Identity-based key agreement protocols from pairings

Abstract

In recent years, a large number of identitybased key agreement protocols from pairings have been proposed. Some of them are elegant and practical. However, the security of this type of protocol has been surprisingly hard to prove, even in the random oracle model. The main issue is that a simulator is not able to deal with reveal queries, because it requires solving either a computational problem or a decisional problem, both of which are generally believed to be hard (i.e., computationally infeasible). The best solution so far for security proofs uses the gap assumption, which means assuming that the existence of a decisional oracle does not change the hardness of the corresponding computational problem. The disadvantage of using this solution to prove security is that such decisional oracles, on which the security proof relies, cannot be performed by any polynomial time algorithm in the real world, because of the hardness of the decisional problem. In this paper we present a method incorporating a built-in decisional function into the protocols. The function transfers a hard decisional problem in the proof to an easy decisional problem. We then discuss the resulting efficiency of L. Chen the schemes and the relevant security reductions, in the random oracle model, in the context of different pairings one can use. We pay particular attention, unlike most other papers in the area, to the issues which arise when using asymmetric pairings.

An efficient certificateless blind signature scheme without bilinear pairing

“…Theoretical analyses (Chen et al 2007) and experimental results (Cao and Kou 2010) (He et al 2011a, 2012b demonstrate that the computation costs of a bilinear pairing operation, a modular exponentiation operation and a bilinear pairing-based scale multiplication operation are about 19, 3 and 3 times of that of a ECCbased scale multiplication operation. Therefore, we could get that the computational cost of the Sign algorithm in the proposed scheme is 60%, 54.55% and 10.71% of that in Sun et al's CLBS scheme (Sun and (Zhang et al 2011) separately.…”

“…However, the bilinear pairing operation is very complicated. Theoretical analysis (Chen et al 2007) (Hankerson et al 2004) and experimental results (Cao and Kou 2010) (He et al 2011a(He et al , 2012b demonstrate that the computation cost of a bilinear pairing operation is similar to that of a dozen or so elliptic curve scalar multiplication operations. Therefore, the performance of those CLBS schemes is not very satisfactory and CLBS scheme without bilinear pairing is required for practical applications.…”

On the Importance of Public-Key Validation in the MQV and HMQV Key Agreement Protocols

“…Kunz-Jacques et al [15] showed that the zero-knowledge proof proposed in [4] for proving possession of discrete logarithms in groups of unknown order can be broken if a dishonest verifier selects invalid parameters during its interaction with the prover. More recently, Chen, Cheng and Smart [7] illustrated the importance of public-key validation in identity-based key agreement protocols that use bilinear pairings.…”

Blind Identity-Based Encryption and Simulatable Oblivious Transfer

“…In our schemes, we will require that the correctness of these parameters be publicly verifiable (Chen et al [CCS07] describe efficient techniques for verifying these parameters in a typical instantiation). We will refer to the following complexity assumption made in these groups.…”

“…In the case of blind IBE schemes Π 1 and Π 2 , we implement this check by first verifying the group parameters γ are valid (see [CCS07]), then verifying that for any params and C = (X, Y, Z), all the values are in the correct groups and the following relation holds:…”