2372 IEEE TRANSACTIONS ON WIRELESS COMMUNICATIONS, VOL. 10, NO.

7, JULY 2011
Generalized Digital Certicate for
User Authentication and Key Establishment for
Secure Communications
Lein Harn and Jian Ren, Senior Member, IEEE
AbstractPublic-key digital certicate has been widely used
in public-key infrastructure (PKI) to provide user public key
authentication. However, the public-key digital certicate itself
cannot be used as a security factor to authenticate user. In this
paper, we propose the concept of generalized digital certicate
(GDC) that can be used to provide user authentication and key
agreement. A GDC contains users public information, such as
the information of users digital drivers license, the information
of a digital birth certicate, etc., and a digital signature of
the public information signed by a trusted certicate authority
(CA). However, the GDC does not contain any users public
key. Since the user does not have any private and public key
pair, key management in using GDC is much simpler than using
public-key digital certicate. The digital signature of the GDC
is used as a secret token of each user that will never be revealed
to any verier. Instead, the owner proves to the verier that
he has the knowledge of the signature by responding to the
veriers challenge. Based on this concept, we propose both
discrete logarithm (DL)-based and integer factoring (IF)-based
protocols that can achieve user authentication and secret key
establishment.
Index TermsPublic-key digital certicate, user authentica-
tion, key management.
I. INTRODUCTION
A
digital certicate is the combination of a statement and
a digital signature of the statement. The well-known
digital certicate is the X.509 public-key digital certicate
[1]. The statement generally contains the users public key
as well as some other information. The signer of the digital
signature is normally a trusted certicate authority (CA). The
X.509 public-key digital certicate has been widely used in
public-key infrastructure (PKI) to provide authentication on
the users public key contained in the certicate. The user is
authenticated if he is able to prove that he has the knowledge
of the private key corresponding to the public key specied in
the X.509 public-key digital certicate. However, the public-
key digital certicate itself cannot be used to authenticate a
user since a public-key digital certicate contains only public
Manuscript received October 27, 2010; revised March 25, 2011; accepted
March 27, 2011. The associate editor coordinating the review of this paper
and approving it for publication was W. Lou.
L. Harn is with the Department of Computer Science and Electrical
Engineering, University of MissouriKansas City, MO 64110, USA (e-mail:
[email protected]).
J. Ren is with the Department of Electrical and Computer Engineering,
Michigan State University, East Lansing, MI 48824, USA (e-mail: ren-
[email protected]).
This work was supported in part by the US National Science Foundation
under CAREER Award CNS-0845812 and grants CNS-0848569 and CNS-
1050326.
Digital Object Identier 10.1109/TWC.2011.042211.101913
information and can be easily recorded and played back once
it has been revealed to a verier.
In this paper, we propose an innovative approach which
enables a user to be authenticated and a shared secret session
key be established with his communication partner using any
general form of digital certicates, such as a digital drivers
license, a digital birth certicate or a digital ID, etc. We
call this kind of digital certicate as a generalized digital
certicate (GDC). A GDC contains users public information
and a digital signature of this public information signed by
a trusted CA. However, in GDC, the public information does
not contain any users public key. Since user does not have
any private and public key pair, this type of digital certicate
is much easier to manage than the X.509 public-key digital
certicates. The digital signature of the GDC is used as a
secret token of each user. The owner of a GDC never reveals
signature of GDC to a verier in plaintext. Instead, the owner
computes a response to the veriers challenge to prove that
he has the knowledge of the digital signature. Thus, owning
a GDC can provide user authentication in a digital world. In
addition, a secret session key can be established between the
verier and the certicate owner during this interaction.
There are three entities in a digital certicate application.
They are the following:
a) Certicate Authority (CA): CA is the person or orga-
nization that digitally signs a statement with its private key.
In PKI applications, the X.509 public-key digital certicate
contains a statement, including the users public key, and a
digital signature of the statement. The difference between the
GDC and the existing public-key digital certicate is that in
a GDC, the public information does not contain any users
public key.
b) Owner of a GDC: The owner of the GDC is the
person who receives the GDC from a trusted CA over a secure
channel. The owner needs to compute a valid answer in
response to the veriers challenged question in order to be
authenticated and establish a secret session key.
c) Verier: The verier is the person who challenges the
owner of a GDC and validates the answer using the owners
public information and CAs public key.
In most paper-world user identication applications, a
trusted authority is responsible for issuing identication card
with user information, such as user name and a personal
photo on the card, to each user. Each user can be successfully
identied if the user owns a legitimate paper certicate and
matches the photo on the card. The built-in tamper-resistant
technology made the identication cards very difcult to be
1536-1276/11$25.00 c 2011 IEEE
HARN and REN: GENERALIZED DIGITAL CERTIFICATE FOR USER AUTHENTICATION AND KEY ESTABLISHMENT FOR SECURE COMMUNICATIONS 2373
forged. Therefore, owning a paper certicate is the factor in
the authentication process. In this paper, our goal is to propose
a similar solution in electronic-world applications. We call it
the generalized digital certicate (GDC). A GDC contains
public information of the user and a digital signature of the
public information signed by a trusted certicate authority.
The digital signature will never be revealed to the verier.
Therefore, the digital signature of a GDC becomes a security
factor that can be used for user authentication.
The rest of this paper is organized as follows. In the
next section, we provide an overview of the related work.
In Section III, we introduce some preliminaries and also
describe discrete Logarithm (DL)-based user authentication
and key establishment protocol using GDC. In Section IV,
we describe integer factoring (IF)-based user authentication
and key establishment protocol. We conclude in Section V.
II. RELATED WORK
User authentication and key establishment are two funda-
mental services in secure communications. Extensive research
has been conducted in both areas. However, unlike the GDC as
we propose in this paper, most schemes in literature rely on the
public-key digital certicates in providing user authentication
and key establishment [2][4].
A traditional digital signature provides authentication of a
given message to the receiver. However, this approach can
sometimes violate the signers privacy. A malicious receiver
can reveal the senders digital signature to any third-party
without the senders consent. Subsequently, anyone can access
the signers public key and validate the digital signature. In
1989, Chaum and Antwerpen [5] introduced the notion of
an undeniable signature, which enables the signer to have a
complete control over his/her signature. The verication of
an undeniable signature requires participation of the message
signer. However, this arrangement can prevent undesirable
veriers from validating the signature. The real problem of the
undeniable signature is that the signer needs to authenticate the
verier before helping the verier to validate the undeniable
signature. Some recent works can be found in [6], [7].
Designated verier signature (DVS) was rst introduced
in [8], and also in [9] independently, both in 1996. A DVS
provides authentication of a given message to a specied
verier. One unique property of a DVS is that a valid DVS
can be generated by the real signer or by the designated
verier. With this unique property, a DVS is different from
a traditional digital signature in two aspects. (i) Since the
designated verier knows that he/she did not generate the DVS
him/herself, the designated verier is therefore convinced that
the DVS was generated by the real signer. However, unlike
the traditional digital signature, which can be veried by any
veriers, for the DVS, no third party member can determine
the real signer of the DVS even with knowledge of the private
key. (ii) A DVS provides authentication of a given message
without non-repudiation property of the traditional digital
signature. A DVS can replace the traditional digital signature
in most applications and provide services with deniability.
In [8], a DVS scheme based on a non-interactive undeniable
signature scheme with a trap-door commitment was proposed,
however, this scheme is computationally inefcient. A DVS
can be established by setting the number of signers in a ring
signature to two, as proposed in [10], [11]. However, a DVS
based on ring signatures does not provide strong designated
verier properties. In [12], a DL-based DVS scheme based
on the combination of Schnorr signature [13] and Zheng
signature [14] was proposed. It is a pairing-based variant of
[10]. More recently, DVS schemes based on any bilinear map
was proposed [15].
The concept of universal DVS (UDVS) was proposed in
[16]. A UDVS is an ordinary digital signature with the
additional functionality that allows the owner of a digital
signature to convert the signature into a DVS of any designated
verier at his choice. The construction of a UDVS scheme
(DVSBM) was based on a bilinear map. Three new UDVS
constructions based on Schnorr [13] and RSA signatures [17]
were proposed in [18]. Also, the ElGamal-based UDVS has
been proposed in [15]. Some other related research on the
DVS and UDVS can be found in [19][21].
Similar to our proposed scheme, there are three entities
in each UDVS application: the CA, the owner of a digital
signature, and the designated verier. However, in a UDVS,
the owner needs to convert the digital signature into a DVS
non-interactively in order to authenticate a message. While
in our proposed scheme, the owner of a digital certicate
interacts with a verier in order to prove the knowledge of
the digital certicate and to be authenticated by the verier.
Our proposed scheme is closely related to the ID-based
cryptography [22]. In an ID-based cryptographic algorithms,
each user needs to register at a private key generator (PKG)
and identify himself before joining the network. Once a user is
accepted, the PKG will generate a private key for the user. The
users identity (e.g. users name or email address) becomes
the corresponding public key. In this way, in order to verify a
digital signature of a message, the sender sends an encrypted
message to a receiver, a user only needs to know the identity
of his communication partner and the public key of the PKG,
which is extremely useful in cases like wireless communi-
cation where pre-distribution of authenticated public keys is
infeasible. However, in an ID-based cryptographic algorithm,
it is assumed that each user already knows the identity of
his communication partner. Based on this assumption, there is
no need, nor have feasible ways, to authenticate the identity.
This is the main advantage of ID-based cryptography. Due
to this assumption, ID-based cryptography is only limited
to applications that communication entities know each other
prior to communication. While in our proposed GDC scheme,
the user does not need to know any information of his/her
communication partner. The public information of a GDC,
such as users identity, can be transmitted and veried by
each communication entity. Furthermore, this information is
used to authenticate each other. In other words, our proposed
schemes support general PKI applications, such as Internet
e-commence, that communication entities do not need to
know each other prior to the communication. Our proposed
solution is based on the combination of a conventional digital
signature scheme and the well-known (generalized) Dife-
Hellman assumption [23], [24].
2374 IEEE TRANSACTIONS ON WIRELESS COMMUNICATIONS, VOL. 10, NO. 7, JULY 2011
III. DL-BASED PROTOCOL
A. Preliminaries
A paper certicate can be used as an users authentication
factor, but a public-key digital certicate cannot be used as an
authentication factor in network applications. This is because
a paper certicate cannot be easily forged or duplicated, but a
public-key digital certicate can be easily recorded and played
back.
In our scheme, the owner of a GDC never needs to reveal
the digital signature of the GDC in plaintext to the verier.
Instead, the owner proves that he has knowledge of the
digital signature by responding to the veriers challenge. The
knowledge of the digital signature on the GDC can provide
user authentication. The proposed protocol should satisfy the
following security requirements.
1) Unforgeability: A valid response can only be generated
by the certicate owner who knows the digital signature
of the GDC.
2) One-wayness: No other person can derive the digital
signature of the certicate based on the interaction.
3) Nontransferrability: A response to a veriers chal-
lenge cannot be transferred into a response to another
veriers challenge, which would otherwise create im-
personation of the user.
Our proposed protocol is built on the combination of the
traditional DL-based digital signature and the Dife-Hellman
Assumption (DHA) [23].
B. Review of ElGamal Digital Signature
In the ElGamal scheme [25], a large prime and a generator
in the order of 1 are assumed to be shared by all users.
The signer selects a random private key [1, 2] and
computes the corresponding public key =

mod .
The signer rst randomly selects a secret parameter
[1, 1] with gcd(, 1) = 1 and computes =

mod .
Then, is solved by knowing the signers secrets, and , as
= + mod 1, (1)
where represents the message digest of the message

.
(, ) is dened as the digital signature of the message

.
The signature (, ) can be veried by checking whether the
equation

mod , (2)
holds true.
In an ElGamal signature scheme, the parameter of the
signature can be computed off-line as =

mod . The
signature component is computed on-line. Readers can
refer to [26] for more discussion on the design of DL-
based signature schemes. Without loss of generality, we can
represent the generalized signing equation for all DL-based
signature schemes as = + mod 1 where (, , )
are three parameters from the set of values (, , ). More
specically, each parameter can be a mathematical combina-
tion of (, , ). For example, the parameter can be ,
or . The verication equation is determined accordingly as

mod . There are 18 generalized ElGamal-type

signature variants [26].
In the following discussion, we use the original ElGamal
signature as an example to present our proposed protocol.
C. Dife-Hellman Assumption (DHA)
Assume and have their private keys,

and

, and
their corresponding public keys,

mod and

mod , respectively, where is a large prime integer and

is a primitive element of the multiplicative group modulo .
Only and can compute a shared secret
,
=

=
,
mod .
DHA refers to the assumption that it is computationally
infeasible to determine
,
without knowing the private key

or

. However, solving the private key

or

from
the corresponding public key

or

is equivalent to solving
the discrete logarithm problem.
D. User Authentication and Key Establishment Protocol
1) Registration at CA: Let be the certicate owner and
be the verier. needs to register at a CA to obtain
a GDC. The CA generates an ElGamal signature (

)
for user s statement

according to equation (1), where

is the message digest of the statement

. Since the
signature component

is a random integer and does not

depend on

, it does not need to be kept secret. However,

the signature component

is a function of the statement.

Each owner needs to keep it secret from the verier in
the authentication process. Our user authentication and key
establishment protocol is illustrated in Fig. 1.
2) Protocol: The authentication and key establishment pro-
tocol contains the following four steps:
1) The user passes his user information

and parame-
ters (

) to the verier , where

mod .
2) After receiving

and (

), the verier checks

whether

mod , (3)
where is the public key of the CA. If this equality
holds true, the verier rst randomly selects an
integer

[1, 2], then computes a challenge

mod and send

to the user . Otherwise,

the user authentication fails and the protocol is stopped.
3) The user rst uses his secret

to compute the
Dife-Hellman secret key
,
=

mod ,

,
=
(
,
), where (
,
) represents a key derivation
procedure with
,
as an input. Then user randomly
selects an integer

[1, 2], computes

mod and the response = (

,
,

),
where (

,
,

) represents a one-way keyed-

hash function under the key

,
. The user sends
and

back to .
4) After receiving the and

from the user , the ver-

ier uses his secret

to compute the Dife-Hellman

shared secret key
,
=

mod ,

,
=
(
,
), and checks whether (

,
,

) =
is true. If this verication is successful, the certicate
owner is authenticated by the verier and a one-
time secret session key

mod is
HARN and REN: GENERALIZED DIGITAL CERTIFICATE FOR USER AUTHENTICATION AND KEY ESTABLISHMENT FOR SECURE COMMUNICATIONS 2375
4
Step
2
3
1
User A Verier B
Computes S
A
= r
s
A
A
mod p
m

A
, r
A
, S
A
If g
m
A
= y
r
A
A
S
A
mod p
then authentication fails.
Otherwise, B randomly selects v
B
[1, p 2]
and computes c
B
= r
v
B
A
mod p
c
B
Computes K
A,B
= c
s
A
B
mod p, K

A,B
= D(K
A,B
)
Randomly selects v
A
[1, p 2]
Computes c
A
= r
v
A
A
mod p and Ack = h(K

A,B
, c
B
c
A
)
Ack, c
A
Computes K
B,A
= S
v
B
A
mod p
K

B,A
= D(K
B,A
)
If Ack = h(K

B,A
, c
B
c
A
)
then A is authenticated
and c
v
A
B
= c
v
B
A
mod p is the established key.
otherwise, the authentication fails.
Fig. 1. DL-based authentication and key agreement protocol.
shared between and . This shared key can provide
perfect forward security.
In order to be authenticated successfully by the verier, in our
protocol, the certicate owner needs to compute and send a
valid pair (

) and to the verier in steps 1) and 3).

The parameters (

) need to satisfy

mod .
This pair of integers can be easily solved by anyone. However,
we want to show that only the certicate owner who knows
the secret exponent of

can compute a valid . This

is because the verier can compute the one-time secret
key
,
used in generating the as
,
=

mod . According to the DHA, the certicate owner

who knows the secret exponent of

can also compute

,
as
,
=

=
,
mod . Thus,
the certicate owner can interact with the verier and be
authenticated successfully.
Remark 1: As we have discussed previously, a valid

can
be solved by anyone, including the verier. Thus, technically,

does not need to be transmitted in step 2). However, if the

prover sends

in step 2), it can help the verier to terminate

the protocol immediately once an invalid

is detected.
E. Security Analysis and Discussion
In this section, we will analyze the security of the proposed
user authentication and key establishment protocol for the
unforgeability, one-wayness and nontransferability.
a) Unforgeability: In order to perform a forgery attack,
the attacker needs to present a valid pair (

) in step 1)
and the corresponding in step 3) in order to impersonate
the certicate owner successfully. A valid pair (

) alone
in step 1) cannot be used to authenticate the certicate owner
since this pair of parameters can be solved easily by the
attacker from equation (3). However, it is computationally
infeasible for the attacker to nd the discrete logarithm of

because the security of the ElGamal signature scheme.

Therefore, it is computationally infeasible for the attacker to
get a pair (

) to satisfy

mod . Due
to the DHA, without knowing the secret exponent of

,
it would be infeasible for the attacker to compute
,
and forge a valid in step 3). On the other hand, the
certicate owner obtains the secret exponent of

from
CA during the registration and the certicate owner can be
authenticated successfully in step 3). In summary, the security
of the unforgeability of our proposed protocol is provided
through combination of the security of the ElGamal signature
scheme and the DHA.
Therefore, the proposed user authentication and key estab-
lishment protocol is secure against forgery attacks.
2376 IEEE TRANSACTIONS ON WIRELESS COMMUNICATIONS, VOL. 10, NO. 7, JULY 2011
b) One-wayness: In step 1), the certicate owner
presents

to the verier. The computation of secret

from

is infeasible since computation of

from the

is a
discrete logarithm problem. Also, in step 3), the certicate
owner uses the secret

to compute the Dife-Hellman key

,
. Although the verier knows the Dife-Hellman key

,
; but due to the DHA, the verier cannot obtain the
secret

. Therefore, our proposed protocol satises the one-

wayness property.
c) Nontransferability : Due to the DHA, a valid response
can only be generated by a certicate owner who knows
the secret digital signature component

such that

mod , or by a verier who knows the random secret of

a random challenge selected by the verier. As the verier
selects a random challenge each time, the response is only
valid for a one-time authentication.
Since the digital signature of a GDC is never passed to the
verier, the verier cannot pass the complete GDC to any third
party. There is no privacy intrusion problem in our protocol.
Therefore, a valid response cannot be transferred into a
response of another veriers challenge.
Our protocol enables a certicate owner to be authenticated
and two one-time shared secret keys
,
and

mod be established between , the certicate

owner, who knows

such that

mod , and the

verier through the authentication protocol. The former is
used to generate the , and the latter is established shared
secret key between and . In addition, it enables the owner
to send a conrmation to the verier. Since the Dife-
Hellman secret shared key can be generated by either or ,
the certicate owner can deny participating in the protocol.
Remark 2: In the original DHA, it is assumed that the
generator is a primitive element of the multiplicative group
modulo ; while the parameter

mod in Theorem 1
is not necessarily a generator. However, we can ensure that

is a primitive element of the multiplicative group modulo by

requiring (, 1) = 1 [27]. Particularly, when = 2

+1
is a safe prime, where

is also a prime, we can ensure

is a primitive element of the multiplicative group modulo if

is an odd number.
Remark 3: Similar to the ID-based cryptographic algo-
rithms, our proposed protocol also has the key escrow prob-
lem, that is the CA knows the one-time secret session key
shared between the users. Some cryptographic algorithms have
been proposed to solve the key escrow problem of the ID-
based signature (IBS) while enjoying the benets of the IBS,
such as certicateless digital signature (CDS) [28].
IV. IF-BASED PROTOCOL
In this section, we propose an IF-based user authentication
and key establishment protocol. It is a combination of an on-
line/off-line digital signature [29] and a generalized Dife-
Hellman assumption (GDHA) [24].
A. Review of On-line/Off-line Digital Signature
We will review the trapdoor hash families and the on-
line/off-line signature scheme based on the trapdoor hash
families.
A trapdoor hash family, introduced in [30] and formally
dened in [29], consists of a pair (, ), where is a
probabilistic polynomial-time key generation algorithm, and
is a family of randomized hash family. generates a pair
(, ), where is a (public) hash key, and is its
associated (private) trapdoor key. A trapdoor hash function in
is a hash function with a trapdoor secret. It is represented
as

(, ), where is a message and is an auxiliary

random number. A trapdoor hash function must satisfy the
following three requirements:
Efciency: Given a hash key and a pair
(, ),

(, ) is computable in polynomial time.

Collision resistance: There is no probabilistic
polynomial-time algorithm , on input , that
can generate two pairs (
1
,
1
) and (
2
,
2
) such that

1
=
2
and

(
1
,
1
) =

(
2
,
2
) with
non-negligible probability.
Trapdoor collision: Given pairs (, ), (
1
,
1
)
and an additional message
2
, there exists a probabilistic
polynomial-time algorithm that generates
2
such that

(
1
,
1
) =

(
2
,
2
).
If
1
is uniformly distributed in , then the distribu-
tion of
2
is computationally indistinguishable from
uniform distribution in .
B. Factoring-Based Trapdoor Hash Function
Choose at random two safe primes and (i.e. primes
such that

= ( 1)/2 and

= ( 1)/2 are primes) and

compute = . Choose at random an element of order
(), where () = lcm( 1, 1) = 2

. The public
hash key is (, ) and the private trapdoor key is
(, ). The trapdoor hash function

(, ) is dened as
follows:

(, ) =

mod , (4)
where denotes concatenation. To show that the

(, )
is a trapdoor hash function under the factoring assumption,
one needs to show that it fullls the three main properties
of a trapdoor hash function. The proof that

(, ) is a
factoring based trapdoor hash function can be found in [29].
For given pairs (, ), (
1
,
1
) and an additional
message
2
, to compute a trapdoor collision, we need to
compute an
2
such that

(
1
,
1
) =

(
2
,
2
).
According to equation (4), equivalently, we should have

1
=

2
mod . That is, we need to nd an
2
such that 2

1
+
1
= 2

2
+
2
mod (), where is
the size of the auxiliary parameter . Given the trapdoor key
= (, ), () can be computed in polynomial time and
hence
2
can be computed in polynomial time by solving the
linear equation

2
= 2

(
1

2
) +
1
mod ().
C. Signature scheme
In [29], a hash-sign-switch paradigm in which any regular
digital signature scheme combined with a trapdoor hash family
in (, ) can be converted into an on-line/off-line signature
scheme. Basically, in the off-line phase, a signer generates a
HARN and REN: GENERALIZED DIGITAL CERTIFICATE FOR USER AUTHENTICATION AND KEY ESTABLISHMENT FOR SECURE COMMUNICATIONS 2377
hash value to commit to an arbitrarily selected message. In the
on-line phase, given a message, the signer nds a collision of
the trapdoor hash to the previously calculated hash value. The
collision point and the signature generated in the off-line phase
can be presented as the signature for the message generated
in the on-line phase.
Let

(, ) be a trapdoor hash function, be the

hash key, be the associated trapdoor key, be the
verication key, and be the signing key for any regular
digital signature scheme. The following describes the on-
line/off-line signature scheme:
Key generation algorithm GEN: Generate a pair
(, ) using a public-key generation algorithm and a
pair (, ) using the algorithm. The signing key is
(, , ) and the verication key is ( , ).
Signing algorithm SIGN: Given a signing key
(, , ), the signing algorithm operates as
follows:
Off-line phase: The signer randomly selects (, )
and computes

(, ), then uses his se-

cret key to sign

(, ) and ob-
tain

(, )). The signer stores , ,

(, )) and optionally

(, ) to
avoid re-computation during the on-line phase.
On-line phase: Given a message

, the signer
nds a collision of the trapdoor hash for
(, ) such that

) =

(, ).
The signature of message

is dened as

(, )),

(, ).
Verication algorithm VERF: First verify

(, )) using and

(, ),
and then compute

) to verify if

(, ) =

).
D. Generalized Dife-Hellman Assumption (GDHA)
Assume and have their private keys

and

,
and their corresponding public keys

mod and

mod , respectively. Let = , where and

are two large primes. Then it is assumed that only and can
compute a shared secret
,
=

mod . GDHA
refers to the assumption that it is computationally infeasible to
determine
,
without knowing the private key

or

.
It has been shown in [24] that GDHA is a valid assumption
as long as factoring Blum-integers is hard.
E. User Authentication and Key Establishment Protocol
1) Registration at CA: Let be the certicate owner and
be the verier. needs to register at a CA to obtain
a GDC. The CA generates an on-line/off-line digital sig-
nature, (

)),

)), for user s

statement

. Each owner needs to keep the signature

secret from the verier in the authentication protocol. While

proving knowledge of the secret component to the verier, the
owner conceals the secret component to the verier during the
authentication phase following the GDHA. Our user authen-
tication and key establishment protocol is illustrated in Fig.
2.
2) Protocol: The authentication and key establishment pro-
tocol contains the following four steps:
1) The user passes his user information

and pa-
rameters (

)),

)), to the
verier , where

mod .
2) After receiving

and
(

)),

)), rst veries

that (

)) is the signature of (

)
using the . Then, computes

) =
2

mod ,
and verify if

) =

), where
is the length of the secret exponent

. If this equality
holds true, the verier rst randomly selects an integer

[1, 1], then computes

mod and
sends

to the user . Otherwise, the user authentica-

tion fails and the protocol is stopped.
3) The user rst uses his secret

to compute the
Dife-Hellman secret key
,
=

mod ,

,
=
(
,
). Then user randomly selects an integer

[1, 1], computes

mod and the

response = (

,
,

), where (
,
)
represents a key derivation procedure with
,
as
an input, (

,
,

) represents a one-way keyed-

hash function under the key

,
. The user sends
and

back to .
4) After receiving the and

from the user , the ver-

ier uses his secret

to compute the Dife-Hellman

shared secret key
,
=

mod ,

,
=
(
,
), and checks whether (

,
,

) =
is true. If this verication is successful, the certicate
owner is authenticated by the verier and a one-
time secret session key

mod is
shared between and . This key can provide perfect
forward security.
In order to be authenticated successfully by the verier, in our
protocol, the certicate owner needs to compute and sends
valid parameters (

)),

)) and
to the verier in steps 1) and 3). The parameter

needs
to satisfy

) =
2

mod .
This parameter can be easily solved by anyone or is publicly
available. However, we want to show that only the certicate
owner who knows the secret exponent of

can compute
a valid . This is because the verier can compute the
one-time secret key
,
used in generating as
,
=

mod . According to the GDHA, the certicate

owner who knows the secret exponent of

can also
compute
,
as
,
=

=
,
mod .
Thus, the certicate owner can interact with the verier and
be authenticated successfully.
Remark 4: In our proposed protocol, CA generates an on-
line/off-line digital signature for each registered user. The CA
does not actually need the trapdoor property of the one-way
hash function. In fact, The CA does not need the trapdoor key.
It only needs to use the one-way hash property to compute
a hash value

. Also, in order to construct an IF-based

2378 IEEE TRANSACTIONS ON WIRELESS COMMUNICATIONS, VOL. 10, NO. 7, JULY 2011
2
1
4
Step
3
User A Verier B
Computes S
A
= g
s
A
A
mod n
m
A
, S
SK
(h
HK
(m

, s

)), S
A
, h
HK
(m

, s

)
Veries signature S(h
HK
(m

, s

)) of h
HK
(m

), and
h
HK
(m
A
, S
A
) = h
HK
(m

, s

))
The program stops if the authentication fails.
Otherwise, randomly selects v
B
[n 1], and
computes c
B
= g
v
B
mod n
c
B
Computes K
A,B
= c
s
A
B
mod n, K

A,B
= D(K
A,B
)
Randomly selects an integer v
A
[1, n 1]
Computes c
A
= g
v
A
mod n, and Ack = h(K

A,B
, c
B
c
A
)
Ack, c
A
Computes K
B,A
= S
v
B
A
mod p
K

B,A
= D(K
B,A
)
If Ack = h(K

B,A
, c
B
c
A
),
then A is authenticated
and c
v
A
B
= c
v
B
A
mod n is the established key.
Otherwise, the authentication fails.
Fig. 2. IF-based authentication and key agreement protocol.
protocol, the CA needs to use the RSA signature to digitally
sign the hash value (

).
F. Security Analysis and Discussion
The security of this protocol relies on the combination of
the security of the RSA signature, collision resistance of the
one-way hash function and the GDHA. The On-line/Off-line
digital signature is secure against adaptive-chosen message
attacks, provided that the original scheme is secure against
generic chosen-message attacks [29]. It has also proved that
the trapdoor hash function is collision resistance [29]. Similar
to the security analysis presented in Section III-E for the DL-
based protocol, the proposed IF-based protocol also satises
the properties of unforgeability, one-wayness and nontransfer-
ability. The protocol also provides deniable authentication and
protects privacy of the digital certicate.
V. CONCLUSION
In this paper, we have proposed a novel design in using
a GDC for user authentication and key establishment. In our
design, a GDC does not contain the users public key. Since
the user does not have any private and public key pair, this type
of digital certicate is much easier to manage than the X.509
public-key digital certicates. Our approach can be applied to
both DL-based and IF-based public-key cryptosystems.
REFERENCES
[1] Network Working Group, Internet X.509 public key infrastructure
certicate and crl prole, RFC: 2459," Jan. 1999.
[2] C. Tang and D. Wu, An efcient mobile authentication scheme for
wireless networks," IEEE Trans. Wireless Commun., vol. 7, pp. 1408-
1416, Apr. 2008.
[3] G. Yang, Q. Huang, D. Wong, and X. Deng, An efcient mobile
authentication scheme for wireless networks," IEEE Trans. Wireless
Commun., vol. 9, pp. 168-174, Jan. 2010.
[4] J. Chun, J. Hwang, and D. Lee, A note on leakage-resilient authenti-
cated key exchange," IEEE Trans. Wireless Commun., vol. 8, pp. 2274-
2279, May 2009.
[5] D. Chaum and H. van Antwerpen, Undeniable signatures," Advances in
Cryptology - Crypto89, Lecture Notes in Computer Science, vol. 435,
pp. 212-217, 1989.
[6] M. Bohj and M. Kjeldsen, Cryptography report: undeniable signature
schemes," Tech. Rep., Dec. 15, 2006.
[7] X. Huang, Y. Mu, W. Susilo, and W. Wu, Provably secure pairing-based
convertible undeniable signature with short signature length," Pairing-
Based Cryptography -C Pairing 2007, vol. 4575/2007 of Lecture Notes
in Computer Science, pp. 367-391, Springer Berlin / Heidelberg, 2007.
[8] M. Jakobsson, K. Sako, and R. Impagliazzo, Designated verier
proofs and their applications," Advances in Cryptology - EUROCRYPT,
pp. 143-154, 1996. LNCS Vol 1070.
[9] D. Chaum, Private signature and proof systems," 1996.
[10] R. Rivest, A. Shamir, and Y. Tauman, How to leak a secret," Advances
in Cryptology-ASIACRYPT, Lecture Notes in Computer Science, vol.
2248/2001, Springer Berlin / Heidelberg, 2001.
[11] J. Ren and L. Harn, Generalized ring signatures," IEEE Trans. De-
pendable Secure Comput., vol. 5, no. 4, Oct.-Dec., pp. 155-163, 2008.
[12] S. Saeednia, S. Kremer, and O. Markowitch, An efcient strong
designated verier signature scheme," ICISC 2003, vol. 2836 of Springer
Lecture Notes in Computer Science, pp. 40-54, 2003.
HARN and REN: GENERALIZED DIGITAL CERTIFICATE FOR USER AUTHENTICATION AND KEY ESTABLISHMENT FOR SECURE COMMUNICATIONS 2379
[13] C. Schnorr, Efcient signature generation by smart cards," J. Cryptol-
ogy, vol. 4, no. 3, pp. 161-174, 1991.
[14] Y. Zheng, Digital signcryption or how to achieve cost (signature
& encryption << cost (signature) + cost (encryption)," Advances in
Cryptology - Crypto97, Lecture Notes in Computer Science vol. 1294,
pp. 165-179, 1997.
[15] F. Laguillaumie and D. Vergnaud, Designated verier signatures:
anonymity and efcient construction from any bilinear map." IACR e-
print.
[16] R. Steinfeld, L. Bull, H. Wang, and J. Pieprzyk, Universal designated
verier signatures," in Asiacrypt03, vol. LNCS 2894, pp. 523-542,
2003.
[17] R. Rivest, A. Shamir, and L. Adleman, A method for obtaining dig-
ital signatures and public-key cryptosystems," Commun. Assoc. Comp.
Mach., vol. 21, no. 2, pp. 120-126, 1978.
[18] R. Steinfeld, H. Wang, and J. Pieprzyk, Efcient extension of stan-
dard schnorr/rsa signatures into universal designated-verier signatures,"
PKC04, vol. Springer Lecture Notes in Computer Science of 2947,
pp. 86-100, 2004.
[19] H. Lipmaa, G. Wang, and F. Bao, Designated verier signature
schemes: Attacks, new security notions and a new construction," in
ICALP05, 2005.
[20] Y. Li, W. Susilo, Y. Mu, and D. Pei, Designated verier signature:
Denition, framework and new constructions," Ubiquitous Intelligence
and Computing, vol. 4611/2007, Springer Berlin / Heidelberg, 2007.
[21] A. Mihara and K. Tanaka, Universal designated-verier signature with
aggregation," in Proc. Third International Conf. Inf. Technol. Appl.,
2005.
[22] A. Shamir, Identity-based cryptosystems and signature schemes," in
Advances in Cryptology: Proc. Crypto84, Lecture Notes in Computer
Science vol. 196, (Berlin), pp. 47-53, Springer-Verlag, 1985.
[23] W. Dife and M. E. Hellman, New directions in cryptography," IEEE
Trans. Inf. Theory, vol. 22, pp. 644-654, 1976.
[24] E. Biham, D. Boneh, and O. Reingold, Breaking generalized Dife-
Hellman modulo a composite is no easier than factoring," Inf. Process.
Lett., vol. 70, pp. 83-87, 1999.
[25] T. A. ElGamal, A public-key cryptosystem and a signature scheme
based on discrete logarithms," IEEE Trans. Inf. Theory, vol. 31, no. 4,
pp. 469-472, 1985.
[26] L. Harn and Y. Xu, Design of generalized ElGamal type digital
signature schemes based on discret logarithm," Electron. Lett., vol. 30,
no. 24, pp. 2025-2026, 1994.
[27] R. Lidl and H. Niederreiter, Finite Fields. Cambridge University Press,
2000.
[28] L. Harn, J. Ren, and C. Lin, Design of DL-based certicateless digital
signatures," J. Syst. Software, vol. 82, pp. 789-793, 2009.
[29] A. Shamir and Y. Tauman, Improved online/ofine signature schemes,"
in Proc. 21st Annual International Cryptology Conf. Advance Cryptol-
ogy, p. 355-367, Springer-Verlag, 2001.
[30] H. Krawczyk and T. Rabin, Chameleon signatures," in Proc. Symp.
Netw. Distributed Syst. Security (NDSS00), (Internet Society), pp. 143-
154, Feb. 2000.
Dr. Lein Harn received his Bachelor of Science
degree in Electrical Engineering from the National
Taiwan University in 1977. In 1980, he received
his MS in Electrical Engineering from the State
University of New York-Stony Brook and in 1984
he received his doctorate degree in Electrical En-
gineering from the University of Minnesota. He
joined as an Assistant Professor in the department of
Electrical and Computer Engineering at the Univer-
sity of Missouri-Columbia in 1984 and in 1986, he
moved to Computer Science and Telecommunication
Program (CSTP) of University of Missouri-Kansas City (UMKC). While at
UMKC he went on development leave to work in Racal Data Group in
Florida for a year. His research interests are cryptography, network security
and wireless communication security. He has published number of papers on
digital signature design and applications, wireless and network security. He
has written two books on Security. At present he is investigating new ways
of using digital signature in various applications.
Jian Ren received the B.S. and M.S. degrees both
in mathematics from Shaanxi Normal University,
China, in 1988 and 1991 respectively. He received
the Ph.D. degree from Xidian University in 1994.
From 1997 to 1998, he was with Racal Datacom
as a security architect. From 1998 to 2002, he was
rst with Bell-Labs and later with Avaya Labs as a
member of technical staff. He joined the Department
of Electrical and Computer Engineering department
at Michigan State University in 2005 as an assistant
professor. His current research interests are in the
areas cryptography, network security, energy efcient sensor network security
protocol design, and privacy-preserving communications. He is a recipient
of the U.S. National Science Foundation Faculty Early Career Development
(CAREER) award in 2009. He is a senior member of IEEE.