In this paper, a novel biometric authentication scheme is proposed, which combines zero-knowledge proof, - protocols and bit commitment scheme. The remote server compares biometric template using committed values, this can keep privacy of user's biometrics. To the best knowledge of us, this is the first scheme which uses - protocols as a basic tool to implement biometric authentication. Compared with the previous schemes, this scheme has advantages as higher security, lower computation complexity and privacy keeping of biometric template.
Biometric Identification and Security
User Authentication and Security Systems
Advanced Steganography and Watermarking Techniques
Lalitha Bhavani Jivanadham, A. K. M. Muzahidul Islam, Nafees Mansoor, Sabariah Baharun
Driven by the technology advances in Micro-Electro-Mechanical Systems which has facilitated the development of smart sensors; we have witnessed in recent years the emergence of WSNs in environment, military, surveillance, natural disaster relief, healthcare, etc. These WSNs carry the promise of drastically improving and expanding the quality of services across a wide variety of settings and for different segments of the population. Therefore, it is very important to develop a WSN with robustness and security in mind. Typically, the sensors are smaller in sizes that have limited processing and computational power resources, and are inexpensive, thus enabling the network to have a large coverage area and longer range. By using hundreds or thousands of them it is possible to build a high quality, fault-tolerant sensor network where failure of one or few nodes does not affect the operation of the network. They are also self-configuring or self-organizing. In this paper, we propose formation of a Secured Cluster-based architecture for a Dynamic Wireless Sensor Network that uses two topology management operations: node-move-in and node-move-out. The proposed security protocol integrates one round Zero Knowledge Proof and AES algorithm to apply for node authentication, where only authenticated nodes will be accepted during node-move-in operation. We also show that it requires O(h+q) rounds for a node to join into a network securely, where h is the height of the dynamic cluster-based wireless sensor network and q is the number of neighbouring nodes of a joining node.
In many applications, the password is sent as cleartext to the server to be authenticated thus providing the eavesdropper with opportunity to steal valuable data. This paper presents a simple protocol based on zero knowledge proof by which the user can prove to the authentication server that he has the password without having to send the password to the server as either cleartext or in encrypted format. Thus the user can authenticate himself without having to actually reveal the password to the server. Also, another version of this protocol has been proposed which makes use of public key cryptography thus adding one more level of security to the protocol and enabling mutual authentication between the client & server.
In a traditional (t, n)-threshold secret sharing scheme, t or more honest participants can reconstruct the secret K. In the reconstruction process, the individual shares and the secret key K are revealed, hence K is shared once only. In this paper, we firstly give the definition of leakproof secret sharing scheme which is composed of a distribution protocol and a proof protocol, then propose two leakproof secret sharing protocols, a computationally secure protocol and an information-theoretically secure protocol. In our protocols, t or more participants can jointly prove that they hold the secret K by using a multi-prover zero-knowledge argument of knowledge. As a result, the secret K will be shared for as many times as desired. Furthermore, each participant can detect the dealer in the distribution protocol from cheating, and any verifier can prevent non-qualified set of participants in proof protocol from cheating. As an example of the practical impact of our work we use our techniques to construct group identification schemes with zero-knowledge.
In this thesis we present two new type systems for verifying the security of cryptographic protocol models expressed in a spi-calculus and, respectively, of protocol implementations expressed in a concurrent lambda calculus. In this thesis we present two new type systems for verifying the security of cryptographic protocol models expressed in a spi-calculus and, respectively, of protocol implementations expressed in a concurrent lambda calculus. The two type systems combine prior work on refinement types with union and intersection types and with the novel ability to reason statically about the disjointness of types. The increased expressivity enables the analysis of important protocol classes that were previously out of scope for the type-based analyses of cryptographic protocols. In particular, our type systems can statically analyze protocols that are based on zero-knowledge proofs, even in scenarios when certain protocol participants are compromised. The analysis is scalable and provides security proofs for an unbounded number of protocol executions. The two type systems come with mechanized proofs of correctness and efficient implementations.
George Danezis, Markulf Kohlweiss, Benjamin Livshits, Alfredo Rial
Abstract. Nowadays, service providers gather fine-grained data about users to deliver personalized services, for example, through the use of third-party cookies or social network profiles. This poses a threat both to privacy, since the amount of information obtained is excessive for the purpose of customization, and authenticity, because those methods employed to gather data can be blocked and fooled. In this paper we propose privacy-preserving profiling techniques, in which users perform the profiling task locally, reveal to service providers the result and prove its correctness. We address how our approach applies to tasks of both classification and pattern recognition. For the former, we describe client-side profiling based on random forests, where users, based on certified input data representing their activity, resolve a random forest and reveal the classification result to service providers. For the latter, we show how to match a stream of user activity to a regular expression, or how to assign it a probability using a hidden Markov model. Our techniques, based on the use of zero-knowledge proofs, can be composed with other protocols as part of the certification of a larger computation. 1
Wireless Sensor Networks (WSNs) will provide an excellent opportunity to control environments. Even WSNs have lot of applications, some of them quite sensitive in nature and require full proof secured environment. The wireless security mechanism is not same as in wired networks. Because there is no user-controlling for each individual node, wireless environment, and more importantly, scarce energy resources. In this paper, we propose the 3-round zero knowledge protocol for main problem in sensor network security is that sensors are compromised once; the adversary can easily launch clone attacks by replicating the compromised node, distributing the clones throughout the network, and starting a variety of insider attacks. Previous works against clone attacks suffer from either a high communication/storage overhead or poor detection accuracy. Here, we propose a novel scheme for detecting clone attacks in sensor networks, which computes for each sensor a social fingerprint by extracting the neighbourhood characteristics and verifies the legitimacy of the originator for each message by checking the enclosed fingerprint. The fingerprint generation is based on the superimposed s-disjunct code, which incurs a very light communication and computation overhead. The fingerprint verification is conducted at both the base station and the neighbouring sensors, which ensures a high detection probability. The security and performance analysis indicate that our algorithm can identify clone attacks with a high detection probability at the cost of a low computation/communication/storage overhead. To our best knowledge, our scheme is the first to provide real-time detection of clone attacks in an effective and efficient way.
The three critical resources in any cluster based Wireless Sensor Networks (WSN) are Sensor Nodes (SN), Cluster Head (CH) and Base Station (BS). The main job of Cluster Head is to send all the aggregated data collected from multiple sensor Nodes to the Base Station. But before sending the data, the Cluster Head must be perfectly sure about the actual identity of Base Station. If any intruder acts as Base Station and receives the aggregated data the entire security of the network is spoiled. To avoid this, the authenticity of the base station needs to be checked by cluster head before sending any data. Many asymmetric authentication techniques like digital signatures are difficult to implement in resource constraint sensor Nodes. A zero-knowledge proof protocol is a powerful cryptographic system that can be applied in many cryptographic applications and operations such as identification, authentication, key exchange and others, but many of the existing zero knowledge proof of identity involves exponential calculations which are not suitable for WSN. To overcome the limitations of the existing techniques, the proposed protocol provides Zero knowledge proof identity using congruence equations. Here, Triplet simultaneous linear congruence equations are used to subdivide a whole secret into three shares. A part of a secret is used as identity of the base station and stored in it. The Base Station won't reveal the part of secret stored in it to the Cluster Head but the Cluster Head confirms the true identity without getting the actual secret from Base Station. In this scheme, the Cluster Heads need to solve only congruence equations which need only limited computation and memory. When the proposed protocol is compared with existing protocols it shows that it provide instant authentication, with minimum memory utilization and withstand many attacks.
Experts predict that in the next 10 to 100 years scientists will succeed in creating human-level artificial general intelligence. While it is most likely that this task will be accomplished by a government agency or a large corporation, the possibility remains that it will be done by a single inventor or a small team of researchers. In this paper, we address the question of safeguarding a discovery which could without hesitation be said to be worth trillions of dollars. Specifically, we propose a method based on the combination of zero knowledge proofs and provably AI-complete CAPTCHA problems to show that a superintelligent system has been constructed without having to reveal the system itself.
Sławomir Grzonkowski, Peter Corcoran, Thomas Coughlin
A number of well-known authentication protocols are considered in the context of next-generation mobile and CE network services. The potential weaknesses of current protocols can be overcome using Zero Knowledge Proof (ZKP) techniques to protect user passwords so an alternative ZKP protocol, SeDiCi 2.0, is described. This offers mutual and also two-factor authentication that is considered more secure against various phishing attempts than existing trusted third party protocols. The suitability of such a ZKP protocol for various CE-based cloud computing applications is demonstrated.
A user centric approach to authentication for home networks is proposed. A zero-knowledge-proof (ZKP) authentication is used to leverage the emerging cloud infrastructure allowing users to temporarily transfer their service and content rights within a trusted environment such as a friend's home. This approach enables the sharing of personalized content and more sophisticated network-based services over a conventional TCP/IP infrastructure. Experimental results derived from a reference prototype are presented. These demonstrate the practicality of the underlying approach. The potential to develop new cloud services for "social" home networks is also discussed.
Wireless Sensor Networks (WSNs) offer an excellent opportunity to monitor environments, and have a lot of interesting applications, some of which are quite sensitive in nature and require full proof secured environment. The security mechanisms used for wired networks cannot be directly used in sensor networks as there is no user-controlling of each individual node, wireless environment, and more importantly, scarce energy resources. In this paper, we address some of the special security threats and attacks in WSNs. We propose a scheme for detection of distributed sensor cloning attack and use of zero knowledge protocol (ZKP) for verifying the authenticity of the sender sensor nodes. The cloning attack is addressed by attaching a unique fingerprint to each node, that depends on the set of neighboring nodes and itself. The fingerprint is attached with every message a sensor node sends. The ZKP is used to ensure non transmission of crucial cryptographic information in the wireless network in order to avoid man-in-the middle (MITM) attack and replay attack. The paper presents a detailed analysis for various scenarios and also analyzes the performance and cryptographic strength.
A new watermark embedding and detection method in Microsoft Word 2007-2010 files which use Office Open XML (OOXML) format is proposed in this paper. Watermark information can be imperceptibly embedded into OOXML documents by replacing or adding the values of Revision Identifiers (RIs), which are specific attributes in the main document body of the OOXML document. In the detection process, a secure watermark detection scheme based on zero-knowledge proof is proposed without revealing any watermarking-related information to improve the security of watermarking detection. Experiments show that 4.43 bit is embedded into each word and 0.07 bit is embedded into each bit of the document on average, which is higher than contemporary linguistic watermarking approaches. The method can resist “Format”, “Impersonation”, “Save As”, “Copy” and other active attacks and all these changes will not be shown on the MS Office screen display. Therefore, the proposed method can apply to the field of security protection for OOXML format documents.
Advanced Steganography and Watermarking Techniques
We define a new notion of relatively-sound non-interactive zeroknowledge (NIZK) proofs, where a private verifier with access to a trapdoor continues to be sound even when the Adversary has access to simulated proofs and common reference strings. It is likely that this weaker notion of relative-soundness suffices in most applications that need simulation-soundness. We show that for certain languages whicharediversegroups,and henceallowsmoothprojectivehashfunctions, one can obtain more efficient single-theorem relatively-sound NIZKsas opposed to simulation-sound NIZKs. We alsoshow that such relatively-sound NIZKs can be used to build rather efficient publiclyverifiable CCA2-encryption schemes. By employing this new publicly-verifiable encryption scheme along withanassociatedsmoothprojective-hash,weshowthatarecentPAKmodel single-round password-basedkey exchange protocol of Katz and
Matteo Maffei, Giulio Malavolta, Manuel Reinert, Dominique Schröder
The existing (election) voting systems, e.g., representative democracy, have many limitations and often fail to serve the best interest of the people in collective decision making. To address this issue, the concept of liquid democracy has been emerging as an alternative decision-making model to make better use of "the wisdom of crowds". Very recently, a few liquid democracy implementations, e.g. Google Votes and Decentralized Autonomous Organization (DAO), are released; however, those systems only focus on the functionality aspect, as no privacy/anonymity is considered. In this work, we, for the first time, provide a rigorous study of liquid democracy under the Universal Composability (UC) frame- work. In the literature, liquid democracy was achieved via two separate stages -- delegation and voting. We propose an efficient liquid democracy e-voting scheme that uni es these two stages. At the core of our design is a new voting concept called statement voting, which can be viewed as a natural extension of the conventional voting approaches. We remark that our statement voting can be extended to enable more complex voting and generic ledger-based non-interactive multi-party computation. We believe that the statement voting concept opens a door for constructing a new class of e-voting schemes.
Gilles Barthe, Daniel Hedin, Santiago Zanella-Béguelin, Benjamin Grégoire · 5 authors
Zero-knowledge proofs have a vast applicability in the domain of cryptography, stemming from the fact that they can be used to force potentially malicious parties to abide by the rules of a protocol, without forcing them to reveal their secrets. Σ-protocols are a class of zero-knowledge proofs that can be implemented efficiently and that suffice for a great variety of practical applications. This paper presents a first machine-checked formalization of a comprehensive theory of Σ-protocols. The development includes basic definitions, relations between different security properties that appear in the literature, and general composability theorems. We show its usefulness by formalizing—and proving the security—of concrete instances of several well-known protocols. The formalization builds on CertiCrypt, a framework that provides support to reason about cryptographic systems in the Coq proof assistant, and that has been previously used to formalize security proofs of encryption and signature schemes.
Abhilasha Bhargav-Spantzel, Anna Squicciarini, Elisa Bertino, Xiangwei Kong · 5 authors
We present algorithms to reliably generate biometric identifiers from a user's biometric image which in turn is used for identity verification possibly in conjunction with cryptographic keys. The biometric identifier generation algorithms employ image hashing functions using singular value decomposition and support vector classification techniques. Our algorithms capture generic biometric features that ensure unique and repeatable biometric identifiers. We provide an empirical evaluation of our techniques using 2569 images of 488 different individuals for three types of biometric images; namely fingerprint, iris and face. Based on the biometric type and the classification models, as a result of the empirical evaluation we can generate biometric identifiers ranging from 64 bits up to 214 bits. We provide an example use of the biometric identifiers in privacy preserving multi-factor identity verification based on zero knowledge proofs. Therefore several identity verification factors, including various traditional identity attributes, can be used in conjunction with one or more biometrics of the individual to provide strong identity verification. We also ensure security and privacy of the biometric data. More specifically, we analyze several attack scenarios. We assure privacy of the biometric using the one-way hashing property, in that no information about the original biometric image is revealed from the biometric identifier.
Biometric Identification and Security
Advanced Steganography and Watermarking Techniques
Ali Bagherzandi, Stanisław Jarecki, Nitesh Saxena, Yanbin Lu
We revisit the problem of protecting user’s private data against adversarial compromise of user’s device(s) which would normally store this data. We formalize an attractive solution to this problem as PasswordProtected Secret-Sharing (PPSS), which is a protocol that allows a user to secret-share her data among n trustees in such a way that (1) the user can retrieve the shared secret upon entering a correct password into a reconstruction protocol which succeeds as long as at least t+ 1 honest trustees participate, and (2) the shared data remains secret even against the adversary which corrupts at most t servers, with the level of protection expected of passwordauthentication, i.e. the probability that the adversary learns anything useful about the secret is at most negligibly greater than q/|D| where q is the number of reconstruction protocol instances in which adversary engages and |D| is the size of the dictionary from which the password was randomly chosen. We propose an efficient PPSS protocol in the public key model, i.e. where the device can remember a trusted public key, provably secure under the DDH assumption, using non-interactive zero-knowledge proofs which are efficiently instantiatable in the Random Oracle Model (ROM). The resulting protocol is robust and practical, with fewer than 4t + 12 exponentiations per party, and with only three messages exchanged between the user and each server, implying a single round of interaction in the on-line phase. As a side benefit our PPSS protocol yields a new Threshold Password Authenticated Key Exchange (T-PAKE) protocol in the public key model which is significantly faster than existing T-PAKE’s provably secure in the public key model in ROM.