Search

A partially blind signature scheme allows the signer to inoculate a non-removable common information into his blind signature. This common information may represent the date or the amount of e-cash. Due to its un-traceablility and partial blindness property, the partially blind signature plays an important role in many e-commerce applications. Based on the RSA scheme, we propose a partially blind threshold signature with low-computational load for the client.

Two efficient authenticated encryption schemes with message linkages are proposed. One is a basic scheme, that it has the better performance in comparison with the all previously proposed schemes in terms of the communication and the computation costs. However, it has a property as same as the previously proposed schemes, that the message blocks can be recovered only after the entire signature blocks have been received. Therefore, the basic scheme is applicable to encrypt all-or-nothing flow. Thus, we improve the basic scheme and also propose a generalized scheme, which allows the receiver to recover the partial message blocks before receiving the entire signature blocks. That is, the receiver may perform the receiving and the recovering processes simultaneously. Therefore, the generalized scheme is applicable to message flows. The generalized scheme requires smaller bandwidth and computational time as compared to the previously proposed authenticated encryption schemes with message linkages for message flows.

In secret sharing schemes, the secret holder has to distribute secret shares to each participant before distributing the secrets. To distribute or redistribute shares is a very costly process with respect to both time and resources. Unlike previous works, where different approaches are proposed for different scenarios, we propose a unified approach for both threshold‐based schemes and generalized group‐oriented cryptosystems. This unified implementation has the following merits: (1) With a unified approach, the implementation requires much less overhead than its counterparts when various secret sharing problems are simultaneously involved; (2) The Secret Holder (SD) does not need to redistribute new secret shares after the secret reconstruction; (3) The SD can, dynamically and efficiently, determine the capacities (weight) of each user on recovering the secrets, and the threshold values of the secrets; (4) To dynamically adjust the capacities of users, the SD does not need to refresh the shadow o...

The smart card-based scheme is a very promising and practical solution to remote authentication. Compared with other smart card-based schemes, our solution achieves more functionality and requires much less computational cost. These important merits include: (1) there is no verification table; (2) users can freely choose their passwords; (3) the communication cost and the computational cost is very low; and (4) it provides mutual authentication between the user and the server.

Anonymous multi-receiver identity (ID)-based encryption (anonymous MIBE) allows a sender to use the identities of multiple receivers to encrypt messages such that only the selected receivers can decrypt the messages while nobody, except the sender, knows who the other selected receivers are. Recently, several anonymous MIBE schemes were proposed. However, some security weaknesses were found in some of these schemes. Moreover, in the existing anonymous MIBE schemes, the decryption cost required for each receiver is linear in the number of selected receivers. In this article, we propose an efficient anonymous MIBE scheme and formally prove that it is semantically secure for both confidentiality and receiver anonymity. With compared to previously proposed anonymous MIBE schemes, our scheme has the best performance while offers provable security.

In 1998, Chang and Wu proposed a group-oriented authentication mechanism with key exchange [Computer Communications 21 (1998) 485–497]. The authors show that the Chang–Wu protocols are vulnerable to the impersonation attack. They also give improvements that can not only eliminate the security flaw, but also reduce the redundant messages inherent in the original protocols.

In 1999, Liaw proposed a new broadcasting cryptosystem, which requires smaller bandwidth as compared to the previously proposed broadcasting cryptosystems. However, this article will show that the proposed system is insecure enough by presenting a conspiracy attack on it. We will also point out some ambiguous problems in Liaw's paper. Moreover, we propose an improved broadcasting cryptosystem, which is a slight modification of the proposed system to overcome the conspiracy attack.

In 1995, Wu proposed an efficient smart card-oriented remote login authentication scheme. The scheme allows a user to freely choose his password, and no verification tables are required. Hwang recently showed the insecurity in Wu's scheme; however, he did not propose his improvement. In this article, authors show a different approach to break the scheme, and propose their improvement. The modified scheme can withstand all possible attacks.

In 1999, Chen (1999) proposed several signature schemes in his graduate thesis. One is a group‐oriented (t,n) threshold signature scheme in which the (t,n) threshold signature is based on an RSA scheme. Although it has advantages, including message recovery, lower cost for transmission, and message linkage, it requires a great amount of time for the modulo exponentiation computation. In this article, we propose an improved scheme, which is more efficient than the one proposed by Chen both in the signature generation and the verification.

In PKC 2004, Choi et al. proposed an ID-based authenticated group key agreement (AGKA) protocol using bilinear pairings. Unfortunately, their protocol suffered from an impersonation attack and an insider colluding attack. In 2008, Choi et al. presented an improvement to resist insider attacks. In their modified protocol, they used an ID-based signature scheme on transcripts for binding them in a session to prevent replay of transcripts. In particular, they smartly used the batch verification technique to reduce the computational cost. In this paper, we first show that Choi et al.'s modified AGKA protocol still suffers from an insider colluding attack. Then, we prove that the batch verification of the adopted ID-based signature scheme in their modified protocol suffers from a forgery attack.

User hierarchy is a critical issue in the access control policy for information protection systems. The conventional user hierarchy structure utilized over the past decades is discussed. Within this user hierarchy structure, a user is permitted to access all of the files of other users who are below him in the user hierarchy. However, this relationship is not suitable for the following situation; users desire to keep some permissions of files private to themselves and free from access from superior users. In this paper, we shall propose a new user privilege hierarchy to represent the relationship of limited inheritance. Furthermore, we also provide an effective and dynamic method that can procure the relationships and the inheritable privileges among users in the user privilege hierarchy.

Signature scheme is one of important primitives in modern cryptography, which may offer functionalities of user identification, non-repudiation, and message authentication. With the advent of identity (ID)-based public key system (IDPKS) with bilinear pairings, many cryptographic schemes and protocols based on the IDPKS system have been proposed. Though the IDPKS system has the advantage to eliminate certificate management, it is a critical issue to revoke misbehaving or compromised users in this system. Quite recently, Tseng and Tsai presented a practical revocation mechanism using a public channel for the IDPKS system. In this paper, we adopt Tseng and Tsaii¦s revocation concept to propose the first revocable ID-based signature scheme with batch verifications (RID-SBV). Meanwhile, we discuss the several cases of batch verifications. Under the computational Diffie-Hellman assumption, we demonstrate that the proposed RID-SBV scheme is a provably secure signature scheme.

Recently, Fan et al. proposed the first anonymous multi-receiver identity (ID)-based encryption (AMIBE) scheme to encrypt a message for multiple selected receivers while achieving anonymity. They claimed that nobody, except the sender, knows who the selected receivers are. However, their scheme has been shown that any selected receiver can extract the identities of the other selected receivers because their security model cannot capture the full requirement of receiver anonymity. In this article, we first re-define the security model of AMIBE. We then propose a new AMIBE scheme to achieve complete receiver anonymity. We prove that the proposed AMIBE scheme is semantically secure against adaptive chosen cipher text attacks (CCA). Comparisons are given to demonstrate the proposed AMIBE schemei¦s advantages.

Cellular (3G or 2.5G) networks provide wider service areas and ubiquitous connectivity with low data rates. WLAN networks offer higher data rates and the easy compatibility of wired Internet, but cover smaller areas. 3G and WLAN possess complementary properties. Integrating 3G and WLAN networks may offer subscribers high-speed wireless data services and ubiquitous connectivity. For integrating two different networks, there are several problems should be concerned, such as authentication, billing, quality of service, and seamless roaming between 3G and WLAN networks. In this paper, we address the authentication problem and propose an efficient authentication protocol to let 3G subscribers can connect WLAN with higher data rate. Certainly, the protocol is also suitable for 2.5G. The authentication protocol utilizes a one-time password approach to authenticate subscribers. It can withstand guessing, replay and impersonation attacks. A simulation result is given to validate our protocol.

A digital signature with a subliminal channel, that allows a signer to embed subliminal messages in the digital signature. Any receivers may verify the signature, but can not discover the subliminal messages, only authorized receivers can extract the subliminal messages. In this paper we propose two digital signature schemes with subliminal channels based on discrete logarithms. Both schemes allow a signer to generate a digital signature, which may contain two or more subliminal messages for various subliminal receivers. Compared to the previously proposed schemes, both our schemes greatly reduce the size of secret keys that must be kept by the signer and the subliminal receiver; as well as the length of the digital signature. The security of the proposed schemes is based on the difficulty of computing the discrete logarithm problem.

Shamir (1984) proposed the idea of a cryptographic system based on identification information and presented an identity-based signature scheme. He also presented as an open problem to find an ID-based public-key cryptosystem or public-key distribution system. In the past, many ID-based public-key distribution systems have been proposed. However, none of these is an ID-based system in Shamir's sense because each user's public key is not only the identity of the entity but also some additional random numbers. Maurer and Yacobi (1991) developed a non-interactive ID-based public-key distribution system. In their scheme, except for the identity of the entity, there were no public keys, certificates for public keys or other information required to be exchanged. However, they did not construct an ID-based signature scheme, user identification scheme or conference key distribution system. In this paper, we provide a slight improvement of the Maurer and Yacobi's scheme in that the trusted authority only adds one public value over the original scheme. Based on this, we provide not only a non-interactive public-key distribution system, but also a directed signature scheme, a user identification scheme and a conference key distribution system. Thus, a non-interactive public-key system will be more practical and complete for various kinds of applications. The security for the proposed schemes is based on the one-way hash function assumption and the difficulty of computing the discrete logarithm for a composite modulus.

With a partially blind signature scheme, the signer inoculates non-removable common information into his blind signature. This common information may represent the date or the amount of cash. Due to its untraceability and partial blindness property, the partially blind signature plays an important role in many e-commerce applications. Based on the RSA scheme, we propose a partially blind signature with low computation which makes it attractive for mobile client and smart-card implementation.

Wireless local area network (WLAN) and cellular network are two important technologies for providing wireless communications. For user authentication of WLAN, the IEEE 802.1X standard provides an authentication framework that is based on the Extensible Authentication Protocol (EAP). When a roaming user wants to access WLANs provided by different operators, the user must remember multiple identities and the corresponding authentication credentials. Obviously, such an exercise is not user friendly. This problem is caused by the fact that a visited WLAN does not have the authentication credential of a roaming user. Previous proposals have studied the authentication of inter-network roaming across different WLANs, or across a cellular network and a WLAN. As is known, cellular networks provide wider service areas, ‘always-on’ and ubiquitous connectivity. The integration of WLAN and cellular networks has a management advantage that it can unify the subscriber identity and the corresponding credential. In this paper, we first propose a practical certificate distribution scheme. The certificate distribution scheme allows roaming users of a cellular network to obtain temporary certificates from their home cellular network. Afterward adopting certificate-based authentication protocol of the IEEE 802.1X standard, roaming users may use temporary certificates to access WLANs. The proposed solution achieves easy subscriber management and pervasive access. As demonstrated, the proposed solution also provides mutual authentication and strong identity protection, in addition to withstanding the man-in-the-middle attack and the eavesdropping attack. A performance evaluation shows that the proposed protocol is well suited for roaming users with mobile devices.

Owing to the rapid development of microelectronics techniques, the computation power of low-cost processors has increased greatly. Therefore, based on a public-key and secret-key hybrid algorithm, Zhibin and Naitong proposed an authentication scheme for personal communication systems; they emphasised security of mutual authentication, and claimed to provide non-repudiation of service. However, it is shown here that an attacker can easily impersonate a valid network provider, therefore non-repudiation of service is not provided by the aforementioned scheme.

Recently, Tan et al. proposed an efficient smart card-oriented remote login authentication scheme. The scheme has several merits: (i) the user can freely choose his password; (ii) no verification tables are required; and (iii) the computation overhead is low. However, the authors show the insecurity of Tan-Zhu's scheme.

Recently, Yi et al. [see ibid., vol. 36, no. 2, p. 130-1 (2000)] proposed a digital signature scheme using a one-time pair of keys that provides the signer with anonymity with respect to the verifier but not to the certification authority. In this comment, we show that Yi et al.'s scheme is insecure against forgery because any malicious attacker can generate valid signatures for any message without knowing the legal user's secret keys. That is, even the certification authority cannot identify the identity of the real signer. Therefore, Yi et al.'s signature scheme is not secure enough to withstand a forgery attack.

Seo and Sweeney recently proposed a simple authenticated key agreement protocol using a password-based method [see ibid., vol. 35, no. 13, p. 1073, 1999]. They claimed that the established session key between two users is also verified. However, the author points out that verification of the session key cannot be achieved in their protocol. A slight improvement to their protocol is proposed to overcome this weakness.

Y.M. Tseng and J.K. Jan (see ibid., vol.35, no.1, pp.37-8, 1999) have proposed an improved group signature scheme based on the discrete logarithm problem. In this Comment, we show that the new scheme is still not unlinkable. A reply by Tseng and Jan is included.

In 1998, an efficient group signature scheme (the Lee-Chang scheme) was proposed based on the discrete logarithm problem. In this scheme, different group signatures of a signer for different messages contain some identical information. Once one group signature is identified, all previous group signatures are also identified at the same time. This is impractical for applications of group signatures. The authors propose an improvement on the Lee-Chang scheme to solve the above problem. The improved group signature scheme preserves the main merits inherent in most of the Lee-Chang scheme. The security of the improved scheme is also based on the discrete logarithm problem.

With the growth in the scale of network technologies, security has become a major concern and a limiting factor. Computer networks provide convenient procedures for users operating at remote places. However, an intruder can easily access and intercept information transmitted in an open channel. Two integrated schemes for user authentication and access control are proposed, which are mechanisms used to provide for the protection of privacy and security in a distributed environment. One scheme is a dynamic approach which provides an efficient updating process for the modification of access rights. The second scheme allows servers to simplify verification processes for multiple access requests of a user at the same time. Both schemes are noninteractive approaches in which security is based on the computational difficulty of solving the discrete logarithm problem. Compared with other schemes proposed previously, the schemes are more secure and efficient and suitable for applications in a distributed environment. Intruders cannot derive secret information from public information. Intruders are not able to acquire the passwords of users from previously intercepted messages. By applying a time stamp, the schemes can withstand the replaying attack.

Chikazawa and Yamagishi ( see ibid., vol. 28, no 1, p. 1015-17, 1992) proposed an ID-based key sharing system which improved the previous scheme to counter the attack developed by Simbo and Kawamura (1991). An improvement to the Chikazawa-Yamagishi scheme is presented. This improvement achieves the same security level and requires fewer transmitted messages and less computing time for key distribution and key recovery than the existing scheme.