Skip to main content

Changshe Ma

Followers

2

Following

1

Public Views

Antonis Michalas

University of Westminster

SDIWC Organization

Emiliano De Cristofaro

University of California, Riverside

ISAR Publications

Anna University

Journal of Computer Science IJCSIS

Sujatha Paramasivam

ANNA UNIVERSITY OF TECHNOLOGY CHENNAI

Interests

Uploads

Papers by Changshe Ma

Practical Searchable Symmetric Encryption Supporting Conjunctive Queries Without Keyword Pair Result Pattern Leakage

IEEE Access

The research of searchable symmetric encryption (SSE) has been focused on the trade-off between s... more The research of searchable symmetric encryption (SSE) has been focused on the trade-off between security, performance, and functionality. Recently proposed Hidden Cross-Tags (HXT) protocol improves the Oblivious Cross-Tags (OXT) by avoiding the leakage of 'Keyword Pair Result Pattern' (KPRP), at the cost of increasing the storage size by two orders of magnitude. In this paper, we reconsider the principle of designing SSE protocols to prevent KPRP leakage. At first, we introduce a new primitive called subset membership check (SMC), where a set is encrypted such that its subset membership can be checked only through a protocol between Sender and Tester. The holistic security of SMC requires that nothing is revealed other than the membership of a subset after each execution of the protocol. We propose a hashbased SMC implementation with efficient computation, communication, and storage. Secondly, based on the hash-based SMC, we present a practical SSE protocol that supports conjunctive queries without KPRP leakage. Our SSE protocol, called 'Practical Hidden Cross-Tags' (PHXT), maintains the same storage size as OXT while preserving the same privacy and functionality as HXT. Compared with HXT, our PHXT reduces the storage size and the communication overhead by 91.29%, 64.29%, respectively, without degrading the computational efficiency. INDEX TERMS Conjunctive query, encrypted bloom filter, holistic security, keyword pair result pattern, searchable symmetric encryption, subset membership check.

Practical Lattice-Based Multisignature Schemes for Blockchains

IEEE Access

Compact multisignature is vital for shrinking the signature size of decentralized blockchain. All... more Compact multisignature is vital for shrinking the signature size of decentralized blockchain. All practical compact multisignature schemes have been constructed from the discrete logarithm problem which is potentially vulnerable to quantum computing attacks. Lattice-based multisignature schemes are potential candidates for resisting quantum attacks. However, the existing lattice-based multisignature schemes suffer either loose signatures or large public key and signature sizes after compressing, which makes them unsuitable for blockchains. In this paper, we first present a practical lattice-based multisignature scheme with much smaller signature sizes than previous lattice-based multisignature schemes. Then, we extend our scheme to support public key aggregation with almost the same performance. Both of our multisignature schemes are provably secure in the random oracle model under the ring version of the short integer solution (Ring-SIS) assumption. They outperform the recent lattice-based multisignature scheme proposed by Bansarkhani and Sturm (BS) in terms of both signature size and communication overhead.

CCA-Secure Keyed-Fully Homomorphic Encryption

Lecture Notes in Computer Science, 2016

Simple and efficient password-based authenticated key exchange protocol

Journal of Shanghai Jiaotong University Science, Aug 1, 2011

bin * (), PAN Jia-xin (), MA Chang-she ()

Fast Digital Signature Schemes as Secure as Diffie-Hellman Assumptions

ABSTRACT This paper presents two fast digital signature schemes based on Di-e-Hellman assumptions... more ABSTRACT This paper presents two fast digital signature schemes based on Di-e-Hellman assumptions. In the random oracle model, the flrst scheme S1 has a tight security reduction to the computational Di-e-Hellman (CDH) problem; and the second scheme S2 has a tight security reduction to the decisional Di-e-Hellman (DDH) problem. Comparing with existing signature schemes (whose security is tightly related to CDH problem) like EDL signature schemes, the signature generation of S1 is about 27% faster, and the veriflcation is about 35% faster, if without considering the hash function evalu- ations. Comparing with existing signature schemes (whose security is tightly related to DDH problem) like KW-DDH signature scheme, the signing of S2 is about 40% faster and the veriflcation is about 35% faster. The high e-ciency of the proposed schemes is attributed to a new protocol EDL mwz which implements the proof of equality of discrete logarithm. The EDL mwz protocol outperforms its counterpart, the Chaum and Pedersen protocol, as its computation is about 38% faster and its bandwidth is jGj bits shorter. This new protocol may be of independent interests.

Democratic group signatures with threshold traceability

Journal of Shanghai Jiaotong University, 2009

Recently, democratic group signatures(DGSs) particularly catch our attention due to their great f... more Recently, democratic group signatures(DGSs) particularly catch our attention due to their great flexibilities, i.e., no group manager, anonymity, and individual traceability. In existing DGS schemes, individual traceability says that any member in the group can reveal the actual signer's identity from a given signature. In this paper, we formally describe the definition of DGS, revisit its security notions by strengthening the requirement for the property of traceability, and present a concrete DGS construction with (t, n)-threshold traceability which combines the concepts of group signatures and of threshold cryptography. The idea behind the (t, n)-threshold traceability is to distribute between n group members the capability of tracing the actual signer such that any subset of not less than t members can jointly reconstruct a secret and reveal the identity of the signer while preserving security even in the presence of an active adversary which can corrupt up to t − 1 group members.

Democratic group signatures with threshold traceability

Journal of Shanghai Jiaotong University (Science), 2009

Recently, democratic group signatures(DGSs) particularly catch our attention due to their great f... more Recently, democratic group signatures(DGSs) particularly catch our attention due to their great flexibilities, i.e., no group manager, anonymity, and individual traceability. In existing DGS schemes, individual traceability says that any member in the group can reveal the actual signer's identity from a given signature. In this paper, we formally describe the definition of DGS, revisit its security notions by strengthening the requirement for the property of traceability, and present a concrete DGS construction with (t, n)-threshold traceability which combines the concepts of group signatures and of threshold cryptography. The idea behind the (t, n)-threshold traceability is to distribute between n group members the capability of tracing the actual signer such that any subset of not less than t members can jointly reconstruct a secret and reveal the identity of the signer while preserving security even in the presence of an active adversary which can corrupt up to t − 1 group members.

Efficient Short Signcryption Scheme with Public Verifiability

Lecture Notes in Computer Science, 2006

RFID privacy

Proceedings of the 16th ACM conference on Computer and communications security - CCS '09, 2009

Abstract Privacy of RFID systems is receiving increasing attention in the RFID community. Basical... more

On the Untraceability of Anonymous RFID Authentication Protocol with Constant Key-Lookup

Lecture Notes in Computer Science, 2009

In ASIACCS’08, Burmester, Medeiros and Motta proposed an anonymous RFID authentication protocol (... more In ASIACCS’08, Burmester, Medeiros and Motta proposed an anonymous RFID authentication protocol (BMM protocol [2]) that preserves the security and privacy properties, and achieves better scalability compared with other contemporary approaches. We analyze BMM protocol and find that some of security properties (especial untraceability) are not fulfilled as originally claimed. We consider a subtle attack, in which an adversary can manipulate the messages transmitted between a tag and a reader for several continuous protocol runs, and can successfully trace the tag after these interactions. Our attack works under a weak adversary model, in which an adversary can eavesdrop, intercept and replay the protocol messages, while stronger assumptions such as physically compromising of the secret on a tag, are not necessary. Based on our attack, more advanced attacking strategy can be designed on cracking a whole RFID-enabled supply chain if BMM protocol is implemented. To counteract such flaw, we improve the BMM protocol so that it maintains all the security and efficiency properties as claimed in [2].

Secure and efficient RFID mutual authentication protocol

Journal of Computer Applications, 2009

Journal of Computer Applications 2008 28 (9): 2236-2238 ISSN: 1001-9081: CN: 51-1307/TP, Secure a... more

Efficient authenticated encryption schemes with public verifiability

IEEE 60th Vehicular Technology Conference, 2004. VTC2004-Fall. 2004, 2004

An authenticated encryption scheme allows messages to be encrypted and authenticated simultaneous... more An authenticated encryption scheme allows messages to be encrypted and authenticated simultaneously. In 2003, Ma and Chen proposed such a scheme with public verifiability. That is, in their scheme the receiver can efficiently prove to a third party that a message is indeed originated from a specific sender. In this paper, we first identify two security weaknesses in the Ma-Chen authenticated encryption scheme. Then, based on the Schnorr signature, we proposed an efficient and secure improved scheme such that all the desired security requirements are satisfied.

Flexible and Secure Secret Updating for Unidirectional Key Distribution in Rfid-Enabled Supply Chains

In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to allevi... more In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to alleviate the key distribution problem in RFID-enabled supply chains. Compared to existing pseudonym based RFID protocols, the secret sharing based solution is more suitable for RFID-enabled supply chains since it does not require a database of keys be distributed among supply chain parties for secure

Enabling Secure Secret Updating for Unidirectional Key Distribution in RFID-Enabled Supply Chains

Lecture Notes in Computer Science, 2009

In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to allevi... more In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to alleviate the key distribution problem in RFID-enabled supply chains. Compared to existing pseudonym based RFID protocols, the secret sharing based solution is more suitable for RFID-enabled supply chains since it does not require a database of keys be distributed among supply chain parties for secure ownership transfer of RFID tags. However, this mechanism cannot resist tag tracking and tag counterfeiting attacks in supply chain systems. It is also not convenient for downstream supply chain parties to adjust the size of RFID tag collections in recovering tag keys. To address these problems, we propose a flexible and secure secret update protocol which enables each supply chain party to update tag keys in a secure and efficient manner. Our proposal enhances the previous secret sharing based mechanism in that it not only solves the flexibility problem in unidirectional key distribution, but also ensures the security for ownership transfer of tags in RFID-enabled supply chains.

Optimistic fair exchange e-commerce protocol based on secret sharing

Journal of Systems Engineering and Electronics, 2006

A key problem of electronic commerce (for short e-commerce) is fair exchange which guarantees tha... more A key problem of electronic commerce (for short e-commerce) is fair exchange which guarantees that at the end of the transaction, either both parties involved in the transaction receive each other&amp;#x27;s items or none do. A non-interactive optimistic fair exchange e-commerce protocol model based on the publicly verifiable secret sharing is presented. The main idea of our exchange protocol is to interchange verifiable and recoverable keys of the symmetric encryption for participants&amp;#x27; items. So it is especially suitable for exchange of large-size items. Furthermore, our protocol is efficient and simple as it does not need interactive proof system which has been adopted by a large quantity of previously proposed fair exchange protocols. Based on a modified (2,2) secret sharing scheme, a concrete non-interactive fair exchange e-commerce protocol is designed.

Identity-Based Parallel Key-Insulated Encryption Without Random Oracles: Security Notions and Construction

Lecture Notes in Computer Science, 2006

In this paper, we apply the parallel key-insulation mechanism to identity-based encryption (IBE) ... more In this paper, we apply the parallel key-insulation mechanism to identity-based encryption (IBE) scenarios, and minimize the damage caused by key-exposure in IBE systems. We first formalize the definition and security notions for ID-based parallel key-insulated encryption (IBPKIE) systems, and then propose an IBPKIE scheme based on Water’s IBE scheme. To the best of our knowledge, this is the first IBPKIE scheme up to now. Our scheme enjoys two attractive features: (i) it is provably secure without random oracles; (ii) it not only allows frequent key updating, but also does not increase the risk of helper key-exposure.

Efficient and Proactive Threshold Signcryption

Lecture Notes in Computer Science, 2005

ABSTRACT To make the system more secure and robust, threshold schemes are proposed to avoid singl... more ABSTRACT To make the system more secure and robust, threshold schemes are proposed to avoid single point failure. At the same time, there are more and more applications which utilize the two basic blocks encryption and digital signature to secure message delivery (such as SSL, SSH). Combining the three tools organically leads to an interesting security tool termed as threshold signcryption which can be used in distributed systems especially the mobile networks. In this paper, we present an efficient threshold signcryption scheme. The scheme is designed for an asynchronous network model which may better present practical distributed systems, especially Internet or mobile ad hoc networks. In order to resist mobile attacks, we add proactive property to our scheme. To the best of our knowledge, the proposed scheme is the first threshold signcryption scheme which is noninteractive, proactive and provably secure and works on asynchronous network models.

Analysis and Improvement of an Authenticated Key Exchange Protocol

Lecture Notes in Computer Science, 2011

ABSTRACT In this paper, we analyze and improve an authenticated key exchange protocol named as up... more ABSTRACT In this paper, we analyze and improve an authenticated key exchange protocol named as up which is proposed in a recent paper. We present a key compromise impersonation (KCI) attack and a secret replication (SR) attack against up. In order to formally capture these attacks, a variant of Canetti-Krawczyk model named as vCK model is proposed. Using this variant, we describe a successful KCI attack and a successful SR attack against up. To avoid the attacks, we provide an improved protocol named as up+ by binding the shared secret to the session identifier. up+ is provably secure under the hardness of the Gap Diffie-Hellman problem in the random oracle model. Our improved protocol combines the higher security level with comparable efficiency.

Security Enhancement and Modular Treatment towards Authenticated Key Exchange

Lecture Notes in Computer Science, 2010

We present an enhanced security model for the authenticated key exchange (AKE) protocols to captu... more We present an enhanced security model for the authenticated key exchange (AKE) protocols to capture the pre-master secret replication attack and to avoid the controversial random oracle assumption in the security proof. Our model treats the AKE protocol as two relatively independent modules, the secret exchange module and the key derivation module, and formalizes the adversarial capabilities and security properties for each of these modules. We prove that the proposed security model is stronger than the extended Canetti-Krawczyk model. Moreover, we introduce NACS, a two-pass AKE protocol which is secure in the enhanced model. NACS is practical and efficient, since it reqires less exponentiations, and, more important, admits a tight security reduction with weaker standard cryptographic assumptions. Finally, the compact and elegant security proof of NACS shows that our method is reasonable and effective.

Transitive Signatures Based on Bilinear Maps

The notion of transitive signature, firstly introduced by Micali and Rivest, is a way to digitall... more The notion of transitive signature, firstly introduced by Micali and Rivest, is a way to digitally sign the vertices and edges of a dynamically growing, transitively closed graph. All the previous proposed transitive signature schemes were constructed from discrete logarithm, factoring, or RSA assumption. In this paper, we introduce two alternative realizations of transitive signature based on bilinear maps. The proposed transitive signature schemes possess the following properties: (i) they are provably secure against adaptive chosen-message attacks in the random oracle model; (ii) there are no need for node certificates in our transitive signature schemes, so the signature algebra is compact; (iii) if using Weil pairing, our signature schemes are more efficient than all previous proposed schemes.

Practical Searchable Symmetric Encryption Supporting Conjunctive Queries Without Keyword Pair Result Pattern Leakage

IEEE Access

The research of searchable symmetric encryption (SSE) has been focused on the trade-off between s... more The research of searchable symmetric encryption (SSE) has been focused on the trade-off between security, performance, and functionality. Recently proposed Hidden Cross-Tags (HXT) protocol improves the Oblivious Cross-Tags (OXT) by avoiding the leakage of 'Keyword Pair Result Pattern' (KPRP), at the cost of increasing the storage size by two orders of magnitude. In this paper, we reconsider the principle of designing SSE protocols to prevent KPRP leakage. At first, we introduce a new primitive called subset membership check (SMC), where a set is encrypted such that its subset membership can be checked only through a protocol between Sender and Tester. The holistic security of SMC requires that nothing is revealed other than the membership of a subset after each execution of the protocol. We propose a hashbased SMC implementation with efficient computation, communication, and storage. Secondly, based on the hash-based SMC, we present a practical SSE protocol that supports conjunctive queries without KPRP leakage. Our SSE protocol, called 'Practical Hidden Cross-Tags' (PHXT), maintains the same storage size as OXT while preserving the same privacy and functionality as HXT. Compared with HXT, our PHXT reduces the storage size and the communication overhead by 91.29%, 64.29%, respectively, without degrading the computational efficiency. INDEX TERMS Conjunctive query, encrypted bloom filter, holistic security, keyword pair result pattern, searchable symmetric encryption, subset membership check.

Practical Lattice-Based Multisignature Schemes for Blockchains

IEEE Access

Compact multisignature is vital for shrinking the signature size of decentralized blockchain. All... more Compact multisignature is vital for shrinking the signature size of decentralized blockchain. All practical compact multisignature schemes have been constructed from the discrete logarithm problem which is potentially vulnerable to quantum computing attacks. Lattice-based multisignature schemes are potential candidates for resisting quantum attacks. However, the existing lattice-based multisignature schemes suffer either loose signatures or large public key and signature sizes after compressing, which makes them unsuitable for blockchains. In this paper, we first present a practical lattice-based multisignature scheme with much smaller signature sizes than previous lattice-based multisignature schemes. Then, we extend our scheme to support public key aggregation with almost the same performance. Both of our multisignature schemes are provably secure in the random oracle model under the ring version of the short integer solution (Ring-SIS) assumption. They outperform the recent lattice-based multisignature scheme proposed by Bansarkhani and Sturm (BS) in terms of both signature size and communication overhead.

CCA-Secure Keyed-Fully Homomorphic Encryption

Lecture Notes in Computer Science, 2016

Simple and efficient password-based authenticated key exchange protocol

Journal of Shanghai Jiaotong University Science, Aug 1, 2011

bin * (), PAN Jia-xin (), MA Chang-she ()

Fast Digital Signature Schemes as Secure as Diffie-Hellman Assumptions

ABSTRACT This paper presents two fast digital signature schemes based on Di-e-Hellman assumptions... more ABSTRACT This paper presents two fast digital signature schemes based on Di-e-Hellman assumptions. In the random oracle model, the flrst scheme S1 has a tight security reduction to the computational Di-e-Hellman (CDH) problem; and the second scheme S2 has a tight security reduction to the decisional Di-e-Hellman (DDH) problem. Comparing with existing signature schemes (whose security is tightly related to CDH problem) like EDL signature schemes, the signature generation of S1 is about 27% faster, and the veriflcation is about 35% faster, if without considering the hash function evalu- ations. Comparing with existing signature schemes (whose security is tightly related to DDH problem) like KW-DDH signature scheme, the signing of S2 is about 40% faster and the veriflcation is about 35% faster. The high e-ciency of the proposed schemes is attributed to a new protocol EDL mwz which implements the proof of equality of discrete logarithm. The EDL mwz protocol outperforms its counterpart, the Chaum and Pedersen protocol, as its computation is about 38% faster and its bandwidth is jGj bits shorter. This new protocol may be of independent interests.

Democratic group signatures with threshold traceability

Journal of Shanghai Jiaotong University, 2009

Recently, democratic group signatures(DGSs) particularly catch our attention due to their great f... more Recently, democratic group signatures(DGSs) particularly catch our attention due to their great flexibilities, i.e., no group manager, anonymity, and individual traceability. In existing DGS schemes, individual traceability says that any member in the group can reveal the actual signer's identity from a given signature. In this paper, we formally describe the definition of DGS, revisit its security notions by strengthening the requirement for the property of traceability, and present a concrete DGS construction with (t, n)-threshold traceability which combines the concepts of group signatures and of threshold cryptography. The idea behind the (t, n)-threshold traceability is to distribute between n group members the capability of tracing the actual signer such that any subset of not less than t members can jointly reconstruct a secret and reveal the identity of the signer while preserving security even in the presence of an active adversary which can corrupt up to t − 1 group members.

Democratic group signatures with threshold traceability

Journal of Shanghai Jiaotong University (Science), 2009

Recently, democratic group signatures(DGSs) particularly catch our attention due to their great f... more Recently, democratic group signatures(DGSs) particularly catch our attention due to their great flexibilities, i.e., no group manager, anonymity, and individual traceability. In existing DGS schemes, individual traceability says that any member in the group can reveal the actual signer's identity from a given signature. In this paper, we formally describe the definition of DGS, revisit its security notions by strengthening the requirement for the property of traceability, and present a concrete DGS construction with (t, n)-threshold traceability which combines the concepts of group signatures and of threshold cryptography. The idea behind the (t, n)-threshold traceability is to distribute between n group members the capability of tracing the actual signer such that any subset of not less than t members can jointly reconstruct a secret and reveal the identity of the signer while preserving security even in the presence of an active adversary which can corrupt up to t − 1 group members.

Efficient Short Signcryption Scheme with Public Verifiability

Lecture Notes in Computer Science, 2006

RFID privacy

Proceedings of the 16th ACM conference on Computer and communications security - CCS '09, 2009

Abstract Privacy of RFID systems is receiving increasing attention in the RFID community. Basical... more

On the Untraceability of Anonymous RFID Authentication Protocol with Constant Key-Lookup

Lecture Notes in Computer Science, 2009

In ASIACCS’08, Burmester, Medeiros and Motta proposed an anonymous RFID authentication protocol (... more In ASIACCS’08, Burmester, Medeiros and Motta proposed an anonymous RFID authentication protocol (BMM protocol [2]) that preserves the security and privacy properties, and achieves better scalability compared with other contemporary approaches. We analyze BMM protocol and find that some of security properties (especial untraceability) are not fulfilled as originally claimed. We consider a subtle attack, in which an adversary can manipulate the messages transmitted between a tag and a reader for several continuous protocol runs, and can successfully trace the tag after these interactions. Our attack works under a weak adversary model, in which an adversary can eavesdrop, intercept and replay the protocol messages, while stronger assumptions such as physically compromising of the secret on a tag, are not necessary. Based on our attack, more advanced attacking strategy can be designed on cracking a whole RFID-enabled supply chain if BMM protocol is implemented. To counteract such flaw, we improve the BMM protocol so that it maintains all the security and efficiency properties as claimed in [2].

Secure and efficient RFID mutual authentication protocol

Journal of Computer Applications, 2009

Journal of Computer Applications 2008 28 (9): 2236-2238 ISSN: 1001-9081: CN: 51-1307/TP, Secure a... more

Efficient authenticated encryption schemes with public verifiability

IEEE 60th Vehicular Technology Conference, 2004. VTC2004-Fall. 2004, 2004

An authenticated encryption scheme allows messages to be encrypted and authenticated simultaneous... more An authenticated encryption scheme allows messages to be encrypted and authenticated simultaneously. In 2003, Ma and Chen proposed such a scheme with public verifiability. That is, in their scheme the receiver can efficiently prove to a third party that a message is indeed originated from a specific sender. In this paper, we first identify two security weaknesses in the Ma-Chen authenticated encryption scheme. Then, based on the Schnorr signature, we proposed an efficient and secure improved scheme such that all the desired security requirements are satisfied.

Flexible and Secure Secret Updating for Unidirectional Key Distribution in Rfid-Enabled Supply Chains

In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to allevi... more In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to alleviate the key distribution problem in RFID-enabled supply chains. Compared to existing pseudonym based RFID protocols, the secret sharing based solution is more suitable for RFID-enabled supply chains since it does not require a database of keys be distributed among supply chain parties for secure

Enabling Secure Secret Updating for Unidirectional Key Distribution in RFID-Enabled Supply Chains

Lecture Notes in Computer Science, 2009

In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to allevi... more In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to alleviate the key distribution problem in RFID-enabled supply chains. Compared to existing pseudonym based RFID protocols, the secret sharing based solution is more suitable for RFID-enabled supply chains since it does not require a database of keys be distributed among supply chain parties for secure ownership transfer of RFID tags. However, this mechanism cannot resist tag tracking and tag counterfeiting attacks in supply chain systems. It is also not convenient for downstream supply chain parties to adjust the size of RFID tag collections in recovering tag keys. To address these problems, we propose a flexible and secure secret update protocol which enables each supply chain party to update tag keys in a secure and efficient manner. Our proposal enhances the previous secret sharing based mechanism in that it not only solves the flexibility problem in unidirectional key distribution, but also ensures the security for ownership transfer of tags in RFID-enabled supply chains.

Optimistic fair exchange e-commerce protocol based on secret sharing

Journal of Systems Engineering and Electronics, 2006

A key problem of electronic commerce (for short e-commerce) is fair exchange which guarantees tha... more A key problem of electronic commerce (for short e-commerce) is fair exchange which guarantees that at the end of the transaction, either both parties involved in the transaction receive each other&amp;#x27;s items or none do. A non-interactive optimistic fair exchange e-commerce protocol model based on the publicly verifiable secret sharing is presented. The main idea of our exchange protocol is to interchange verifiable and recoverable keys of the symmetric encryption for participants&amp;#x27; items. So it is especially suitable for exchange of large-size items. Furthermore, our protocol is efficient and simple as it does not need interactive proof system which has been adopted by a large quantity of previously proposed fair exchange protocols. Based on a modified (2,2) secret sharing scheme, a concrete non-interactive fair exchange e-commerce protocol is designed.

Identity-Based Parallel Key-Insulated Encryption Without Random Oracles: Security Notions and Construction

Lecture Notes in Computer Science, 2006

In this paper, we apply the parallel key-insulation mechanism to identity-based encryption (IBE) ... more In this paper, we apply the parallel key-insulation mechanism to identity-based encryption (IBE) scenarios, and minimize the damage caused by key-exposure in IBE systems. We first formalize the definition and security notions for ID-based parallel key-insulated encryption (IBPKIE) systems, and then propose an IBPKIE scheme based on Water’s IBE scheme. To the best of our knowledge, this is the first IBPKIE scheme up to now. Our scheme enjoys two attractive features: (i) it is provably secure without random oracles; (ii) it not only allows frequent key updating, but also does not increase the risk of helper key-exposure.

Efficient and Proactive Threshold Signcryption

Lecture Notes in Computer Science, 2005

ABSTRACT To make the system more secure and robust, threshold schemes are proposed to avoid singl... more ABSTRACT To make the system more secure and robust, threshold schemes are proposed to avoid single point failure. At the same time, there are more and more applications which utilize the two basic blocks encryption and digital signature to secure message delivery (such as SSL, SSH). Combining the three tools organically leads to an interesting security tool termed as threshold signcryption which can be used in distributed systems especially the mobile networks. In this paper, we present an efficient threshold signcryption scheme. The scheme is designed for an asynchronous network model which may better present practical distributed systems, especially Internet or mobile ad hoc networks. In order to resist mobile attacks, we add proactive property to our scheme. To the best of our knowledge, the proposed scheme is the first threshold signcryption scheme which is noninteractive, proactive and provably secure and works on asynchronous network models.

Analysis and Improvement of an Authenticated Key Exchange Protocol

Lecture Notes in Computer Science, 2011

ABSTRACT In this paper, we analyze and improve an authenticated key exchange protocol named as up... more ABSTRACT In this paper, we analyze and improve an authenticated key exchange protocol named as up which is proposed in a recent paper. We present a key compromise impersonation (KCI) attack and a secret replication (SR) attack against up. In order to formally capture these attacks, a variant of Canetti-Krawczyk model named as vCK model is proposed. Using this variant, we describe a successful KCI attack and a successful SR attack against up. To avoid the attacks, we provide an improved protocol named as up+ by binding the shared secret to the session identifier. up+ is provably secure under the hardness of the Gap Diffie-Hellman problem in the random oracle model. Our improved protocol combines the higher security level with comparable efficiency.

Security Enhancement and Modular Treatment towards Authenticated Key Exchange

Lecture Notes in Computer Science, 2010

We present an enhanced security model for the authenticated key exchange (AKE) protocols to captu... more We present an enhanced security model for the authenticated key exchange (AKE) protocols to capture the pre-master secret replication attack and to avoid the controversial random oracle assumption in the security proof. Our model treats the AKE protocol as two relatively independent modules, the secret exchange module and the key derivation module, and formalizes the adversarial capabilities and security properties for each of these modules. We prove that the proposed security model is stronger than the extended Canetti-Krawczyk model. Moreover, we introduce NACS, a two-pass AKE protocol which is secure in the enhanced model. NACS is practical and efficient, since it reqires less exponentiations, and, more important, admits a tight security reduction with weaker standard cryptographic assumptions. Finally, the compact and elegant security proof of NACS shows that our method is reasonable and effective.

Transitive Signatures Based on Bilinear Maps

The notion of transitive signature, firstly introduced by Micali and Rivest, is a way to digitall... more The notion of transitive signature, firstly introduced by Micali and Rivest, is a way to digitally sign the vertices and edges of a dynamically growing, transitively closed graph. All the previous proposed transitive signature schemes were constructed from discrete logarithm, factoring, or RSA assumption. In this paper, we introduce two alternative realizations of transitive signature based on bilinear maps. The proposed transitive signature schemes possess the following properties: (i) they are provably secure against adaptive chosen-message attacks in the random oracle model; (ii) there are no need for node certificates in our transitive signature schemes, so the signature algebra is compact; (iii) if using Weil pairing, our signature schemes are more efficient than all previous proposed schemes.