International Journal of Applied Cryptography (4 papers in press)

• An Efficient One-move Nominative Signature Scheme
  by Qiong Huang, Dennis Y. W. Liu, Duncan S. Wong 
  Abstract: A signer in a Nominative Signature (NS) scheme can arbitrarily choose a nominee, then jointly generate a signature in such a way that the signature can only be verified with the nominee's consent. NS is particularly useful in user certification systems. Currently, the only secure NS scheme available requires multi-round communications between the nominator and the nominee during signature generation. This implies that an NS-based user certification system requires a certification issuer to interact with a user using a complicated multi-round protocol for certificate issuance. It remains an open problem to construct an efficient and non-interactive NS scheme. In this paper, we solve this problem by proposing the first efficient one-move (i.e. non-interactive) NS scheme. In addition, we propose an enhanced security requirement called Strong Invisibility, and prove that our scheme satisfies this strong security requirement.
  Keywords: Digital Signatures; Nominative Signatures
   
• The Layered Games Framework for Specifications and Analysis of Security Protocols
  by Amir Herzberg, Igal Yoffe 
  Abstract: We establish rigorous foundations to the use of modular, layered design for building complex distributed systems, resilient to failures and attacks. Layering is key to the design of the Internet and other distributed systems. Hence, solid, theoretical foundations are essential, especially when considering adversarial settings, such as for security and cryptographic protocols. We use games to define specifications for each layer. A protocol realizes a layer (over some lower layer), if it `wins', with high probability, a specified game, when running over any implementation of the lower layer. This is in contrast to existing frameworks allowing modular design of cryptographic protocols, e.g. Universal Composability [15], where protocols must emulate an ideal functionality. Ideal functionalities are a very elegant method for specifications, but we argue that often, game-based specifications are more appropriate. In particular, it may be hard to design the `correct' ideal functionality, and avoid over-specification (`forcing' the protocol to follow a particular design) and under-specification (e.g., allowing protocols that work reasonably only for worst-case adversary but poorly for realistic adversaries); see details within. Our definitions include the basic concepts for modular, layered design: protocols, systems, configurations, executions, and models. We also define three basic relations: indistinguishability (between two systems), satisfaction (of a model by a system), and realization (by protocol, of one model over another model). We prove several basic properties, including the layering lemma and the indistinguishability lemma. The layering lemma shows that given protocols {\pi_i\}_{i=1}^u, if every protocol \pi_i realizes model M_i over model M_{i-1}, then the composite protocol \pi_{1''...''u} realizes model M_u over M_0. This allows specification, design and analysis of each layer independently, and combining the results to ensure properties of the complete system.
  Keywords: Layered specifications; secure e-commerce layers; composability
   
• Unconditionally Reliable and Secure Message Transmission in Undirected Synchronous Networks: Possibility, Feasibility and Optimality
  by Arpita Patra, Ashish Choudhary, Srinathan Kannan, Pandu Rangan Chandrasekharan 
  Abstract: We study the interplay of network connectivity and the issues related to the possibility, feasibility and optimality for unconditionally reliable message transmission (URMT) and unconditionally secure message transmission (USMT) in an undirected synchronous network, under the influence of an adaptive mixed adversary having unbounded computing power, who can corrupt some of the nodes in the network in Byzantine, omission, fail-stop and passive fashion respectively. In URMT problem, a sender S and a receiver R are part of a distributed network, where S and R are connected by intermediate nodes. S wants to send a message m which is a sequence of ℓ (ℓ  1) field elements from a finite field F to R. The challenge is to design a protocol, such that after interacting in phases as per the protocol, R should be able to obtain m with probability at least 1 − δ, where 0 < δ < 1-2 , irrespective of any adversarial strategy. Here phase is a send from S to R or vice versa. The USMT problem has an additional requirement that adversary should not know anything about m in information theoretic sense. We consider two type of adversary, namely threshold and non-threshold. A threshold adversary, denoted by A(tb,to,tf ,tp) can corrupt up to tb, to, tf and tp intermediate nodes between S and R in Byzantine, omission, fail-stop and passive fashion respectively. On the other hand, a non-threshold adversary is a generalization of threshold adversary and it is specified by an adversary structure A. Each element of A is a 4-tuple of the form (B,O, F,E), where B,O, F and E denotes the potential set of nodes which can be corrupted in Byzantine, omission, fail-stop and passive fashion respectively. One of the important conclusions we arrive at from our study is that allowing a negligible error probability significantly helps in the possibility, feasibility and optimality of both reliable and secure message transmission protocols. To design our protocols, we propose several new techniques which are of independent interest.
  Keywords: Probabilistic Reliabilit; Information Theoretic Security; Mixed Adversary.
   
• On reusing ephemeral keys in Diffie-Hellman key agreement protocols
  by Alfred Menezes, Berkant Ustaoglu 
  Abstract: A party may choose to reuse ephemeral public keys in a Diffie-Hellman key agreement protocol in order to reduce its computational workload or to mitigate against denial-of-service attacks. In this note we show that small-subgroup attacks can be successfully launched on some Diffie-Hellman protocols that reuse ephemeral keys if domain parameters are not appropriately selected or if public keys are not appropriately validated.
  Keywords: key agreement protocols; Diffie-Hellman; cryptography