The main goal of cryptography is to enable secure communication over a public channel; often a secret shared among the communicating parties is used to achieve this. The process by which these parties agree on such a shared secret is called key agreement. In this thesis, we focus on two-party key agreement protocols in the public-key setting and study the various methods used to establish and validate public keys. We pay particular attention to certificateless key agreement schemes and attempt to formalize a relevant notion of security. To that end, we give a possible extension of the existing extended Canetti-Krawzcyk security model applicable to the certificateless setting. We observe that none of the certificateless protocols we have seen in the literature are secure in this model; it is an open question whether such schemes exist. We analyze several published certificateless key agreement protocols, demonstrating the existence of key compromise impersonation attacks and even a man-in-the-middle attack in one case, contrary to the claims of the authors. We also briefly describe weaknesses exhibited by these protocols in the context of our suggested security model.

The main goal of cryptography is to enable secure communication over a public channel; often a secret shared among the communicating parties is used to achieve this. The process by which these parties agree on such a shared secret is called key agreement. In this thesis, we focus on two-party key agreement protocols in the public-key setting and study the various methods used to establish and validate public keys. We pay particular attention to certificateless key agreement schemes and attempt to formalize a relevant notion of security. To that end, we give a possible extension of the existing extended Canetti-Krawzcyk security model applicable to the certificateless setting. We observe that none of the certificateless protocols we have seen in the literature are secure in this model; it is an open question whether such schemes exist. We analyze several published certificateless key agreement protocols, demonstrating the existence of key compromise impersonation attacks and even a man-in-the-middle attack in one case, contrary to the claims of the authors. We also briefly describe weaknesses exhibited by these protocols in the context of our suggested security model.

Apresentamos um novo esquema de acordo de chaves criptográficas hierárquico, não Interativo e seguro contra comprometimento de múltiplos nós. Esquemas para Acordo de chaves criptográficas (KAS - Key Agreement Scheme), são usados quando duas ou mais entidades desejam compartilhar uma chave secreta única, afim de para realizar uma comunicação segura por meio de um protocolo de criptografia simétrico. O acordo de chaves proposto possui as seguintes características: Não interativo: Chaves compartilhadas são calculadas sem interação dos nós participantes; Chaves Públicas sem certificados (Certificateless): Para o cálculo da chave compartilhada o nó utiliza sua chave secreta e a chave pública do destinatário, que é certificada pela identidade do destinatário; Hierárquico: Permite que seja utilizado um gerenciamento hierárquico, para concessão, revogação e distribuição de chaves; e Resistente: Permite segurança do sistema mesmo quando nós dentro da hierarquia são comprometidos em qualquer ordem e quantidade. Este trabalho é uma nova abordagem do artigo \"Strongly-Resilent and Non-Interactive Hierarchical Key-Agreement in MANETs\" onde substituímos o uso de sistemas baseados na identidade por sistemas sem certificado, eliminando a custódia de chaves em todos os níveis hierárquicos, aumentando a segurança do sistema quanto ao comprometimento de nós. É apresentado ainda uma discussão sobre a segurança do esquema proposto e de acordos de chaves não interativos. / This work presents a new resilient, hierarchical, non-interactive and certificateless key agreement scheme. Cryptographic key agreement schemes (KAS) are used when two or more entities want to share a secret key, in order to realize secure communication using a symmetric encryption protocol. The proposed key agreement has the following characteristics: Non-interactive: Any two nodes can compute a unique shared secret key without interaction; Certificateless: To compute the shared secret key, each node only needs its own secret key, the identity of its peer and his public key implicitly certified; Hierarchical: The scheme is decentralized through a hierarchy where all nodes in the hierarchy can derive the secret keys for each of its children without any limitations or prior knowledge on the number of such children or their identities; Resilient: The scheme is resilient against compromise of any number of nodes in the hierarchy. This work is a new approach about article ``Strongly-Resilient and Non-Interactive Hierarchical Key-Agreement in MANETs\" which replaces id based system for certificateless system, eliminating the key escrow on all levels, increasing system security against compromised nodes. It also presents a discussion on the security of the proposed scheme and non-interactive key agreement.

<div>Unmanned Aerial Vehicles (UAVs), commonly known as drones, are aircrafts without a human pilot aboard. The flight of drones can be controlled with a remote control by an operator located at the ground station, or fully autonomously by onboard computers. Drones are mostly found in the military. However, over the recent years, they have attracted the interest of industry and civilian sectors. <br></div><div>With the recent advance of sensor and embedded device technologies, various sensors will be embedded in city infrastructure to monitor various city-related information. In this context, drones can be effectively utilized in many safety-critical applications for collecting data from sensors on the ground and transmitting configuration instructions or task requests to these sensors.</div><div> <br></div><div>However, drones, like many networked devices, are vulnerable to cyber and physical attacks.<br></div><div>Challenges for secure drone applications can be divided in four aspects: 1) securing communication between drones and sensors, 2) securing sensor localization when drones locate sensors, 3) providing secure drone platforms to protect sensitive data against physical capture attacks and detect modifications to drone software, and 4) protecting secret keys in drones under white-box attack environments.<br></div><div> <br></div><div>To address the first challenge, a suite of cryptographic protocols is proposed. The protocols are based on certificateless cryptography and support authenticated key agreement, non-repudiation and user revocation. To minimize the energy required by a drone, a dual channel strategy is introduced.<br></div><div>To address the second challenge, a drone positioning strategy and a technique that can filter out malicious location references are proposed.<br></div><div>The third challenge is addressed by a solution integrating techniques for software-based attestation and data encryption.<br></div><div>For attestation, free memory spaces are filled with pseudo-random numbers, which are also utilized to encrypt data collected by the drone like a stream cipher.<br></div>A dynamic white-box encryption scheme is proposed to address the fourth challenge. Short secret key are converted into large look-up tables and the tables are periodically shuffled by a shuffling mechanism which is secure against white-box attackers.

Apresentamos um novo esquema de acordo de chaves criptográficas hierárquico, não Interativo e seguro contra comprometimento de múltiplos nós. Esquemas para Acordo de chaves criptográficas (KAS - Key Agreement Scheme), são usados quando duas ou mais entidades desejam compartilhar uma chave secreta única, afim de para realizar uma comunicação segura por meio de um protocolo de criptografia simétrico. O acordo de chaves proposto possui as seguintes características: Não interativo: Chaves compartilhadas são calculadas sem interação dos nós participantes; Chaves Públicas sem certificados (Certificateless): Para o cálculo da chave compartilhada o nó utiliza sua chave secreta e a chave pública do destinatário, que é certificada pela identidade do destinatário; Hierárquico: Permite que seja utilizado um gerenciamento hierárquico, para concessão, revogação e distribuição de chaves; e Resistente: Permite segurança do sistema mesmo quando nós dentro da hierarquia são comprometidos em qualquer ordem e quantidade. Este trabalho é uma nova abordagem do artigo \"Strongly-Resilent and Non-Interactive Hierarchical Key-Agreement in MANETs\" onde substituímos o uso de sistemas baseados na identidade por sistemas sem certificado, eliminando a custódia de chaves em todos os níveis hierárquicos, aumentando a segurança do sistema quanto ao comprometimento de nós. É apresentado ainda uma discussão sobre a segurança do esquema proposto e de acordos de chaves não interativos. / This work presents a new resilient, hierarchical, non-interactive and certificateless key agreement scheme. Cryptographic key agreement schemes (KAS) are used when two or more entities want to share a secret key, in order to realize secure communication using a symmetric encryption protocol. The proposed key agreement has the following characteristics: Non-interactive: Any two nodes can compute a unique shared secret key without interaction; Certificateless: To compute the shared secret key, each node only needs its own secret key, the identity of its peer and his public key implicitly certified; Hierarchical: The scheme is decentralized through a hierarchy where all nodes in the hierarchy can derive the secret keys for each of its children without any limitations or prior knowledge on the number of such children or their identities; Resilient: The scheme is resilient against compromise of any number of nodes in the hierarchy. This work is a new approach about article ``Strongly-Resilient and Non-Interactive Hierarchical Key-Agreement in MANETs\" which replaces id based system for certificateless system, eliminating the key escrow on all levels, increasing system security against compromised nodes. It also presents a discussion on the security of the proposed scheme and non-interactive key agreement.

Many systems contain sensitive data such as user credentials used for authentication purposes. For large systems, a common approach is to store the data in a configuration file at a trusted third party. However, that would imply a single point of failure if an adversary gains access to the trusted party. In theory this could be solved by encrypting the data but in practice this only moves the problem and does not solve it, since some type of credential data is needed to decrypt the configuration file. A more flexible solution is needed that requires less of human interaction while also providing a higher degree of security. This thesis proposes a complete cryptographical system for solving this problem in a typical enterprise setting with a set of additional implementation requirements by using multi-party computation and Shamir's secret sharing protocol. Additionally, the work combines the mentioned system with a certificateless cryptography based multi-party computation protocol, since certificates usually implies a time-consuming process. The system has been evaluated in terms of security and efficiency with the conclusion that the results look promising. In terms of performance, the bulk of the overhead comes from certificateless cryptography, a constraint for the specific scenario which might not be present in general. The work also provides incentives for developing and further evolving Java libraries for cryptography, especially for multi-party computation and certificateless cryptography. / Många system innehåller känslig data, exempelvis användaruppgifter som används för autentiseringsändamål. För stora system är en vanlig lösning att lagra data i en konfigurationsfil hos en betrodd tredje part. Det skulle emellertid innebära att den svagaste länken är om motståndare får tillgång till den betrodda parten. I teorin kan detta lösas genom att kryptera data men i praktiken flyttar det bara på problemet men löser det inte, eftersom någon typ av autentiseringsdata behövs för att dekryptera konfigurationsfilen. En mer flexibel lösning behövs som kräver mindre mänsklig interaktion samtidigt som det ger en högre grad av säkerhet. Denna avhandling föreslår ett komplett kryptografiskt system för att lösa detta problem i en typisk företagsmiljö med en ytterligare uppsättning implementationskrav genom att använda multipartsberäknande och Shamirs secret sharing protokoll. Dessutom kombinerar arbetet det nämnda systemet med ett certifikatfritt krypteringsbaserat protokoll kombinerat med multipartsberäkningar, eftersom certifikat oftast innebär en tidskrävande process. Systemet har utvärderats med avseende på säkerhet och effektivitet med slutsatsen att det ser lovande ut. När det gäller prestanda kommer huvuddelen av omkostnaden från den certifikatfria kryptografin, en begränsning för det specifika scenariot som kanske inte är närvarande i allmänhet. Arbetet ger också motiv för att vidareutveckla Java-bibliotek för kryptografi, speciellt för multipartsberäknande protokoll och certifikatlös kryptering.

Information exchange in wireless communication without being blocked by terrain or infrastructure is easier and simpler than that in the traditional wired communication environments. Due to the transmission type, anonymity is urgently required in wireless communications for concealing the footprint of mobile users. Additionally, the mobility of a mobile device may incur possible threats to the past encrypted transmitted data, where the past session keys for the encryptions of wireless communications may be derived by the long-term secret stored the mobile device if it is lost. In this thesis, we propose an efficient solution by using symmetry-based cryptosystems for forward secrecy and anonymity in the standards of mobile networks, such as GSM, UMTS, and LTE, without losing the compatibility. By adopting secret chain (SC) based mechanism, the generation of every session key involves a short-term secret, changed in every session, to achieve forward secrecy and anonymity. Furthermore, synchronization mechanism required for the SC-protocol is also proposed. For more advanced security requirements of truly non-repudiation and strong anonymity, which is additionally anonymous to systems, certificateless signatures and group signatures are applied in the authentication protocols for UMTS and VANETs. Certificateless signatures can eliminate the overhead of using public-key infrastructure (PKI) in wireless communications. Our work proposed a certificateless signature scheme achieving the same security level of non-repudiation as that in the PKI-based signature scheme, that most of the proposed certificateless signatures cannot fulfill. Group signatures practice the privacy of the participants of the authentication protocol by originating the group signatures belonging to their group. However, directly applying group signatures in wireless communications results in inefficiency of computation when a group has a large amount of members. Therefore, we aim at reducing the computation costs of membership revocation on the proposed group signature scheme to constant without being influenced by the amount of members and then apply the scheme to VANETs and UMTS. Eventually, all the proposed schemes in the thesis are theoretically proven secure under the standard reduction.

本論文提出了一個免憑證加密系統的方案，並且將此方案實作出來，使得此方案更具實用性。此方案主要架構為免憑證加密系統，利用此系統的特性消除傳統公開金鑰密碼系統中需要公開金鑰憑證認證的麻煩，也不會產生基於身分認證加密系統的私鑰託管問題，有效的結合了兩項系統的優點，並且提高了這兩種系統的安全性及方便性。本論文的協定中，在基於身分認證加密系統的公鑰部分還加入了階級以及時間戳記的概念，用以限制接收方取得部份私鑰的能力，並且也將接收方的部分公鑰加入其中，來增加部份私鑰的安全性。另外此協定也加入了提早解密金鑰的部分，可讓傳送方在傳出密文後更改解密時間，而不需要重新使用新的公鑰加密資訊，便可提早讓接收方取得相對應的明文資訊。 / In this paper, we propose a new certificateless public key encryption system, and implement it for securing e-mail systems. Certificateless cryptography, which is in contrast to traditional public key crypto-systems, does not require the use of certificates to guarantee the authenticity of public key. It does rely on the use of a trusted third party (TTP) who is in possession of a master key, just like the identity-based public key cryptography. However, certificateless public key crypto-system does not suffer from the key escrow property, whereas, it is a problem in the identity-based public key crypto-systems. Moreover, in our system, we add some new properties like level and time-stamp to limit the ability of receivers and to promote the safety of the system. Time-stamp ensures that the ciphertext cannot be decrypted before the indicated time and a level ensures that only the user with the corresponding identity and level can decrypt the ciphertext. In addition, a new feature is also introduced which is called the time-release encryption. Time-release encryption allows the encrypter to publish a release key so that the ciphertext can be decrypted by the receiver before the time indicated in the time-stamp when necessary.

在傳統的公開金鑰簽章系統中，用戶的公鑰需要一個可信第三方(Trusted Third Party-TTP)發給憑證來保證其可靠性。其後Shamir提出基於使用者身分的簽名機制(ID-Based Signature)　儘管不需要憑證，但此種系統的概念中，TTP仍然扮演著強大的角色，隨之而來的是金鑰託管(Key Escrow)的問題。而在2003年時提出的免憑證簽章系統Certificateless Signature Scheme(CL-S)概念中，不僅不需要憑證也同時解決了Key Escrow的問題。本篇文章便是基於CL-S的概念下，發展出一套免憑證的可代理簽章系統(CL-Proxy Signature)。並且可利用簡單的方式使我們的系統擴張成為一個支援盲簽名(Blind Signature)的免憑證代理盲簽章系統。 / Traditional public key cryptosystem (PKC) requires a Trusted-Third-Party(TTP) for the management of certificates of users’ public keys. To solve this problem, Shamir introduced the concept of ID based signature scheme. Although the ID based signature scheme doesn't require the certificate management, TTP still plays an important role here. In addition, ID-based schemes have the key escrow problem. In 2003, a certificateless signature scheme has been introduced. In a certificateless signature scheme, certificates are not required on one hand and can solve the key escrow problem on the other hand. In this paper, based on the concept of certificateless, we introduce a certificateless proxy signature scheme. A remarkable feature of our scheme is that it can be extended into a certificateless proxy blind signature.

Sob o modelo de criptografia de chave pública baseada em identidades (ID-PKC), a própria identidade dos usuários é usada como chave pública, de modo a dispensar a necessidade de uma infra-estrutura de chaves públicas (ICP), na qual o gerenciamento de certificados digitais é complexo. Por outro lado, sistemas nesse modelo requerem uma entidade capaz de gerar chaves secretas. Essa entidade é conhecida por PKG (Private Key Generator); ela possui uma chave-mestra e mantém custódia das chaves secretas geradas a partir dessa chave-mestra. Naturalmente, a custódia de chaves é indesejável em muitas aplicações. O conceito de Criptografia de Chave Pública sem Certificado, ou Certificateless Public Key Cryptography (CL-PKC), foi proposto para que a custódia de chaves fosse eliminada, mantendo, porém, as características de interesse: a não necessidade de uma ICP e a eliminação de certificados digitais. CL-PKC deixa de ser um sistema baseado em identidades, pois é introduzida uma chave pública, gerada a partir de uma informação secreta do usuário. Nesta dissertação, apresentamos a construção de dois esquemas, um CL-PKE e um CL-PKS, baseados em emparelhamentos bilineares sobre curvas elípticas. Ambas propostas: (1) eliminam custódia de chaves; (2) dispensam certificados digitais; (3) são mais eficientes, sob certos aspectos, que esquemas anteriormente publicados; (4) e são seguros contra ataques adaptativos de texto cifrado escolhido (em CL-PKE) e contra ataques adaptativos de mensagem escolhida (em CL-PKS), sob o modelo de oráculos aleatórios. / Under the model of Identity Based Cryptography (ID-PKC), the public key can be the user's identity, therefore it does not require a Public Key Infrastructure (PKI) with its complex management of Digital Certificates. On the other hand, this system requires a Private Key Generator (PKG), a trusted authority who is in possession of a master key and can generate any of the private keys. In this way, PKG can exercise the so-called key escrow, which is undesirable in many applications. The concept of Certificateless Public Key Cryptography (CL-PKC) was proposed in order to remove the key escrow characteristic of IBC, while it does not require PKI neither Digital Certificates to certify the public keys. CL-PKC is no more an IBC because public keys are introduced, to bind the identities with its secret keys. In this thesis we construct two schemes, one CL-PKE and one CL-PKS, based on bilinear pairing functions which: (1) does not allow key escrow by the PKG; (2) does not require Digital Certificates; (3) is more efficient, in some aspects, than previously published CL-PKE and CL-PKS schemes; (4) and is secure in the sense that it is strong against adaptive chosen ciphertext attacks (in CL-PKE) and adaptive chosen message attacks (in CL-PKS), under Random Oracle Model.