Identity-based deniable authentication protocol Source: ELECTRONICS LETTERS 3rd March2005 Vol. 41 No.5 Author: Y.Shi and J.Li Presenter: 蕭芥釧 資訊碩一 M9525674

Outline Introduction Bilinear pairings Proposed scheme Protocol analysis conclusion

Introduction (1/4) Deniable authentication protocol: Application The receiver can verify the source of the message as the traditional authentication protocol. The receiver cannot prove the source of the message to the third party. Application Electronic voting systems.

Introduction (2/4) Fan et al. proposed a simple deniable authentication protocol based on the Diffie-Hellman key distribution protocol. An intruder masquerades as a receiver to a sender and persuades a sender to initiate a protocol with him. This protocol adopts certificates to defeat the attack of the person-in-the-middle Shao has pointed out that Fan’s scheme can suffer from the impersonate attack

Introduction (3/4) Shao proposed a non-interactive deniable authentication protocol based on the generalised E1 Gamal signature scheme Shao’s scheme still requires heavy use of certificates

Introduction (4/4) In this paper, we propose a new non- interactive deniable authentication protocol based on identity cryptography Only the intended receiver can identify the source of a given message It is suitable for offline authentication in some applications such as e-mail

Bilinear pairings A modified bilinear pairing is a map e^: G1 ╳ G1 → G2 with the following properties:

Proposed scheme (1/4) The concept of identity-based cryptography was first proposed by Shamir It is a form of public key cryptography The public key can be an arbitrary string Boneh and Franklin proposed an efficient identity-based encryption (IBE) based on bilinear pairings IBE scheme needs a trusted key generation centre (KGC)

The KGC chooses the following system parameters

Proposed scheme (2/4) The KGC keeps the master key s secretly and publishes the public parameter (G1, G2, eˆ, P, PKGC, H1, H). Given a user’s identity ID, the KGC generates a pair of the user’s identity- based keys (QID, SID) as follows QID = H1 (ID) SID = sQID KGC issues the private key SID to the user via a secure channel.

Proposed scheme (3/4) In our scheme, we adopt a secure signature scheme such as Hess’s identity-based signature scheme. We represent its signature and verification functions for a message m with a pair of keys (QID, SID) by δ = Sign(m, SID ) and Verify(δ,QID ,m) = true

Proposed scheme (4/4)

Protocol analysis (1/3) Lemma 1: the protocol authentication the source of the message Proof: Ks = e^(rQR, PKGC) = e^(SR,U) = KR If someone proves (U,δ,MAC,M) to R, he must be S. Even though an intruder gets the messages U, QR and PKGC he cannot get the key K The key K is as difficult as solving the BDH problem

Protocol analysis (2/3) Lemma 2: The protocol is deniable Proof: After receiving (U,δ,MAC,M), R can identify with his private key SR R cannot prove the source of the message to a third party.

Protocol analysis (3/3) Lemma 3: The protocol can withstand impersonate attacks Proof: Assume that the third party obtains the message M and its authenticator (U,δ,MAC) If he can verify the authenticator, he must find K’= K. It is impossible to do it under the BDH problem.

Conclusions The authors have developed a new deniable authentication protocol based on identity cryptography that has no need for certificates. this scheme is secure since no one can impersonate the intended receiver under the security assumption of the BDH problem This scheme is non-interactive and suitable for offline authentication.