Zero-knowledge password policy checks (ZKPPC) were introduced in Kiefer and Manulis’ report from 2014. The protocol aimed to solve the longstanding issue with servers requiring clients to provide their password in plain text to ensure its strength. Their protocol was intended to eliminate the need for users to trust the server to store and handle passwords correctly while simultaneously allowing the server to know that the registered password was strong enough. This thesis has investigated the soundness of the protocol by Kiefer and Manulis and will present three new zero-day vulnerabilities discovered in the process. The vulnerabilities allow a dishonest user to prove adherence to the policy for invalid passwords. Additionally, the thesis presents our new Proof of Inequality which prevents one of these vulnerabilities, as well as an extension for an incomplete part of the protocol. The two remaining zero-day vulnerabilities are weaknesses in the protocol left for future research.
Identity-based mutual authentication and key agreement (ID-MAKA) between a mobile user and cloud service provider is necessary for accessing any cloud services. In recent years, there are a large number of ID-MAKA schemes had been proposed on mobile cloud computing services to make authentication and accessing process more usability, security, and scalability. In this paper, we propose a new ID-MAKA scheme for mobile cloud computing, which firstly achieves remote biometric-based authentication(remote servers authenticate user's biometrics), single sign-on (a single credential and single registration for accessing multiple servers) and center-less authentication(the registration center does not participate in the access procedure) in one scheme. In order to realize this target, we design a ZK-token based on ECC and cryptographic hash function, and then artfully employ it to introduce the fuzzy extractor technology and zero-knowledge technology into our scheme. Therefore, the user can access multiple cloud computing servers by registering only once in the registration center, and cloud computing servers can complete the biometric-based remote authentication and key agreement for the user without the registration center participating. In this way, our scheme greatly improves usability, scalability, and security compared to other existing solutions. We give a formal security proof for our scheme by using Real-Or-Random(RoR) model and Burrows-Abadi-Needham (BAN) logic to show that the present scheme is secure and security analysis for other known attacks. Finally, according to the experiment result, our scheme has lower computation and communication cost compared with most existing related schemes.
In order to deploy a secure WLAN mesh network, authentication of both users and APs is needed, and a secure authentication mechanism should be employed. However, some additional configurations of trusted third party agencies are still needed on-site to deploy a secure authentication system. This paper proposes a new block chain-based authentication protocol for WLAN mesh security access, to reduce the deployment costs and resolve the issues of requiring key delivery and central server during IEEE 802.11X authentication. This method takes the user’s authentication request as a transaction, considers all the authentication records in the mesh network as the public ledger and realizes the effective monitoring of the malicious attack. Finally, this paper analyzes the security of the protocol in detail, and proves that the new method can solve the dependence of the authentication node on PKI and CA.
We propose a cryptographic protocol with zero-knowledge proof (ZKP) on elliptic curves (EC) using public keys and random messages, allowing to establish the truth of a statement not conveying any additional information about the statement itself. The cryptographic protocols based on zero-knowledge proof allow identification, key exchange and other cryptographic operations to be performed without leakage of sensitive information during the information exchange. The implementation of the cryptographic protocol of the zero-knowledge proof on the basis of the mathematical apparatus of elliptic curves allows to significantly reduce the size of the protocol parameters and increase its cryptographic strength (computational complexity of the breaking). The security of cryptosystems involving elliptic curves is based on the difficulty of solving the elliptic curve discrete logarithm problem. We determine the completeness and correctness of the protocol and give an example of the calculation is given. The cryptographic protocol was modeled in the High-Level Protocol Specification Language, the model validation and verification of the protocol were also performed. The software verification of the cryptographic protocol was performed using the software modules On the Fly Model Checker and Constraint Logic based Attack Searcher. In order to validate the cryptographic protocol resistance to intruder attacks, we used the Security Protocol Animator package for Automated Validation of Internet Security Protocols and Applications. The security of the proposed cryptographic protocol ZKP EC is based on the difficulty of solving the elliptic curve discrete logarithm problem). The recommended elliptical curves according to DSTU 4145-2002 may be used to implement such cryptographic protocol.
Two-factor authentication (2FA) is widely prevalent in banking, emails and virtual private networks (VPN) connections or in accessing any secure web service. In 2FA, to get authenticated the users are expected to provide additional secret information along with the password. Typically, this secret information (tokens) is generated by a centralized trusted third party upon receiving an authentication request from users. Thus, this additional layer of security comes at the cost of inherently trusting the third party for their services. The security of such authentication systems is always under the threat of the trusted party is being compromised. In this paper, we propose a novel approach to make server authentication even more secure by building 2FA over the blockchain platform which is distributed in nature. The proposed solution does not require any trusted third party between claimant (user) and the verifier (server) for the authentication purpose. To demonstrate the idea of using blockchain technology for 2FA, we have added an extra layer of security component to the OpenSSH server a widely used application for Secure Shell (SSH) protocol.
Blockchain is a distributed ledger, which is protected against malicious modifications by means of cryptographic tools, e.g. digital signatures and hash functions. One of the most prominent applications of blockchains is cryptocurrencies, such as Bitcoin. In this work, we consider a particular attack on wallets for collecting assets in a cryptocurrency network based on brute-force search attacks. Using Bitcoin as an example, we demonstrate that if the attack is implemented successfully, a legitimate user is able to prove that fact of this attack with a high probability. We also consider two options for modification of existing cryptocurrency protocols for dealing with this type of attacks. First, we discuss a modification that requires introducing changes in the Bitcoin protocol and allows diminishing the motivation to attack wallets. Second, an alternative option is the construction of special smart-contracts, which reward the users for providing evidence of the brute-force attack. The execution of this smart-contract can work as an automatic alarm that the employed cryptographic mechanisms, and (particularly) hash functions, have an evident vulnerability.
Muhammed F. Esgin, Ron Steinfeld, Joseph K. Liu, Dongxi Liu
We devise new techniques for design and analysis of efficient lattice-based zero-knowledge proofs (ZKP). First, we introduce one-shot proof techniques for non-linear polynomial relations of degree \(k\ge 2\), where the protocol achieves a negligible soundness error in a single execution, and thus performs significantly better in both computation and communication compared to prior protocols requiring multiple repetitions. Such proofs with degree \(k\ge 2\) have been crucial ingredients for important privacy-preserving protocols in the discrete logarithm setting, such as Bulletproofs (IEEE S&P ’18) and arithmetic circuit arguments (EUROCRYPT ’16). In contrast, one-shot proofs in lattice-based cryptography have previously only been shown for the linear case (\(k=1\)) and a very specific quadratic case (\(k=2\)), which are obtained as a special case of our technique.
In ID-based user authentications, a privacy problem can occur, since the service provider (SP) can accumulate the user's use history from the user ID. As a solution to that problem, group signatures are researched. One of important issues in the group signatures is the user revocation. Previously, an efficient revocable scheme with signing/verification of constant complexity was proposed. In this scheme, users are managed by a binary tree, and a list of revoked user information, called a revocation list (RL), is used for revocation. However, the scheme suffers from the large RL. Recently, an extended scheme has been proposed, where the RL size is reduced by compressing RL. On the other hand, there is a problem that some overhead occurs in the authentication as a price for reducing the size of RL. In this research, we propose an extended scheme where the authentication is sped up by reducing the number of zero-knowledge proofs. Furthermore, we implemented it on a PC and shows the effectiveness. The verification time is about 30% shorter than the previous scheme.
Public key infrastructure (PKI) is the foundation and core of network security construction. Blockchain (BC) has many technical characteristics, such as decentralization, impossibility of being tampered with and forged, which makes it have incomparable advantages in ensuring information credibility, security, traceability and other aspects of traditional technology. In this paper, a method of constructing PKI certificate system based on permissioned BC is proposed. The problems of multi-CA mutual trust, poor certificate configuration efficiency and single point failure in digital certificate system are solved by using the characteristics of BC distribution and non-tampering. At the same time, in order to solve the problem of identity privacy on BC, this paper proposes a privacy-aware PKI system based on permissioned BCs. This system is an anonymous digital certificate publishing scheme., which achieves the separation of user registration and authorization, and has the characteristics of anonymity and conditional traceability, so as to realize to protect user's identity privacy. The system meets the requirements of certificate security and anonymity, reduces the cost of CA construction, operation and maintenance in traditional PKI technology, and improves the efficiency of certificate application and configuration.
In this paper, we create secure SSL protocol with zero-knowledge proof which proposed an intruder should not be able to substitute false certificates and masquerade as client or sever. We add Zero-Knowledge proof where certificate transfer directly into both parties. The new scheme was shown to be more secure against the known attacks for SSL. This protocol has characteristics which have identification and authentication of both parties when use to SSL handshake protocol.
A key communication technology in smart cities and smart buildings for automation is RFID. Proving the simultaneous presence of a group of RFID-tagged objects is a practical need in many application areas within this domain. Some examples of this include vehicle fleets, smart parking, safety in public places (smart cities), security and access control (smart buildings), and asset location (supply chain system, health care industry). Security, privacy, and efficiency are central issues when designing such a grouping-proof protocol. This work is motivated by Sundaresan et al.'s grouping-proof protocol, which applies zero-knowledge techniques. In this paper, we propose a light, improved version of an offline serial-dependency grouping-proof protocol. Compared to existing grouping-proof protocols, our scheme improves on efficiency, scalability, security, and communication cost. It resists well-known attacks on grouping-proofs including tag/reader anonymity, tracking, forward security, replay, forgery, and message integrity.
The Estonian electronic voting system which is a leading electronic voting system still suffers from universal verifiability issues and may need improvement of its availability. To solve the problems, in this paper we propose a blockchain-based electronic voting system. A blockchain is a distributed database, where the complete data is shared among all participants in the network. A blockchain system by its nature has several advantages that suit an electronic voting system. Its distributed architecture provides high availability to the system because it does not rely on a centralized server. As all participants have complete data, the protocol allows them to verify each block that is appended to the chain. We try to combine the double envelope encryption technique and blockchain technology for our proposed electronic voting system.
Modern communication technologies and cryptographic technologies have pushed social networks into the virtual world, but they have also ensured the real existence of social proximity. In the evaluation of social proximity, some decentralized scenarios require the participants bootstrapping tust, and the existing authentication key exchange scheme can hardly satisfy the above requirements. In this study, we have designed a homomorphic hash and Blockchain based authenticated key exchange protocol with privacy protection, and prove its security under the standard model based on hash one-way, discrete logarithm and Blockchain transaction-level security assumption, and discussed the attack that the proposed scheme can resist. Compared with the existing scheme, the proposed scheme does not need the default Unit of Trust, is safer and more flexible, suitable for the scenarios that require strangers to bootstrap trust.
Aug 1, 2018·2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)
Dimaz Ankaa Wijaya, Joseph K. Liu, Ron Steinfeld, Dongxi Liu
Monero is one of the privacy-preserving cryptocurrencies employing CryptoNote protocol. The privacy features in Monero are provided by cryptographic techniques such as linkable ring signature and one-time public key. Recent studies show that the majority of Monero inputs are traceable prior to mandatory RingCT transaction. After the RingCT was implemented, the problems were mitigated. We propose a novel attack to reduce the anonymity of Monero transactions or even to fully deanonymise the inputs. The proposed protocol can be launched in RingCT protocol and enables multiple attackers to collaborate without trusting each other. The attack scheme can be planted in the existing Monero services without extra fees and without putting the users' money at risk.
Aug 1, 2018·2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)
Authentication and revocation of users in Vehicular Adhoc Networks (VANETS) are two vital security aspects. It is extremely important to perform these actions promptly and efficiently. The past works addressing these issues lack in mitigating the reliance on the centralized trusted authority and therefore do not provide distributed and decentralized security. This paper proposes a blockchain based authentication and revocation framework for vehicular networks, which not only reduces the computation and communication overhead by mitigating dependency on a trusted authority for identity verification, but also speedily updates the status of revocated vehicles in the shared blockchain ledger. In the proposed framework, vehicles obtain their Pseudo IDs from the Certificate Authority (CA), which are stored along with their certificate in the immutable authentication blockchain and the pointer corresponding to the entry in blockchain, enables the Road Side Units (RSUs) to verify the identity of a vehicle on road. The efficiency and performance of the framework has been validated using the Omnet++ simulation environment.
Debiao He, Yudi Zhang, Ding Wang, Kim‐Kwang Raymond Choo
Mobile device and application (app) security are increasingly important, partly due to the constant and fast-paced cyberthreat evolution. To ensure the security of communication (e.g., data-in-transit), a number of identity-based signature schemes have been designed to facilitate authorization identification and validation of messages. However, in many of these schemes, a user's private key may leak when a new signature is generated since the private keys are stored on the device. Seeking to improve the security of the private key, we propose the first two-party distributed signing protocol for the identity-based signature scheme in the IEEE P1363 standard. This protocol requires that two devices separately store one part of the user's private key, and allows these two devices to generate a valid signature without revealing the entire private key of the user. We formally prove that the security of the protocol in the random oracle model. Then, we implement the protocol using the MIRACL library and evaluate the protocol on two mobile devices. Compared with the protocol of Lindell (CRYPTO'17) that uses the zero-knowledge proof for its security, our protocol is more suitable for deployment in the mobile environment.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Kei Leo Brousmiche, Antoine Durand, Thomas Heno, Christian Poulain · 6 authors
The blockchain technology has recently attracted increasing interests in a wide range of use-cases. Among those, the management of vehicles' data and life cycle over a blockchain has sparked various research initiatives on a global scale, with the promise to prevent automobile frauds and to enable more collaborations between the involved stakeholders. In this paper, we investigate the problem of securing and sharing vehicles' data over a consortium blockchain, and we describe the architecture of the implemented proof-of-concept. Then, we introduce a novel hybrid cryptographic protocol to secure the access to vehicles' data between the involved stakeholders. Finally, we discuss the lessons learned acquired from the preliminary trials and we highlight the future research challenges and opportunities.
Voice over Long Term Evolution (VoLTE) technology defines standards to deliver real-time services such as voice and video over LTE based on IP Multimedia Subsystem (IMS) networks. The security implementation in VoLTE is End-to-Access (e2a), which means that the sessions are only encrypted between the mobile terminals and the IMS network. In this paper we propose a new approach for securing End-to-End (e2e) VoLTE media based the Ethereum Blockchain. The solution consists of creating public and private keypairs for VoLTE user equipments (UEs) and storing the public keys in the Ethereum Blockchain. The media is encrypted e2e using the Secure Real Time Protocol (SRTP) protocol with a variety of session key distribution mechanisms. Results showed that the solution implementation has minimal impact on the existing IMS network, and the secure call setup time between two terminals is negligible compared to the original VoLTE setup time.
This paper presents a comprehensive survey of the existing blockchain protocols for the Internet of Things (IoT) networks. We start by describing the blockchains and summarizing the existing surveys that deal with blockchain technologies. Then, we provide an overview of the application domains of blockchain technologies in IoT, e.g., Internet of Vehicles, Internet of Energy, Internet of Cloud, Edge computing, etc. Moreover, we provide a classification of threat models, which are considered by blockchain protocols in IoT networks, into five main categories, namely identity-based attacks, manipulation-based attacks, cryptanalytic attacks, reputation-based attacks, and service-based attacks. In addition, we provide a taxonomy and a side-by-side comparison of the state-of-the-art methods toward secure and privacy-preserving blockchain technologies with respect to the blockchain model, specific security goals, performance, limitations, computation complexity, and communication overhead. Based on the current survey, we highlight open research challenges and discuss possible future research directions in the blockchain technologies for IoT.
This article describes how after the concept of anonymous credential systems was introduced in 1985, a number of similar systems have been proposed. However, these systems use zero-knowledge protocols to authenticate users, resulting in inefficient authentication during the stage of proving credential possession. To overcome this drawback, this article presents a signature scheme that uses partially blind signatures and chameleon hash functions such that both the prover and verifier achieve efficient authentication. In addition to providing a computational cost comparison table showing that the proposed signature scheme achieves a more efficient credential possession proving compared to other schemes, concrete security proofs are provided under a random oracle model to demonstrate that the proposed scheme satisfies the properties of anonymous credentials.