1. Improvement of Hwang-Lo-Lin scheme based on an ID-based cryptosystem No author given (Korea information security Agency) Presented by J.Liu

2. Outline Introduction Review of the Hwang-Lo-Lin scheme Cryptanalysis The modified ID-based identification scheme Security analysis Performance analysis Conclusions

3. Introduction ID-based public key cryptosystem. Maurer-Yacobi(1996)  Tseng-Jan(1998)  Hwang-Lo-Lin(2004)  Horng-Liu-Liu(2005)  This Letter(2005) Hwang et al. developed the improved scheme was suitable for the wireless environment.

4. Review of the Hwang-Lo-Lin scheme TA setup the system parameters as following: 1.N = p 1  p 2  p 3  p 4, where p i are primes and their decimal digits are between 60-70, (p i -1)/2 are odd and pair wise relatively prime. 2.DLP is feasible but factoring N is infeasible. 3.g is a primitive root in each GF(p i ). 4.h(.) is an one way hash function. 5.ed = 1 mod  (N) and tv = 1 mod  (N).

5. Cont 6.ID b, ID m : identity of base station(BS) and mobile device(M), respectively. 7.s b = et  log g (ID b 2 ) mod  (N) is secret key for BS. 8.s m = et  log g (ID m 2 ) mod  (N) is secret key for M. 9.T: timestamp {N, g, e, h(.)}are public parameters and keep {p 1, p 2, p 3, p 4, t, v, d } secret.

6. Login and authentication 1.Choose k  R Z N *, computes Y = (ID m 2 ) k mod N, Z = (ID b 2 ) ks m T mod N 2.Sends {ID m, Y, Z, T } to BS. 3.BS computes Z’ = (Y) s b T, checks Z = Z’ If yes then… else…. ?

7. Key points

8. Cryptanalysis Attacker forge {ID m, Y 1, Z 1, T’ } from a valid login message {ID m, Y, Z, T } by Y 1 = Y rT mod N and Z 1 = Z rT’ mod N.

9. The modified ID-based identification scheme The parameters are the same of Hwang’s scheme, but the 4 primes have bit size more than 1024 bits. (DLP OK? about 300 decimal digits) 1.M sends {ID m, Z, T} to BS, where Z = H((ID b 2 ) s m T mod N) 2.BS verifies by Z = H((ID m 2 ) s b T mod N)

10. Security analysis 1.Passive replay attack: Changes timestamp T. H((ID m 2 ) s b T mod N)  H((ID m 2 ) s b T’ mod N) 2.Active replay attack: The attacker can not change Z and T without s m and s b. 3.ID-stolen attack: The same with 2.

11. Performance analysis Without random number generator(hash function). Shorter message length (1/2). Fewer exponential operation (2  1). More suitable in wireless environment.

12. Conclusion Secure More suitable.