hardware. We show that protocols not using tamper-proof devices are not deniable if malicious verifiers can use trusted agents. In a strong key registration model, deniability can be restored, but only at the price of using key escrow. As an application, we show how to break invisibility in undeniable signatures, how to sell votes in voting schemes, how to break anonymity in group/ring signatures, and how to carry on the Mafia fraud in non-transferable protocols. We conclude by observing that the ability to put boundaries in computing devices prevents from providing full control on how private information spreads: the concept of sealing a device is in some sense incompatible with privacy.

Multi-party key agreement protocols indirectly assume that each principal equally contributes to the final form of the key. In this paper we consider three malleability attacks on multi-party key agreement protocols. The first attack, called strong key control allows a dishonest principal (or a group of principals) to fix the key to a pre-set value. The second attack is weak key control in which the key is still random, but the set from which the key is drawn is much smaller than expected. The third attack is named selective key control in which a dishonest principal (or a group of dishonest principals) is able to remove a contribution of honest principals to the group key. The paper discusses the above three attacks on several key agreement protocols, including DH (Diffie-Hellman), BD (Burmester-Desmedt) and JV (Just-Vaudenay). We show that dishonest principals in all three protocols can weakly control the key, and the only protocol which does not allow for strong key control is the DH protocol. The BD and JV protocols permit to modify the group key by any pair of neighboring principals. This modification remains undetected by honest principals.

Signature computation is frequently performed on insecure devices -- e.g., mobile phones -- operating in an environment where the private (signing) key is likely to be exposed. Strong key-insulated signature schemes are one way to mitigate the damage done when this occurs. In the key-insulated model [6], the secret key stored on an insecure device is refreshed at discrete time periods via interaction with a physically-secure device which stores a "master key". All signing is still done by the insecure device, and the public key remains fixed throughout the lifetime of the protocol. In a strong (t,N)-key-insulated scheme, an adversary who compromises the insecure device and obtains secret keys for up to t periods is unable to forge signatures for any of the remaining N-t periods. Furthermore, the physically-secure device (or an adversary who compromises only this device) is unable to forge signatures for any time period.We present here constructions of strong key-insulated signature schemes based on a variety of assumptions. First, we demonstrate a generic construction of a strong (N - 1,N)-key-insulated signature scheme using any standard signature scheme. We then give a construction of a strong (t,N)-signature scheme whose security may be based on the discrete logarithm assumption in the random oracle model. This construction offers faster signing and verification than the generic construction, at the expense of O(t) key update time and key length. Finally, we construct strong (N - 1,N)-key-insulated schemes based on any "trapdoor signature scheme" (a notion we introduce here); our resulting construction in fact serves as an identity-based signature scheme as well. This leads to very efficient solutions based on, e.g., the RSA assumption in the random oracle model.