免憑證密碼學機制之研究

免憑證式公開金鑰密碼學(CL-PKC)可同時解決兩個公開金鑰密碼學(PKC)中重要的問題。第一個問題是以身份為基礎密碼學(ID-PKC)中的金鑰託管(key escrow)問題，另一個問題是在傳統公開金鑰密碼學(PKC)中憑證的需求問題。在過去，免憑證式公開金鑰密碼學引發眾多研究學者的注意，同時亦有許多密碼學機制被提出，包括免憑證式加密(CLE)和簽章(CLS)。公開金鑰密碼學中的兩個主要基礎機制就是簽章及加密，然而，如何改善上述密碼學機制之安全性及增加其應用領域之研究議題；如可撤銷性質(可撤銷的短簽章)、強健的安全性(強健不可偽造without random oracle)和免憑證式加密的應用(匿名多接收者的加密)等議題則很少被研究討論。在本論文中，我們首先在random oracle model下提出一個可撤銷免憑證式短簽章(RCLSS)機制；我們的機制採用公開管道的撤銷機制去撤銷非法或逾期的使用者，並且擁有低通訊頻寬優勢。隨後，為了改善免憑證式簽章的安全性，我們在無需random oracle 的模式下(或稱without random oracle下)，提出一個安全的免憑式證簽章機制，同時，我們證明我們的免憑證式簽章機制在可調整式選擇明文(adaptive chosen-message)攻擊下，擁有強健不可偽造(strong unforgeability)。此外，我們延伸免憑證式加密機制，提出一個匿名多接收者的免憑證式加密機制(AMCLE)，這個AMCLE機制具備接收者匿名性及多名接收者特性。在我們的AMCLE機制中，每個使用者的解密計算量是固定，而且和接收者的人數是獨立的；並在相關的假設及攻擊model下，我們證明我們所提出的AMCLE機制是安全。然而許多過去所提出的免憑證式簽章，其安全性是植基於質因數分解(integer factorization)或離散對數(discrete logarithm)的難題；而這兩個難題在未來會被量子電腦(quantum computer)所破解，所以安全性植基於這兩個難題的免憑證式簽章會變得不安全。幸運地，植基於晶格的密碼學(lattice-based cryptography)是可以抵擋量子攻擊之後量子密碼學(post-quantum cryptography)中的一個重要方法。在本論文中，我們提出一個在晶格上可撤銷憑證式簽章(RCLS)機制，同時，植基在晶格上的短整數解(short integer solution, SIS)假設，我們證明所提出的可撤銷憑證式簽章(RCLS)機制，在可調整式選擇明文攻擊下，具備存在不可偽造(existential unforgeability)。

關鍵字

免憑證式簽章；短簽章；撤銷；強健不可偽造；標準模式；匿名性；免憑證式加密；多個接收者；晶格；短整數解

並列摘要

Certificateless public-key cryptography (CL-PKC) was introduced to simultaneously solve two important problems in public-key cryptographies (PKC). One is the key escrow problem in ID-based public-key cryptography (ID-PKC) and the other is to eliminate the need of certificates in traditional PKC. In the past, the study of CL-PKC has received significant attention from researchers and numerous cryptographic primitives have been presented such as certificateless encryption (CLE) and certificateless signature (CLS). Indeed, the main cryptographic primitives of the PKC are signatures and encryptions. However, to improve the security and to increase the application of above cryptographic primitives, there was little work on several important topics and applications such as revocable property (revocable short signature), strong security (strong unforgeability without random oracle) and CLE application (anonymous multireceiver encryption). In the thesis, we first present an efficient revocable certificateless short signature (RCLSS) scheme in the random oracle model, which provides a public revocation mechanism to revoke misbehaving/compromised users and enjoys low communication bandwidth. Then, to improve the security of CLS schemes, we propose a secure CLS scheme without random oracles under the generally adopted security model. Meanwhile, we demonstrate that our CLS scheme possesses strong unforgeability under adaptive chosen-message attacks. Moreover, we extend the CLE schemes and address the issue on both receiver anonymity and multireceiver to propose anonymous multireceiver certificateless encryption (AMCLE) scheme, in which the required decryption cost of each receiver is constant and independent of the number of receivers. Under related assumptions and adversary models, we formally prove that the proposed schemes mentioned above are semantically secure. However, the security of the mostly previous CLS schemes is based on the hardness of integer factorization or discrete logarithm problems. These two problems would be solved by quantum computers in the future so that the signature schemes based on them will also become insecure. Fortunately, lattice-based cryptography is one of the main candidates for post-quantum cryptography. In this thesis, we address the revocation problem and propose the first revocable CLS (RCLS) scheme over lattices. Based on the short integer solution (SIS) assumption over lattices, we demonstrate that our lattice-based RCLS scheme possesses existential unforgeability against adaptive chosen message attacks.

並列關鍵字

Certificateless signature ； Short signature ； Revocation ； Strong unforgeability ； Standard model ； Anonymity ； Certificateless encryption ； Multireceiver ； Lattice ； SIS assumption

參考文獻

[1] Al-Riyami, S.S., Paterson, K.G.: Certificateless public key cryptography. In: Proceedings of ASIACRYPT’03, LNCS 2894, pp. 452–473, 2003.

Google Scholar

[2] Baek, J., Safavi-Naini, R., Susilo, W.: Efficient multi-receiver identity-based encryption and its application to broadcast encryption. In: Proceedings of PKC’05, LNCS 3386, pp.380–397, 2005.