1. Identity-based deniable authentication protocol
Source: ELECTRONICS LETTERS 3rd
March2005 Vol. 41 No.5
Author: Y.Shi and J.Li
Presenter: 蕭芥釧
資訊碩一 M

2. Outline Introduction Bilinear pairings Proposed scheme
Protocol analysis
conclusion

3. Introduction (1/4) Deniable authentication protocol: Application
The receiver can verify the source of the message as the traditional authentication protocol.
The receiver cannot prove the source of the message to the third party.
Application
Electronic voting systems.

4. Introduction (2/4)
Fan et al. proposed a simple deniable authentication protocol based on the Diffie-Hellman key distribution protocol.
An intruder masquerades as a receiver to a sender and persuades a sender to initiate a protocol with him.
This protocol adopts certificates to defeat the attack of the person-in-the-middle
Shao has pointed out that Fan’s scheme can suffer from the impersonate attack

5. Introduction (3/4)
Shao proposed a non-interactive deniable authentication protocol based on the generalised E1 Gamal signature scheme
Shao’s scheme still requires heavy use of certificates

6. Introduction (4/4)
In this paper, we propose a new non- interactive deniable authentication protocol based on identity cryptography
Only the intended receiver can identify the source of a given message
It is suitable for offline authentication in some applications such as

7. Bilinear pairings A modified bilinear pairing is a map
e^: G1 ╳ G1 → G2 with the following properties:

8. Proposed scheme (1/4)
The concept of identity-based cryptography was first proposed by Shamir
It is a form of public key cryptography
The public key can be an arbitrary string
Boneh and Franklin proposed an efficient identity-based encryption (IBE) based on bilinear pairings
IBE scheme needs a trusted key generation centre (KGC)

9. The KGC chooses the following system parameters

10. Proposed scheme (2/4)
The KGC keeps the master key s secretly and publishes the public parameter
(G1, G2, eˆ, P, PKGC, H1, H).
Given a user’s identity ID, the KGC generates a pair of the user’s identity- based keys (QID, SID) as follows
QID = H1 (ID)
SID = sQID
KGC issues the private key SID to the user via a secure channel.

11. Proposed scheme (3/4)
In our scheme, we adopt a secure signature scheme such as Hess’s identity-based signature scheme.
We represent its signature and verification functions for a message m with a pair of keys (QID, SID) by δ = Sign(m, SID ) and Verify(δ,QID ,m) = true

12. Proposed scheme (4/4)

13. Protocol analysis (1/3)
Lemma 1: the protocol authentication the source of the message
Proof:
Ks = e^(rQR, PKGC) = e^(SR,U) = KR
If someone proves (U,δ,MAC,M) to R, he must be S.
Even though an intruder gets the messages U, QR and PKGC he cannot get the key K
The key K is as difficult as solving the BDH problem

14. Protocol analysis (2/3) Lemma 2: The protocol is deniable Proof:
After receiving (U,δ,MAC,M), R can identify with his private key SR
R cannot prove the source of the message to a third party.

15. Protocol analysis (3/3)
Lemma 3: The protocol can withstand impersonate attacks
Proof:
Assume that the third party obtains the message M and its authenticator (U,δ,MAC)
If he can verify the authenticator, he must find K’= K. It is impossible to do it under the BDH problem.

16. Conclusions
The authors have developed a new deniable authentication protocol based on identity cryptography that has no need for certificates.
this scheme is secure since no one can impersonate the intended receiver under the security assumption of the BDH problem
This scheme is non-interactive and suitable for offline authentication.