Discrete Logarithm

In most currently used public-key cryptographic systems, including those based on the difficulty to either factorize large numbers like the RSA [RSA78] or to extract a discrete logarithm of a large number [Elg85,DH76,US 94], the most time consuming part is modular exponentiation. The base of this computation is modular multiplication. We demonstrate the ability to implement very efficiently public-key cryptographic

Brizolis asked the question: does every prime p have a pair (g,h) such that h is a fixed point for the discrete logarithm with base g? The first author previously extended this question to ask about not only fixed points but also two-cycles, and gave heuristics (building on work of Zhang, Cobeli, Zaharescu, Campbell, and Pomerance) for estimating the number of such pairs given certain conditions on g and h. In this paper we extend these heuristics and prove results for some of them, building again on the aforementioned work. We also make some new conjectures and prove some average versions of the results.

We present group encryption, a new cryptographic primitive which is the encryption analogue of a group signature. It possesses similar verifiability, security and privacy properties, but whereas a group signature is useful whenever we need to conceal the source (signer) within a group of legitimate users, a group encryption is useful whenever we need to conceal a recipient (decryptor) within a group of legitimate receivers. We introduce and model the new primitive and present sucient as well as necessary conditions for its generic implementation. We then develop an ecient novel number theoretic construction for group encryption of discrete logarithms whose complexity is independent of the group size. To achieve this we construct a new public-key encryption for discrete logarithms that satisfies CCA2-key-privacy and CCA2-security in the standard model. Applications of group encryption include settings where a user wishes to hide her preferred trusted third party or even impose a hidden hierarchy of trusted parties, or settings where verifiable well-formed ciphertexts are kept in a untrusted storage server that must be prevented from both learning the content of records as well as analyzing the identities of their retrievers.

This paper deals with proposing an algorithm that can solve DLP in polynomial time in certain groups. It is an extension to the general algorithm proposed by Douglas Long and AviWigderson in their paper " How Discreet is the Discrete Log?", except that the main algorithm proposed in this paper works without needing to find any square roots. The first algorithm proposed is a general purpose algorithm, and solves DLP in the general case, but no method has been located to be able to employ that. The second algorithm solves DLP in specific groups, particularly modulo Fermat Prime or Psuedo Fermat Prime groups. This has been discussed in detail, and can be used readily. It may also be used to reveal a certain number of bits of the exponent in other groups. The exponent-construction based algorithm may also find uses in solving DLP in other groups as well, by checking the coprimality of the exponent (and various functions of the exponent) against the factors of N-1. All exponentiations done in relation to the generator are modular. This does not apply to exponentiation of 2 to define the group size, or the complexity analysis.

In this paper, discrete log-based public-key cryptography is explored. Specifically, we first examine the Discrete Log Problem over a general cyclic group and algorithms that attempt to solve it. This leads us to an investigation of the security of cryptosystems based over certain specific cyclic groups: Fp, F × p , and the cyclic subgroup generated by a point on an elliptic curve; we ultimately see the highest security comes from using E(Fp) as our group. This necessitates an introduction of elliptic curves, which is provided. Finally, we conclude with cryptographic implementation considerations.

Signcryption is an asymmetric cryptographic method that provides simultaneously both message confidentiality and unforgeability at a low computational and communication overhead. In this paper we propose realistic security models for signcryption, which give the attacker power to choose both messages/signcryptexts as well as recipient/sender public keys when accessing the signcryption/unsigncryption oracles of attacked entities. We then show that Zheng's original signcryption scheme is secure in our confidentiality model relative to the Gap Diffie-Hellman problem and is secure in our unforgeability model relative to a Gap version of the discrete logarithm problem. All these results are shown in the random oracle model.

A general technique of batch verification for equality of discrete logarithms is proposed. Examples of batching threshold decryption schemes are presented based on threshold versions of ElGamal and RSA cryptosystems. Our technique offers large computational savings when employed in schemes with a large number of ciphertexts to be decrypted, such as in e-voting or e-auction schemes using threshold decryption. The resulting effect is beneficial for producing more efficient schemes.

We introduce in this paper a new identity-based threshold signature (IBTHS) technique, which is based on a pair of intractable problems, residuosity and discrete logarithm. This technique relies on two difficult problems and offers an improved level of security relative to an on two difficult hard problems. The majority of the denoted IBTHS techniques are established on an individual difficult problem. Despite the fact that these methods are secure, however, a prospective solution of this sole problem by an adversary will enable him/her to recover the entire private data together with secret keys and configuration values of the associated scheme. Our technique is immune to the four most familiar attack types in relation to the signature schemes. Enhanced performance of our proposed technique is verified in terms of minimum cost of computations required by both of the signing algorithm and the verifying algorithm in addition to immunity to attacks. 1. INTRODUCTION In 1971, the idea of digital signature was first presented by Diffie and Helman [1] that enabled a signer in possession of a secrete key to sign a message, while anybody using a public key could perform verification of the signature. The notion of threshold signatures was presented by Desmedt [2] in 1987. A secret key, and correspondingly, the signing power, is shared to a collection of players in a (,) threshold signature scheme, where this is accomplished in a manner that any subset of players is able to collectively deliver a signature on the account of the group, whereas a subset composed of up to −1 players is incapable. The threshold signature is fundamental yet of a great significance cryptographic scheme that is due to its bifold function: by boosting the opportunity of the signing agency while simultaneously improving the safeguarding process against fraudulence through completing the learn process of the secret signature key for the antagonist. Subsequent to Desmedt's creation, in the commonly-named threshold cryptography domain, several threshold signature approaches incorporated on diverse premise were formulated, such as [3-8]. In order to streamline key management processes in certificate based public key setting, Shamir [9] in 1984, called for identity-based (ID-based) encryption and signature methods. Thenceforth, in the scope of this commonly-named ID-based cryptography, scores of identity-based cryptography techniques were put forward, such as the works of [10, 11]. The remarkably prominent tool has proposed bilinear pairing [10] in constructing identity-based cryptography primitives, where ID-based could be substituted for certificate-based in public key setting. This is of a special interest particularly when there is a requirement for efficient key management while moderate security is needed. The entire developed literature put forward on ID-based threshold group signature contains approaches that rely on an individual hard problem such as factoring,

Secure information sharing has become very popular in immigration, military applications, healthcare, education and foreign affairs for the past few years. The security and privacy of such type of information cannot easily be compromised because the secure communication utilizes both wireless and wired communication media for exchanging sensitive information. Voice over IP (VoIP) offers many unique capabilities to its users. An important robust dynamism behind the use of IP telephony is cost savings, especially for businesses with large data networks. By transporting voice traffic over IP-based networks, businesses can decrease or abolish the toll charges related to carrying calls over the Public Switched Telephone Network (PSTN). Session Initiation Protocol (SIP) promises simple and efficient management of multimedia sessions amongst several users. To improve the security, integrity,
authenticity and privacy issues while sharing sensitive information, numerous authentication schemes or set-ofrules have been recommended by different researchers in recent times. These authentication schemes are vulnerable to prospective security flaws e.g. replay attack, masquerading, insider attack, impersonation, password guessing, server spoofing, Denning Sacco and denial-of-service (DoS). Further, these schemes also fail to deliver mutual authentication. Almost, no researcher claims with conviction about a foolproof secure authentication
scheme. This research mainly focuses on designing VoIP system based on SIP scheme that caters all the weaknesses in these schemes having low computation costs and low communication complexity and low storage overhead and shows a significant balance between performance and security. The proposed protocol also offers mutual authentication and reliable information delivery between user and server. A provable formal security analysis for the scheme will also be established mathematically, using BAN logic of authentication.

This paper presents a weakness in the key schedule of the AES candidate HPC (Hasty Pudding Cipher). It is shown that for the HPC version with a 128-bit key, 1 in 256 keys is weak in the sense that it has 230 equivalent keys. An efficient algorithm is proposed to construct these weak keys and the corresponding equivalent keys. If a weak key is used, it can be recovered by exhaustive search trying only 289 keys on average. This is an improvement by a factor of 238 over a normal exhaustive key search, which requires on average 2127 attempts. The weakness also implies that HPC cannot be used in standard constructions for hash functions based on block ciphers. The analysis is extended to HPC with a 192-bit key and a 256-bit key, with similar results. For some other key lengths, all keys are shown to be weak. An example of this is the HPC variant with a 56-bit user key and block length of 128 bits, which can be broken in 231 attempts on average.

We propose a new computational problem called the twin Diffie-Hellman problem. This problem is closely related to the usual (computational) Diffie-Hellman problem and can be used in many of the same cryptographic constructions that are based on the Diffie-Hellman problem. Moreover, the twin Diffie-Hellman problem is at least as hard as the ordinary Diffie-Hellman problem. However, we are able to show that the twin Diffie-Hellman problem remains hard, even in the presence of a decision oracle that recognizes solutions to the problem — this is a feature not enjoyed by the ordinary Diffie-Hellman problem. In particular, we show how to build a certain “trapdoor test” which allows us to effectively answer such decision oracle queries, without knowing any of the corresponding discrete logarithms. Our new techniques have many applications. As one such application, we present a new variant of ElGamal encryption with very short ciphertexts, and with a very simple and tight security proof, in the random oracle model, under the assumption that the ordinary Diffie-Hellman problem is hard. We present several other applications as well, including: a new variant of Diffie and Hellman’s non-interactive key exchange protocol; a new variant of Cramer-Shoup encryption, with a very simple proof in the standard model; a new variant of Boneh-Franklin identity-based encryption, with very short ciphertexts; a more robust version of a password-authenticated key exchange protocol of Abdalla and Pointcheval.

In many cases the security of a cryptographic scheme based on computational Diffie–Hellman does in fact rely on the hardness of the decision Diffie–Hellman problem. In this paper we construct concrete examples of groups where the stronger hypothesis, hardness of the decision Diffie–Hellman problem, no longer holds, while the weaker hypothesis, hardness of computational Diffie–Hellman, is equivalent to the hardness of the discrete logarithm problem and still seems to be a reasonable hypothesis.

A recent surge of research on vehicular ad hoc networks (VANETs) has given us new opportunities and challenges. Aside from safety-related applications, commercial applications also find their way to fully utilize these networks. One of the promising applications is the dissemination of commercial advertisements over VANETs. However, there are uncooperative vehicles that may disrupt the spreading of these advertisements. To encourage cooperation, we want to address proper incentives and security measurements. In this paper, we use Reed-Solomon codes (RS-codes) to construct our incentive scheme and enhance its security by introducing one discrete logarithm representation problem. Our construction yields a secure and practical commercial advertisement dissemination scheme over VANETs.

In 2005, Jao, Miller, and Venkatesan proved that the DLP of elliptic curves with the same endomorhism ring is random reducible under the GRH. In this talk, we discuss a possible generalization of this result to hyperelliptic curves of genus 2 (and 3) defined over a finite field and show the difficulties involved. First, we explain the role of the endomorphism rings of the Jacobian and the polarization. Following the work of Jao, Miller and Venkatesan, we construct isogeny graphs for genus 2 curves. Specifically, we discuss the connection between isogenies and ideal classes in the Jacobian of these curves. This project is research in progress and we describe the current status of this research.

The abstract of the original paper was as follows: We explore some questions related to one of Brizolis: does every prime p have a pair (g,h) such that h is a fixed point for the discrete logarithm with base g? We extend this question to ask about not only fixed points but also two-cycles. Campbell and Pomerance have not only answered the fixed point question for sufficiently large p but have also rigorously estimated the number of such pairs given certain conditions on g and h. We attempt to give heuristics for similar estimates given other conditions on g and h and also in the case of two-cycles. These heuristics are well-supported by the data we have collected, and seem suitable for conversion into rigorous estimates in the future.

We propose a new computational problem called the twin Diffie–Hellman problem. This problem is closely related to the usual (computational) Diffie–Hellman problem and can be used in many of the same cryptographic constructions that are based on the Diffie–Hellman problem. Moreover, the twin Diffie–Hellman problem is at least as hard as the ordinary Diffie–Hellman problem. However, we are able to show that the twin Diffie–Hellman problem remains hard, even in the presence of a decision oracle that recognizes solutions to the problem—this is a feature not enjoyed by the Diffie–Hellman problem, in general. Specifically, we show how to build a certain “trapdoor test” that allows us to effectively answer decision oracle queries for the twin Diffie–Hellman problem without knowing any of the corresponding discrete logarithms. Our new techniques have many applications. As one such application, we present a new variant of ElGamal encryption with very short ciphertexts, and with a very simple and tight security proof, in the random oracle model, under the assumption that the ordinary Diffie–Hellman problem is hard. We present several other applications as well, including a new variant of Diffie and Hellman’s non-interactive key exchange protocol; a new variant of Cramer–Shoup encryption, with a very simple proof in the standard model; a new variant of Boneh–Franklin identity-based encryption, with very short ciphertexts; a more robust version of a password-authenticated key exchange protocol of Abdalla and Pointcheval.

This paper shows some efficient and provably-secure convertible undeniable signature schemes (with both selective conversion and all conversion), in the standard model and discrete logarithm setting. They further satisfy unambiguity, which is traditionally required for anonymous signatures. Briefly, unambiguity means that it is hard to generate a (message, signature) pair which is valid for two different public-keys. In other words, our schemes can be viewed as anonymous signature schemes as well as convertible undeniable signature schemes. Besides other applications, we show that such schemes are very suitable for anonymous auction.

Efficient zero-knowledge proofs of knowledge for group homomorphisms are essential for numerous systems in applied cryptography. Especially, Σ-protocols for proving knowledge of discrete logarithms in known and hidden order groups are of prime importance. Yet, while these proofs can be performed very efficiently within groups of known order, for hidden order groups the respective proofs are far less efficient. This paper shows strong evidence that this efficiency gap cannot be bridged. Namely, while there are efficient protocols allowing a prover to cheat only with negligibly small probability in the case of known order groups, we provide strong evidence that for hidden order groups this probability is bounded below by 1/2 for all efficient Σ-protocols not using common reference strings or the like. We prove our results for a comprehensive class of Σ-protocols in the generic group model, and further strengthen them by investigating certain instantiations in the plain model.