【作者】 李素娟；

【导师】 张福泰；

【作者基本信息】 南京师范大学 ， 应用数学， 2013， 博士

【摘要】 密码技术可以用来满足信息的保密性、完整性、认证性和不可抵赖性。而传统的分析密码协议安全性的方法,是给攻击者提供一些访问黑盒子预言器的机会,在此过程中,攻击者只能看到他选择的输入经过黑盒子预言器对应的输出是什么,而不能获取秘密密钥的任何信息以及预言器内部的任何秘密状态。显然,这是一种理想化的安全分析方法。实际上,一个密码系统的任何物理实现都会泄漏系统内部的一些信息。通过各种泄漏攻击,攻击者都能够或多或少获取密码系统的秘密密钥以及内部秘密状态。众所周知,公钥加密是现代密码学的重要组成部分,公钥加密技术在实际应用中也发挥着巨大的作用。因此,对现有的公钥加密方案的安全性分析已不能再局限于传统的理想化模型的安全分析方法,必须根据实际所面临的各种泄漏攻击考虑公钥加密方案的安全性问题。由于密钥泄漏攻击是各种泄漏攻击中最核心、最致命的攻击方法,所以,考虑公钥加密体系下容忍密钥泄漏的安全性问题,正是本文所研究的课题。本文主要对各种公钥加密体系下容忍密钥泄漏的加密方案进行了研究,主要取得了以下成果：·在传统公钥加密方面,根据Naor和Segev[93]在2009年美密会上提出的容忍密钥泄漏的Cramer-Shoup公钥加密方面,我们针对[93]提出的CC2安全的CS-LR-PKE2方案给出了一个改进方案。在保证同样的CCA2安全级别的前提条件下,我们在参数长度、计算代价方面进行了效率改进,同时还提高了密钥的相对泄漏比率。·在基于身份的加密方面,-根据Coron的基于身份的加密方案,我们提出了一个容忍密钥泄漏的基于身份的加密方案。在效率和密钥泄漏比率方面,我们的方案与文献[28]类似。但是,在安全性分析方面,我们除了采用传统的归约证明外,还采用了一种新的证明方法,即：在所构建的加密方案中能够找到满足某些信息论属性的基于身份的Hash Proof System结构,那么所构建的加密方案就是容忍密钥泄漏安全的[3]。-为了适应更多实际应用场景,我们在已有的容忍密钥泄漏的基于身份加密方案的基础上,构建了用户可撤销的容忍密钥泄漏的基于身份的加密方案,并给出了严格的安全证明。·在无证书加密方面,我们填补了目前密码学领域在容忍密钥泄漏的无证书加密方面无研究的空白。我们的工作主要体现在以下几个方面：-首次提出了无证书Hash Proof System的概念,并且首次给出了无证书Hash Proof System所应具有的信息论属性。尤其在有效密文与无效密文的不可区分性的安全模型上,有别于传统公钥体制和基于身份体制下只有一种类型的攻击者,无证书体制下有两类不同类型的攻击者,如何兼顾这两类攻击者,本文进行了创新。-首次给出了容忍密钥泄漏的无证书加密方案的安全模型和容忍密钥泄漏攻击的无证书加密方案一般构造方法。-作为对无证书Hash Proof System的这个新概念有力支撑,本文首次给出了一个具体的且具有相关信息论属性的无证书Hash Proof System的构造实例。根据这个具体的无证书Hash Proof System证明系统,利用One-time Pad就能很巧妙的得到容忍密钥泄漏的无证书加密方案。-在上述构造的容忍密钥泄漏的无证书加密方案的基础上,本文构建了用户可撤销的容忍密钥泄漏的无证书加密方案。更多还原

【Abstract】 Cryptography can be used to meet the information confidentiality, integrity, authen-tication and non-repudiation. Traditional security analysis method of cryptographic protocols is to provide the attacker some opportunities to access the decryption ora-cle in encryption scheme or signing oracle in signature scheme, which are also called black boxes. During the process of accessing such random oracle, the attacker can only see what he chose and the corresponding output from the random oracle, but can not get any information about the secret key and secret status inside the oracle. Obvi-ously, this is an ideal security analysis method. In fact, any physical implementation of a cryptographic system will leak some information within the system. Through the various key leakage attacks, an adversary can obtain some information of the private key and the internal secret state more or less.As we all know that the public key cryptography is an important part of modern cryptography. The public key encryption technology also plays a significant role in the practical application. Therefore, the security analysis of the existing public key encryption scheme is no longer confined to the traditional idealized models. When various kinds of key leakage attacks are taken into consideration the security analysis must be changed consequentially. Due to the key leakage attack is the most important attack, considering efficient public key encryption systems with leakage resilience is just the subject of study in this thesis.The focus of this thesis is studying efficient leakage resilient encryption schemes under various public key cryptosystems. We achieve the following main results:·In the traditional public key encryption system, based on the work of leakage resilient Cramer-Shoup public key encryption scheme which Naor and Segev [93] presented in Crpyto’2009, we give a more efficient public key encryption scheme with leakage resilience compared with the CS-LR-PKE2 scheme of [93]. Our proposed scheme enjoys a low computational cost, a short key length, as well as a higher relative key leakage rate under the same CCA2security level.· In IBE cryptosystem, we get two results.-Based on Coron’s IBE scheme [29], we present a new IBE scheme with leakage resilience. Our proposed scheme is similar with the literature [28] both in efficiency and relative key leakage rate. However, in the se-curity analysis, we give two security analysis methods carefully. One is the traditional security conduction proof; the other is that if we can find an IB-HPS construction satisfying some information theoretic properties in the underlying EBE scheme, then the IBE scheme is leakage resilient [3].-We present a revocable IBE scheme with leakage resilience which can not only resist the partial leakage about the initial private key but also get the revocation functionality via public channel. And the formal secu-rity proof is given afterwards.· In CLE cryptosystem, the study of certificateless encryption with leak-age resilience is still virgin. In this thesis we supply some gaps in the following aspects.-We present the new notion and the new information theoretic properties of certificateless hash proof system for the first time. Partic-ularly in the security model of valid/invalid ciphertext indistinguishability, as distinct from traditional public key and identity-based institutions both of which have only one type of attackers, certificateless system has two different types of attackers, how to balance between these two kinds of attackers, we have done some innovation in the thesis.-We also introduce for the first time the security model and the generic construction method of certificateless leakage resilient encryption. -As a strong supporting of the new concept, we present a concrete certificateless hash proof system example. From the instantiation, we can get a certificateless encryption scheme with one-time pad genuinely.-We design a revocable CLE scheme with leakage resilience and give the security analysis thoroughly.更多还原