Journal of Computer Security - Volume 18, issue 3

Authors: Lekkas, Dimitrios | Gritzalis, Dimitris

Article Type: Research Article

Abstract: Millions of citizens around the world have already acquired their new electronic passport. The e-passport is equipped with contactless communication capability, as well as with an Integrated Circuit Chip enabling cryptographic functionality. Countries are required to build a national Public Key Infrastructure to support digital signatures, as this is considered the basic mechanism to prove the authenticity and integrity of the Machine Readable Travel Documents. The first, large-scale, worldwide PKI is currently under construction, by means of bilateral trust relationships between Countries. In this paper, we propose a set of good practices, which are essential for the establishment of a …global identification scheme based on e-passports, together with an analysis of the security and privacy issues that may arise. We argue that an e-passport may also be exploited in other applications as a globally interoperable PKI-enabled tamperproof device. The preconditions, the benefits and the drawbacks of using e-passports in everyday electronic activities are further analyzed and assessed. Show more

Keywords: Security, trust, digital signatures, machine readable travel documents, PKI, RFID, smart card, electronic passport

DOI: 10.3233/JCS-2008-0370

Citation: Journal of Computer Security, vol. 18, no. 3, pp. 379-396, 2010

Authors: Pala, Massimiliano | Smith, Sean W.

Article Type: Research Article

Abstract: Public key cryptography can uniquely enable trust within distributed settings. Employing it usually requires deploying a set of tools and services collectively known as a Public Key Infrastructure (PKI). PKIs have become a central asset for many organizations, due to distributed IT and users. Even though the usage of PKIs in closed and controlled environments is quite common, interoperability and usability problems arise when shifting to a broader, open environment. To make an effective trust judgment about a public key certificate, a PKI user needs more than just knowledge of that certificate: she also needs to be able to locate …critical parameters such as the certificate repositories and certificate validation servers relevant to that certificate – and all the others the trust path she builds for it. Surprisingly, locating these resources and services remains a largely unsolved problem in real-world X.509 PKI deployment. This issue impacts especially on the usability of this technology and the interoperability of PKIs in open environments such as the Internet. In this paper, we present the design and prototype of a new and flexible solution for automatic discovery of the services and data repositories made available by a Certificate Service Provider (CSP). This contribution will take real-world PKI one step closer to enhancing usability of digital certificates and interoperability between PKIs. Show more

DOI: 10.3233/JCS-2010-0401

Citation: Journal of Computer Security, vol. 18, no. 3, pp. 397-420, 2010

Authors: Li, Jiguo | Huang, Xinyi | Mu, Yi | Susilo, Willy | Wu, Qianhong

Article Type: Research Article

Abstract: In Eurocrypt 2003, Gentry introduced the notion of certificate-based encryption. The merit of certificate-based encryption lies in the following features: (1) providing more efficient public-key infrastructure (PKI) that requires less infrastructure, (2) solving the certificate revocation problem, and (3) eliminating third-party queries in the traditional PKI. Additionally, it also offers the solution to the inherent key escrow problem in the identity-based cryptography. The contributions of this paper are threefold. Firstly, we introduce a new attack called the “Key Replacement Attack” into the certificate-based signature system and refine the security model of certificate-based signature. Secondly, we show that the certificate-based signature …scheme presented by Kang, Park and Hahn in CT-RSA 2004 is insecure against key replacement attacks. Thirdly, we present two new certificate-based signature schemes secure against key replacement attacks. Our first scheme is existentially unforgeable against adaptive chosen message attacks under the computational Diffie–Hellman assumption in the random oracle model. Compared with the certificate-based signature scheme in CT-RSA 2004, our first scheme enjoys shorter signature length and less operation cost. Our second scheme is inspired by Waters signature and is the first construction of certificate-based signature secure against key replacement attacks in the standard model. Show more

Keywords: Certificate-based signature, key replacement attack, PKI

DOI: 10.3233/JCS-2009-0366

Citation: Journal of Computer Security, vol. 18, no. 3, pp. 421-449, 2010

Authors: Li, Chung Ki | Yang, Guomin | Wong, Duncan S. | Deng, Xiaotie | Chow, Sherman S.M.

Article Type: Research Article

Abstract: In Information Processing Letters (2006), Tan pointed out that the anonymous signcryption scheme proposed by Yang, Wong and Deng (YWD) in ISC 2005 provides neither confidentiality nor anonymity. However, no discussion has been made on how a secure scheme can be made and there is no secure scheme available to date. In this paper, we propose a modification of YWD scheme which resolves the security issues of the original scheme without sacrificing its high efficiency and simple design. Indeed, we show that our scheme achieves confidentiality, existential unforgeability and anonymity with more precise reduction bounds. We also give a variation …of our scheme and extend it to a ring signcryption scheme by using the technique due to Boneh, Gentry, Lynn and Shacham. Show more

Keywords: Signcryption, ring signcryption, privacy, anonymity

DOI: 10.3233/JCS-2009-0374

Citation: Journal of Computer Security, vol. 18, no. 3, pp. 451-473, 2010

Authors: Chadwick, David W. | Antony, Sean | Bjerk, Rune

Article Type: Research Article

Abstract: There are several problems associated with the current ways that certificates are published and revoked. This paper discusses these problems, and then proposes a solution based on the use of WebDAV, an enhancement to the HTTP protocol. The proposed solution provides instant certificate revocation, minimizes the processing costs of the certificate issuer and relying party, and eases the administrative burden of publishing certificates and certificate revocation lists (CRLs). We describe how WebDAV can be used for X.509 certificate revocation, and describe how we have implemented it in the PERMIS authorization infrastructure.

Keywords: Revocation, CRLs, LDAP, HTPP, WebDAV, X.509

DOI: 10.3233/JCS-2009-0372

Citation: Journal of Computer Security, vol. 18, no. 3, pp. 475-496, 2010