Certificateless Public Key Cryptography. In 2003 Al-Riyami and Paterson [1] introduced the concept of Certificateless Public Key Cryptography (CL-PKC) to overcome the key escrow limitation of the identity-based public key cryptography (ID-PKC). In CL-PKC a trusted third party called Key Generation Center (KGC) supplies a user with a partial private key. Then, the user combines the partial private key with a secret value (that is unknown to the KGC) to obtain his full private key. In this way the KGC does not know the users private keys. Then the user combines his secret value with the KGC’s public parameters to compute his public key. Compared to the ID-PKC, the trust assumptions made of the trusted third party in CL-PKC are much reduced. In IDPKC, users must trust the private key generator (PKG) not to abuse its knowledge of private keys in performing passive attacks, while in CL-PKC, users need only trust the KGC not to actively propagate false public keys [1]. In CL-PKC a user can generate more than one pair of key (private and public) for the same partial private key. To guarantee that KGC does not replace a user’s public key Al-Riyami and Paterson[1] introduced a binding technique to bind a user’s public key with his private key. In their binding scheme, the user first fixes his secret value and his public key and supplies the KGC his public key. Then the KGC redefine the identity of the user to be the user’s identity concatenated with his public key. By this binding scheme the KGC replacement of a public key apparent, and equivalent to a certificate authority forging a certificate in a traditional PKI.
Certificateless Public Key Cryptography. (CL-PKI) Certificateless cryptography is introduced in 2003 by Xx-Xxxxxx and Xxxxxxxx [1]. It eliminates the necessity of certificate authority (CA) and removes key escrow problem in the system. It comprises of seven algorithms which are as follows:
Certificateless Public Key Cryptography. In 2003, Al-Riyami and Paterson proposed the concept of certificateless public key cryp- tography (CL-PKC) [1]. In a way, CL-PKC combines the best of both worlds by still op- erating in a certificateless environment like ID-PKC, but using a trust model similar to that of PKI. Thus, CL-PKC does not inherit the escrow property of ID-PKC, making the system ideal for networks where privacy or user anonymity is preferred. Furthermore, the absence of certificates removes the cost incurred by certificate storage, distribution, and verification which makes CL-PKC far more efficient than traditional PKI. CL-PKC still makes use of a trusted authority, but in contrast to ID-PKC, the key gen- eration center (KGC) does not have access to the entities’ private keys. Instead, the KGC generates a partial private key that the user then combines with a secret value. Together, these values make up the actual private key, and thus the KGC cannot recover the shared secret established between entities. This change to the scheme also makes it impossible for the KGC to forge any signatures. The public key is generated in a similar way by letting the user combine its secret value with a public parameter selected by the KGC. However, since the secret value is only known to a specific user, public keys can no longer be generated by anyone as in ID-PKC. Thus, the scheme loses the benefit of identity-based key derivation. Consequently, public keys must be provided in some other way, such as through a public directory or by attatching them to messages in a protocol run. Since the introduction of CL-PKC, many new papers have proposed improvements and fixes to the original scheme. However, most of these concern certificateless public key encryption (CL-PKE) and thus few new primitives (such as signature schemes and key agreement protocols) have been proposed. In [2], the original CL-PKE scheme of [1] was improved both in terms of efficiency and security. Later, [62] discovered an adaptive chosen ciphertext vulnerability and proposed a countermeasure to overcome the flaw. In [20], Dent and Xxxxx argues against a claim that the certificateless schemes cannot be proven secure in the standard model.
