Cryptanalysis and improvement of a certificateless encryption scheme in the standard model

Abstract

Certificateless public key cryptography eliminates inherent key escrow problem in identity-based cryptography, and does not yet requires certificates as in the traditional public key infrastructure. In this paper, we give crypt-analysis to Hwang et al.’s certificateless encryption scheme which is the first concrete certificateless encryption scheme that can be proved to be secure against “malicious-but-passive” key generation center (KGC) attack in the standard model. Their scheme is proved to be insecure even in a weaker security model called “honest-but-curious” KGC attack model. We then propose an improved scheme which is really secure against “malicious-but-passive” KGC attack in the standard model.

Keywords

certificateless public key cryptography / standard model / provable security

References

[1] Al-riyami S S, Paterson K G. Certificateless public key cryptography. Lecture Notes in Computer Science, 2003, 2894: 452-473

[2] Shamir A. Identity-based cryptosystems and signature schemes. Lecture Notes in Computer Science, 1985, 196: 47-53

[3] Au M H, Mu Y, Chen J, Wong D S, Liu J K, Yang G. Malicious kgc attacks in certificateless cryptography. In: Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security. 2007, 302-311

[4] Baek J, Safavi-Naini R, Susilo W. Certificateless public key encryption without pairing. In: Proceedings of the 8th International Conference on Information Security. 2005, 134-148

[5] Libert B, Quisouater J J. On constructing certificateless cryptosystems from identity based encryption. Lecture Notes in Computer Science, 2006, 3958: 474-490

[6] Sun Y, Li H. Short-ciphertext and BDH-based CCA2 secure certificateless encryption. Science China Information Sciences, 2010, 53(10): 2005-2015

[7] Bellare M, Rogaway P. Random oracles are practical: a paradigm for designing efficient protocols. In: Proceedings of the 1st ACM Conference on Computer and Communications Security. 1993, 62-73

[8] Yum D H, Lee P J. Generic construction of certificateless encryption. Lecture Notes in Computer Science, 2004, 3043: 802-811

[9] Huang Q, Wong D S. Generic certificateless encryption secure against malicious-but-passive kgc attacks in the standard model. Journal of Computer Science and Technology, 2010, 25(4): 807-826

[10] Hu B C, Wong D S, Zhang Z, Deng X. Key replacement attack against a generic construction of certificateless signature. Lecture Notes in Computer Science, 2006, 4058: 235-246

[11] Liu J K, Au M H, Susilo W. Self-generated-certificate public key cryptography and certificateless signature/encryption scheme in the standard model. In: Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security. 2007, 273-283

[12] Dent A W, Libert B, Paterson K G. Certificateless encryption schemes strongly secure in the standard model. Lecture Notes in Computer Science, 2008, 4939: 344-359

[13] Guo H, Zhang X, Mu Y, Li Z. An efficient certificateless encryption scheme in the standard model. In: Proceedings of the 3rd International Conference on Network and System Security. 2009, 302-309

[14] Hwang Y H, Liu J K, Chow S S. Certificateless public key encryption secure against malicious KGC attacks in the standard model. Journal of Universal Computer Science, 2008, 14(3): 463-480

[15] Zhang G, Wang X. Certificateless encryption scheme secure in standard model. Tsinghua Science & Technology, 2009, 14(4): 452-459

[16] Shen L, Zhang F, Sun Y, Li S. Cryptanalysis of a certificateless encryption scheme in the standard model. In: Proceedings of the 4th International Conference on Intelligent Networking and Collaborative Systems. 2012, 329-333

[17] Dent A W. A survey of certificateless encryption schemes and security models. International Journal of Information Security, 2008, 7(5): 349-377

[18] Cheng Z, Comley R. Efficient certificateless public key encryption. IACR Cryptology Eprint Archive: Report 2005/249, 2005

[19] Huang Q, Wong D S. Generic certificateless encryption in the standard model. In: Proceedings of the 2nd International Conference on Advances in Information and Computer Security. 2007, 278-291

[20] Huang Q, Wong D S. Generic certificateless key encapsulation mechanism. In: Proceedings of the 12th Australasian Conference on Information Security and Privacy. 2007, 215-229

RIGHTS & PERMISSIONS

Higher Education Press and Springer-Verlag Berlin Heidelberg