David Galindo

Followers

540

Following

Public Views

Interests

Uploads

Papers by David Galindo

On the security of public key cryptosystems with a double decryption mechanism

Information Processing Letters, 2008

In public key encryption schemes with a double decryption mechanism (DD-PKE), decryption can be d... more In public key encryption schemes with a double decryption mechanism (DD-PKE), decryption can be done in either of two ways: by the user owning the secret/public key pair corresponding to the ciphertext, or by a trusted party holding a sort of master secret-key. In this note we argue that the classical security notion for standard public key encryption schemes does not suffice for DD-PKE schemes, and propose a new natural definition. Additionally, we illustrate the usefulness of the new security definition by showing that a DD-PKE scheme presented in the workshop Selected Areas in Cryptography 2005 is insecure under this augmented security notion.

Download

A Generic Construction for Token-Controlled Public Key Encryption

Token-controlled public key encryption (TCPKE) schemes, introduced in [1], offer many possibiliti... more Token-controlled public key encryption (TCPKE) schemes, introduced in [1], offer many possibilities of application in financial or legal scenarios. Roughly speaking, in a TCPKE scheme messages are encrypted by using a public key together with a secret token, in such a way that the receiver is not able to decrypt this ciphertext until the token is published or released. The communication overhead for releasing the token is small in comparison with the ciphertext size. However, the fact that the same ciphertext could decrypt to different messages under different tokens was not addressed in the original work. In our opinion this is an essential security property that limits the use of this primitive in practice. In this work, we formalize this natural security goal and show that the schemes in [1]are insecure under this notion. In the second place, we propose a very simple and efficient generic construction of TCPKE schemes, starting from any trapdoor partial one-way function. This construction is obtained from a slight but powerful modification of the celebrated Fujisaki-Okamoto transformation [7]. We prove that the resulting schemes satisfy all the required security properties, in the random oracle model. Previous to this work, only particular instantiations of TCPKE schemes were proposed.

Download

Breaking and Repairing Damgård et al. Public Key Encryption Scheme with Non-interactive Opening

We show a simple chosen-ciphertext attack against a public key encryption scheme with non-interac... more We show a simple chosen-ciphertext attack against a public key encryption scheme with non-interactive opening (PKENO) presented by Damgård, Kiltz, Hofheinz and Thorbek in CT-RSA 2008. In a PKENO scheme a receiver can convincingly reveal to a verifier what the result of decrypting a ciphertext C is, without interaction and without compromising the confidentiality of non-opened ciphertexts. A special interesting feature of PKENO is that a verifier can even ask for opening proofs on invalid ciphertexts. Those opening proofs will convince the verifier that the ciphertext was indeed invalid. We show that one of the schemes by Damgård et al. does not achieve the claimed security goal. Next we provide a fix for it. The repaired scheme presents essentially no overhead and is proven secure under the Decisional Bilinear Diffie-Hellman assumption in the standard model.

Evaluating elliptic curve based KEMs in the light of pairings

Several efforts have been made recently to put forward a set of cryptographic primitives for publ... more Several efforts have been made recently to put forward a set of cryptographic primitives for public key encryption, suitable to be standardized. In two of them (in the first place the NESSIE european evaluation project, already finished, and in the second place the standardisation bodies ISO/IEC), the methodology by Victor Shoup for hybrid encryption, known as Key Encapsulation Method-Data Encapsulation Mechanism (KEM-DEM), has been accepted. In this work we re-evaluate the elliptic curve based KEMs studied to become standards, which are called ACE-KEM, ECIES-KEM and PSEC-KEM. Their security is based on different assumptions related to the elliptic curve discrete logarithm (ECDL) problem on a random elliptic curve. First of all, we fix some inexact results claimed in the previous literature. As a consequence, the performance features of PSEC-KEM are dramatically affected. In second place, we analyse both their security properties and performance when elliptic curves with computable bilinear maps (pairing curves for short) are used. It turns out that these KEMs present a very tight security reduction to the same problem, namely the ECDH problem on such curves; moreover, one can even relate their security to the ECDL problem in certain curves with a small security loss. It is also argued that ECIES-KEM arises as the best option among these KEMs when pairing curves are used. This is remarkable, since NESSIE did not include ECIES-KEM over a random curve in its portfolio of recommended cryptographic primitives. It is concluded that for medium security level applications, which is likely the case for many embedded systems (e.g. smart cards), implementing these KEMs over pairing curves should be considered a very reasonable option.

Download

Breaking Yum and Lee Generic Constructions of Certificate-Less and Certificate-Based Encryption Schemes

Identity-based public key cryptography is aimed at simplifying the management of certificates in ... more Identity-based public key cryptography is aimed at simplifying the management of certificates in traditional public key infrastructures by means of using the identity of a user as its public key. The user must identify itself to a trusted authority in order to obtain the secret key corresponding to its identity. The main drawback of this special form of public key cryptography is that it is key escrowed. Certificate-based and certificate-less cryptography have been recently proposed as intermediate paradigms between traditional and identity-based cryptography, seeking to simplify the management of certificates while avoiding the key escrow property of identity-based cryptography. In this work we cryptanalyse the certificate-based and certificate-less encryption schemes presented by Yum and Lee at EuroPKI 2004 and ICCSA 2004 conferences.

A Practical Public Key Cryptosystem from Paillier and Rabin Schemes

We propose a practical scheme based on factoring and semantically secure (IND-CPA) in the standar... more We propose a practical scheme based on factoring and semantically secure (IND-CPA) in the standard model. The scheme is obtained from a modi.cation of the so called RSA-Paillier [5] scheme. This modification is reminiscent of the ones applied by Rabin [22] and Williams [25] to the well-known RSA cryptosystem. Thanks to the special properties of such schemes, we obtain efficiency similar to that of RSA cryptosystem, provably secure encryption (since recovering plaintext from ciphertext is as hard as factoring) and indistinguishability against plaintext attacks. We also construct a new trapdoor permutation based on factoring, which has interest on its own. Semantic security of the scheme is based on an appropiate decisional assumption, named as Decisional Small 2e-Residues assumption. The robustness of this assumption is also discussed. Compared to Okamoto-Uchiyama's scheme [18], the previous IND-CPA cryptosystem in the standard model with onewayness based on factoring, our scheme is drastically more efficient in encryption, and presents higher bandwith, achieving the same expansion factor as Paillier or El Gamal schemes. We believe the new scheme could be an interesting starting point to develop efficient IND-CCA schemes in the standard model with one-wayness based on factoring.

Download

An efficient semantically secure elliptic curve cryptosystem based on KMOV scheme

... cryptosystem based on KMOV David Galindo, Sebasti`a Martın, Paz Morillo and Jorge L. Villar D... more

Improved certificate-based encryption in the standard model

Journal of Systems and Software, 2008

Certificate-based encryption has been recently proposed as a means to simplify the certificate ma... more Certificate-based encryption has been recently proposed as a means to simplify the certificate management inherent to traditional public key encryption. In this paper, we present an efficient certificate-based encryption scheme which is fully secure in the standard model. Our construction is more efficient (in terms of computational cost and ciphertext size) than any of the previous constructions known without random

Fujisaki-Okamoto IND-CCA hybrid encryption revisited

At Crypto&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp... more At Crypto&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;#39;99, Fujisaki and Okamoto (10) presented a nice generic transfor- mation from weak asymmetric and symmetric schemes into an IND-CCA hybrid encryption scheme in the Random Oracle Model. From this transformation, two specific candidates to standardization were designed: EPOC-2 (9) and PSEC- 2 (16), based on Okamoto-Uchiyama and El Gamal primitives, respectively. Since then, several cryptanalysis of EPOC have

An ecient semantically secure elliptic curve cryptosystem based on KMOV

We propose an elliptic curve scheme over the ring Z n 2 , which is efficient and semantically sec... more We propose an elliptic curve scheme over the ring Z n 2 , which is efficient and semantically secure in the standard model. There appears to be no previous elliptic curve cryptosystem based on factoring that enjoys both of these properties. The KMOV scheme has been used as an underlying primitive to obtain efficiency and probabilistic encryption. Semantic security of the scheme is based on a new decisional assumption, namely, the Decisional Small-x e-Multiples assumption. Confidence on this assumption is also discussed.

Download

Fujisaki-Okamoto hybrid encryption revisited

International Journal of Information Security, 2005

At Crypto’99, Fujisaki and Okamoto [11] presented a generic transformation from weak secure asymm... more At Crypto’99, Fujisaki and Okamoto [11] presented a generic transformation from weak secure asymmetric and symmetric schemes into an IND-CCA hybrid encryption scheme in the Random Oracle Model, which has been extensively used in several cryptographic scenarios. The work we present here forms part of the careful revision of the provable security techniques initiated by Shoup in [25] insofar as we find some ambiguities in the proof of this generic conversion, which can lead to false claims. Consequently, the original conversion is modified and the class of asymmetric primitives that can be used is shortened. Furthermore, the concept of easily verifiable primitive is formalized, showing its connection with the gap problems introduced in [18]. Using these ideas, a completely new security proof for the modified transformation is given, which is phrased using currently widely accepted techniques. The reduction thereby obtained turns out to be tight, enhancing the concrete security claimed in the original work for the easily verifiable primitives. For the remaining primitives, the concrete security is improved at the cost of stronger assumptions. Finally, the resistance of the new conversion against reject timing attacks is addressed.

Download

An IND-CPA cryptosystem from Demytko's primitive

We propose an elliptic curve scheme over the ring Z n 2 , which is efficient and semantically sec... more We propose an elliptic curve scheme over the ring Z n 2 , which is efficient and semantically secure in the standard model. It is based on factoring, and it has expansion factor 2 (previous schemes with these features present expansion factors greater or equal than 4). Demytko's primitive has been used to obtain efficiency and probabilistic encryption. Semantic security of this scheme is based on a new decisional assumption, namely, the Decisional Small Root Assumption. Confidence on this assumption is also discussed.

Download

Boneh-Franklin Identity Based Encryption Revisited

The first practical identity based encryption (IBE) scheme was proposed by Boneh and Franklin in ... more The first practical identity based encryption (IBE) scheme was proposed by Boneh and Franklin in [BF03]. In this work we point out that there is a flawed step in the security reduction exhibited by the authors. Fortunately, it is possible to fix it without changing the scheme or the underlying assumption. In the second place, we introduce a variant of the seminal IBE scheme which allows a more efficient security reduction. This variant is simpler, and has more compact ciphertexts than Boneh-Franklin’s proposal, while keeping the computational cost. Finally, we observe that the flawed step pointed out here is present in several works, and that our techniques can be applied to obtain tighter reductions for previous relevant schemes.

Computational Soundness of Non-Malleable Commitments

This paper aims to find a proper security notion for commitment schemes to give a sound computati... more This paper aims to find a proper security notion for commitment schemes to give a sound computational interpretation of symbolic commitments. We introduce an indistinguishability based security definition of commitment schemes that is equivalent to non-malleability with respect to commitment. Then, we give a construction using tag-based encryption and one-time signatures that is provably secure assuming the existence of trapdoor permutations. Finally, we apply this new machinery to give a sound interpretation of symbolic commitments in the Dolev-Yao model while considering active adversaries.

Download

The Exact Security of Pairing Based Encryption and Signature Schemes

Bilinear pairings have been intensively used in the design of cryptographic protocols during the ... more Bilinear pairings have been intensively used in the design of cryptographic protocols during the last few years. For instance, short signatures and non-interactive key exchange protocols have been designed with them, and they appear as a key component for identity-based cryptography. Focusing on encryption and signature schemes built on bilinear pairings, we look at the security reductions of some known constructions. For any pair "scheme/security reduction", we deduce key sizes to securely implement the schemes. It turns out that some important protocols in the literature appear to be not as efficient as one would wish, due to the lack of tightness of their security reductions. Finally, we summarize current trends to obtain tight security reductions and suggest some open problems.

Download

On the Generic Construction of Identity-Based Signatures with Additional Properties

It has been demonstrated by Bellare, Neven, and Namprempre (Eurocrypt 2004) that identity-based s... more It has been demonstrated by Bellare, Neven, and Namprempre (Eurocrypt 2004) that identity-based signature schemes can be constructed from any PKI-based signature scheme. In this paper we consider the following natural extension: is there a generic construction of “identity-based signature schemes with additional properties” (such as identity-based blind signatures, verifiably encrypted signatures, ...) from PKI-based signature schemes with the same properties? Our results show that this is possible for great number of properties including proxy signatures; (partially) blind signatures; verifiably encrypted signatures; undeniable signatures; forward-secure signatures; (strongly) key insulated signatures; online/offline signatures; threshold signatures; and (with some limitations) aggregate signatures. Using well-known results for PKI-based schemes, we conclude that such identity-based signature schemes with additional properties can be constructed, enjoying some better properties than specific schemes proposed until know. In particular, our work implies the existence of identity-based signatures with additional properties that are provably secure in the standard model, do not need bilinear pairings, or can be based on general assumptions.

Download

A Schnorr-Like Lightweight Identity-Based Signature Scheme

The use of concatenated Schnorr signatures [Sch91] for the hierarchical delegation of public keys... more The use of concatenated Schnorr signatures [Sch91] for the hierarchical delegation of public keys is a well-known technique. In this paper we carry out a thorough analysis of the identity-based signature scheme that this technique yields. The resulting scheme is of interest since it is intuitive, simple and does not require pairings. We prove that the scheme is secure against existential forgery on adaptive chosen message and adaptive identity attacks using a variant of the Forking Lemma [PS00]. The security is proven in the Random Oracle Model under the discrete logarithm assumption. Next, we provide an estimation of its performance, including a comparison with the state of the art on identity-based signatures. We draw the conclusion that the Schnorrlike identity-based signature scheme is arguably the most efficient such scheme known to date.

Download

Estudio Sobre Los Dones Espirituales

INTRODUCCION: La ignorancia no es ninguna bendición. ¿Quién necesita saber acerca de los dones es... more

Download

David Galindo

Uploads

Papers by David Galindo

Log In