Certificates of Recoverability with Scalable Recovery Agent Security

Abstract

Abstract. We propose new schemes for Certificates of Recoverability (CRs). These consist of a user's public key and attributes, its private key encrypted in such a way that it is recoverable by one or more Key Recovery Agents (KRAs), plus a publicly verifiable proof of this (the actual CR). In the original schemes, the level of cryptographic security employed by the KRA and the users is necessarily the same. In our schemes the level of cryptographic security employed by the KRA can be set higher, in a scalable fashion, than that being employed by the users. Among the other improvements of our schemes are its applicability to create CRs for cryptosystems based on the Discrete Log problem in small subgroups, most notably the Digital Signature Standard and Elliptic Curve Crypto systems. Also, the size of the constructed proofs of knowledge can be taken smaller than in the original schemes. We additionally show several ways to support secret sharing in our scheme. Finally we present several new constructions and results on the hardness of "small parts", in the setting of Diffie-Hellman keys in extension fields.

On the Security of Diffie-Hellman Bits

“…Finally, we remark that somewhat similar problem for extensions of finite fields have been considered in [16]. The results of that paper and some of their improvements in [15] have applications to the security of the new cryptosystem designed in [4,10].…”

Doing More with Fewer Bits

“…It is shown in [16] that Lemma 3.1 is a consequence of a much broader result. To this end, let t > 1 be an integer (t = 6 in the current setting).…”

The XTR Public Key System

“…21.ii states that determining the (small) XTR-DH key is as hard as determining the whole DH key in the representation group g . From the results in [24] it actually follows that determining the image of the XTR-DH key under any non-trivial GF(p)-linear function is also as hard as the whole DH key. This means that, for example, finding the α or the α 2 coefficient of the XTR-DH key is as hard as finding the whole DH key, implying that cryptographic applications may be based on just one of the coefficients.…”

“…In particular the choice p = 2 is an option, which has the property (cf. [24]) that bits of the XTR-DH exchanged key are as hard as the whole key. However, for such very small p one should take into account that they make computation of discrete logarithms easier (cf.…”