A Non-interactive Public-Key Distribution System.
An identity-based non-interactive public key distribution system is presented that is based on a novel trapdoor one-way function allowing a trusted authority to compute the discrete logarithms modulo a publicly known composite number m while this is infeasible for an adversary not knowing the factorization of m. Without interaction with a key distribution center or with the recipient of a given message, a user can generate a mutual secure cipher key based solely on the recipient's identity and his own secret key, and subsequently send the message, encrypted with the generated cipher used in a conventional cipher, over an insecure channel to the recipient. In contrast to previously proposed identity-based systems, no public keys, certificates for public keys or other information need to be exchanged and thus the system is suitable for certain applications that do not allow for interaction. The paper solves an open problem proposed by Shamir in 1984.
Introduction
In their seminal 1976 paper, Diffie and Hellman [4] introduced the ingenious concept
of public key cryptography and proposed the first public key distribution system, which
is based on exponentiation in a finite field. The basic idea of a public key distribution
system is briefly summarized in the following in order to point out the novelty in our
scheme that allows it to be non-interactive. In an insecure communication network where
all messages sent over a communication channel can be intercepted by an adversary, two
1 The results of this paper have appeared in part in the proceedings of EUROCRYPT '91, Lecture Notes
in Computer Science, Vol. 547, Springer Verlag, pp. 498-507, 1991.
parties not sharing any secret information initially can generate a secure cipher key (to be
subsequently used together with a conventional symmetric cryptosystem) by each choosing
a secret number, applying a one-way transformation to this number and exchanging the
results of this transformation (the public keys) over an insecure channel. The one-way
transformation has the property that given the result, it is infeasible to compute the
argument. The one-way transformation proposed by Diffie and Hellman has the crucial
additional property, which is due to the commutativity of multiplication, that each party
can generate the same mutual secure cipher key from his own secret number and the other
party's public key. Without knowing at least one of the secret numbers it is infeasible to
generate the secure cipher key using present technology and algorithmic knowledge.
Public-key distribution systems and public-key cryptosystems suffer from the following
well-known authentication problem. In order to prevent an adversary from fraudulently
impersonating another user, it must be possible to verify that a received public key belongs
to the user it is claimed to belong to. A commonly used solution to this authentication
problem is the certification of public keys by a trusted authority which, after checking a
user's identity, signs the concatenation of his name and public key using a digital signature
scheme. Systems based on either the RSA [25] or the ElGamal [6] signature schemes have
been proposed [8].
Shamir [27] suggested as a simple but ingenious method for solving the authentication
problem in public-key cryptography to let each user's public key be his (publicly-known)
identification information. Because it must be infeasible for users to compute the secret key
corresponding to a given identity (including their own), the secret keys must be computed
by a trusted authority who knows some secret trapdoor information. The security of such
an identity-based system depends on the trusted authority in a more crucial way than the
security of a public-key certification system because in the former the trusted authority
knows all secret keys.
Because a user's identity can be assumed to be publicly known (the identity can be
defined as that part of the identification information that is publicly known), the public
keys of an identity-based public-key cryptosystem need not be transmitted. Therefore an
identity-based system can be used in a completely non-interactive manner.
A simple way to set up an identity-based public-key cryptosystem would seem to be to
use the RSA-system with a universal modulus where each user's public encryption exponent
is his (odd, and relatively prime to '(m)) identity and in which a trusted authority
knowing the factorization of the modulus computes the secret decryption exponents for
users. However, this system is insecure because knowledge of a matching (secret/public)
allows to easily factor the modulus.
While Shamir presented an identity-based signature scheme, he proposed as an open
problem to find an identity-based public-key cryptosystem or public-key distribution system
[27]. In the context of signature schemes, however, a non-interactive system is less
advantageous than it would be in the context of a public-key cryptosystem: for any signature
scheme, the signed message can be sent together with a certified public key in one
message whereas for encryption, the sender must in a non-interactive system first obtain
the recipient's public key.
Many previously proposed systems [8, 9, 21, 22, 30] have been called identity-based
public-key distribution systems because they make use of Shamir's idea for self-authentication
of public keys. However, none of these (with the exception of the quite impractical and
also insecure version of a scheme discussed in [30]) is an identity-based system in Shamir's
sense because the public key is a function not only of the identity but also of some random
number selected either by the user or by the trusted authority. As a consequence, these
systems are bound to be interactive. A major achievement of this paper is that it presents
the first truly identity-based public-key distribution system. It should be mentioned that
the key predistribution system of Matsumoto and Imai [15], which is based on a completely
different approach, also achieves non-interactive key distribution.
The original Diffie-Hellman public key distribution system [4] with a prime modulus
p cannot be used as an identity-based system in Shamir's sense because if the scheme is
secure, that is when discrete logarithms modulo p are infeasible to compute, it is infeasible
even for a trusted authority to compute the secret key corresponding to a given public key,
i.e., a given identity. This comment applies to any public-key distribution system based
on a one-way function without trapdoor. One of the achievements of this paper is that
a method for building a trapdoor into the modular exponentiation one-way function is
proposed which allows a trusted authority to feasibly compute discrete logarithms whereas
this is completely infeasible for an adversary using present technology and algorithmic
knowledge. This allows a trusted authority to set up a non-interactive public-key distribution
system. Non-interactiveness may be crucial in some applications (e.g. electronic mail,
some military applications) and in some other applications allows at least to simplify the
protocols. The computational effort that the trusted authority must spend is considerable
but the key distribution protocol itself is very efficient.
2. A Non-interactive Public Key Distribution System
From a protocol viewpoint, the difference between a public-key distribution system
and a public-key cryptosystem is that in the former, both parties must receive the other
party's public key whereas in the latter, only the sending party must receive the public key
of the receiving party. Therefore, a public-key distribution system, when combined with a
conventional symmetric cryptosystem used for encryption, cannot be used as a public-key
cryptosystem. In contrast, a non-interactive public-key distribution system can be used
as a public-key cryptosystem by sending as one message the sender's identity and the
enciphered plaintext, where the cipher key is computed from the receiver's identity and
the sender's secret key and where some agreed conventional cipher is used for encryption
of the message.
Our non-interactive public key distribution system is based on a variant of the Diffie-Hellman
system with composite modulus m. By choosing the prime factors of m appropriately
such that discrete logarithms modulo each prime factor can feasibly be computed
but such that computing discrete logarithms modulo m is nevertheless infeasible, a trusted
authority can set up a public key distribution system based on exponentiation modulo m.
One can show that computing discrete logarithms modulo a composite number is at least
as difficult as factoring the modulus (cf. Section 3).
Two different ways of generating such a modulus m are presented below and in Section
4, respectively. To use a composite modulus prime in the
Diffie-Hellman scheme has previously been proposed by Shmuely [29] and McCurley [17]
in order to exhibit a system which to break requires the ability both to factor m and to
compute discrete logarithms modulo p and q.
Our approach to identity-based public key distribution differs in a crucial way from
previous approaches [8, 9, 21, 22, 30] in that the public key consists entirely of public
identity information (e.g. name, address, physical description), but does not depend on
an additional random number selected either by the user or the trusted authority. This
is the reason why our system can be used in a truly non-interactive manner. Clearly,
the type and amount of information about a user that can be assumed to be publicly
known depends on the application, but note that in most applications, at least part of the
identification information is indeed publicly known. For instance, the receiver's address,
which must be known in every communication system in order to send a message, can
serve as his public key.
One problem that arises in the proposed system is that the multiplicative group Z
m is
cyclic if and only if m is either 2, 4, a power of an odd prime or twice the power of an odd
prime. When m is the product of distinct odd primes there hence exists no element that
generates the entire group Z
m . Thus not every identity number that corresponds to some
valid identification information is guaranteed to have a discrete logarithm with respect
to some universal base ff. This problem could be solved by adding the smallest offset to
every identity number that makes the new number have a discrete logarithm. However, the
resulting system would have to be interactive since the offsets must be exchanged between
the users. Two different solutions to this problem are presented below and in Section 4,
respectively. Both are computationally more efficient (for the trusted authority) than the
offset method and at the same time allow to preserve the advantage of non-interactiveness
of our scheme.
r where the primes are in the following assumed to be odd
and distinct. The maximal order of an element of the multiplicative group Z
m is given by
which is at most 2 \Gammar+1 times the group order '(m). -(m)
is strictly less than '(m)=2 r\Gamma1 unless the numbers (p are pairwise
relatively prime. Let ff be an element of Z
m that is primitive in each of the prime fields
is the smallest exponent t i for
which ff t has maximal order -(m) in Z
. The discrete logarithm
of a number y modulo m to the base ff is defined as the smallest non-negative integer x
such that ff x j y (mod m) (if such an x exists) and can, when the complete factorization
of m is given, be obtained by computing for r the discrete logarithm x i of y to
the base ff modulo p i , i.e., by computing x i satisfying ff x solving the
system
of r congruences for x by the Chinese remainder technique. It follows from Theorem 5.4.2
on page 155 of [28] that this system of concruences has a solution if and only for all distinct
In particular, the above system has no solution
unless either all x i are odd or all x i are even.
For every prime q dividing at least 2 of the r numbers sq be the
maximal power of q that divides at least 2 of these numbers. Let u be the product of all
prime powers q sq , i.e., let u be the maximal integer for which every prime power dividing
also divides at least 2 of the numbers 1. The following lemma and in particular its
corollary suggests an easy to compute publicly-known function that transforms, without
use of the secret trapdoor, any identity number into a modified identity number that is
guaranteed to have a discrete logarithm.
Lemma 1. Let m, ff and u be as defined above. An element y of Z
m that can be expressed
as y j w u (mod m) for some w 2 Z
m has a discrete logarithm x modulo m to the base ff.
Moreover, x is given by the system of congruences x j uz i (mod
where z i is the discrete logarithm of w modulo p i to the base ff.
Proof. A system of congruences has a solution if and only if all congruences are consistent
when considered modulo every prime power contained in at least one of the moduli. This
condition is equivalent to the condition that the congruences be pairwise consistent modulo
the greatest common divisor of the corresponding pair of moduli. Hence the necessary and
sufficient condition for the above system of congruences to have a solution is that for any
Clearly, u is a multiple of gcd(p
any i 6= j and therefore x i.e., the system is pairwise
consistent. 2
Corollary. Let m and ff be as defined above where the numbers (p
are pairwise relatively prime. Then every square modulo m has a discrete logarithm modulo
m to the base ff.
A complete description of the preferred version of the proposed non-interactive public
distribution system follows. The following three paragraphs describe the system set
up by a trusted authority, the user registration phase and the user communication phase,
respectively.
To set up the system we suggest that a trusted authority choose the primes p i such that
the numbers (p are odd and pairwise relatively prime [16]. Preferably, (p
are chosen to be primes themselves. The primes p i are chosen small enough such that
computing discrete logarithms modulo each prime is feasible (though not trivial) using
for instance the algorithm of [3] but such that factoring the product, even with the best
known method for finding relatively small prime factors [12] of a number, is completely
infeasible. The trusted authority then computes the product
of the selected primes, determines an element ff of Z
m that is primitive in every of the
prime fields GF (p i ) and publishes m and ff as system parameters. We refer to Section 3 for
an analysis of the security versus the feasibility for different sizes of parameters. To choose
3 to 4 primes of between 60 and 70 decimal digits seems at present to be appropriate, but
these figures can vary according to future progress in computer technology and number-theoretic
algorithms. An alternative approach to making the discrete logarithm problem
feasible other than by choosing the prime factors of m sufficiently small is described in
Section 4.
When a user A wants to join the system she visits the trusted authority, presents her
identification information IDA together with an appropriate proof of her identity (e.g.
a passport) and receives the secret key s A corresponding to IDA . The above corollary
suggests as a first solution appears to be that the secret key s A can be computed by the
trusted authority as the discrete logarithm of IDA 2 modulo m to the base ff:
Due to the squaring of IDA , s A is guaranteed to exist. However, this solution is insecure
because a square root modulo m of the squared identity I A
2 can be obtained when given
the secret key
computing g SA =2 (note that SA is even). If for at least
one of the prime factors p of m,
log g I A (mod p)
while for at least some other prime factor q of m,
log g I A (mod q) - (q \Gamma 1)=2;
then the obtained square root of I A
2 is different from I A and \GammaI A and thus allows one to
find a non-trivial factor of m. This condition is satisfied by a fraction
all identities, where r is the number of distinct (odd) prime factors of m.
The described problem with equation (1) can be solved by a slight modification. The
trusted authority chooses, once and for all, a secret multiplier t at random from Z
'(m) .
Instead of issuing the discrete logarithms of squared identities as users' secret keys, the
trusted authority conceals these logarithms by multiplying them with t before issuing them
to users. Hence
In order to send a message M securely to a user B without interaction, user A establishes
the mutual secure cipher key KAB shared with user B by computing
Note that KAB j ff vs A s B (mod m) where v uses a conventional
symmetric cryptosystem (e.g. DES) to encipher the message M using the cipher key
KAB , which results in the ciphertext C. User A then sends C together with her identity
number IDA to user B. In order to decipher the received ciphertext C, user B proceeds
symmetrically and computes
He then deciphers C using the conventional cryptosystem with the secret key KAB , which
results in the plaintext message M .
Note that the trusted authority is only required for the initial system set up and for
user registration, but not in the user communication phase described above. In fact,
the trusted authority could close itself down if no additional users need to be registered,
thereby irreversibly erasing the factorization of m.
In the described system the secret key shared by two users is the same when the
protocol is repeated several times. In those cases where this is undesirable user A can
choose a random number R and use f(KAB ; R) as the mutual cipher key, where f is a
cryptographically secure hash function. R is sent to B together with the ciphertext C. In
order to prevent an adversary knowing a previously used cipher key from impersonating
at a later time, a time stamp can be used as an additional argument of the hash function.
It is possible to build a dynamic key distribution system using no hash function, that is
provably as hard (on the average) to break against a disruptive adversary as factoring the
modulus [31].
Although in the proposed trapdoor one-way function the trapdoor is the factorization
of the modulus as in the RSA trapdoor one-way function [25], the two functions are
nevertheless entirely different. In the RSA function, the argument is the base and the
exponent e is a constant whereas in our exponentiation trapdoor one-way function the
argument is the exponent and the base ff is a constant. Accordingly, the inverse operations
are the extraction of the e-th root and the discrete logarithm to the base ff, respectively,
and are infeasible to compute without knowledge of the trapdoor.
3. Security and Feasibility Analysis
We first prove a previously observed but neither published nor widely known fact about
the difficulty of computing discrete logarithms for a composite modulus (see also [2]).
Lemma 2. Let m be the product of distinct odd primes let ff be primitive in
each of the prime fields GF (p i computing discrete logarithms modulo
m to the base ff is at least as difficult as factoring m completely.
Proof. In order to apply an algorithm computing logarithms modulo m to factor m, one
can choose a number t that is larger than -(m), for example apply
the discrete logarithm algorithm to obtain t 0 satisfying ff t 0
m) and thus also
satisfying multiple of -(m). If necessary,
this computation can be repeated a few times for different choices of t, and -(m) can
be computed as the greatest common divisor of the results. Using an idea of Miller [18],
m can be factored when -(m) is known by choosing elements r of Z
m at random until
m) is a non-trivial factor of m, which happens when r is a quadratic residue
modulo some p i and a quadratic non-residue modulo some other p j , i.e., with probability
. Applying this technique several times yields the complete factorization of m.Note that for the proposed scheme,
2-(m). Therefore -(m) can be determined by a single application of the discrete logarithm
algorithm. Notice also that the results of Shmuely [29] and McCurley [17] are different from
Lemma 2 since they hold only for special moduli, but on the other hand the equivalence
of breaking their schemes and factoring is proved.
The function
is commonly used to express the conjectured asymptotic running time of number-theoretic
algorithms. The asymptotically fastest known algorithm for computing discrete logarithms
in GF (p) is the number field sieve which has asymptotic running time L p (1=3; 1), but the
fastest practical algorithm for the size of number considered here is described in [3] and
has asymptotic running time L p (1=2; 1). The largest primes for which this algorithm is at
present feasible with massively parallel computation have between 110 and 120 decimal
digits. For primes of up to 65-70 decimal digits the algorithm is feasible using a few
processors. An important feature of this algorithm is that most of the running time is
spent in a precomputation phase that is independent of actual elements for which the
logarithm is to be computed. After the precomputation, individual logarithms can be
computed much faster in asymptotic running time L p (1=2; 1=2). The algorithm is well
suited for a parallel implementation.
The largest general integers that can at present feasibly be factored using massively
parallel computation have on the order of 130 decimal digits [1]. The factoring algorithm
with the best conjectured asymptotic running time Lm (1=3; c) for some constant c ! 2 is
the number field sieve [13], but for the size of general integers m that can be factored within
reasonable time a variant of the quadratic sieve with asymptotic running time Lm (1=2; 1)
is more efficient [11]. The running time of both these algorithms is independent of the size
of the factor that is found. The best known algorithm for finding factors of moderate size
is the elliptic curve algorithm [12] which is with massively parallel computation successful
for factors with up to 40 decimal digits [10, 20]. Its asymptotic running time is L p (1=2;
where p is the factor to be found. It is the ratio L p (1=2;
of the running times of the elliptic curve factoring algorithm and the discrete logarithm
algorithm [3] that provides a range for the size of the primes for which our public-key
distribution system is both practical and secure.
It seems at present to be appropriate to choose 3 or 4 prime factors of between 70 and
decimal digits. To factor such a modulus is for all presently known factoring algorithms
completely infeasible. The largest factor that has been found by the elliptic curve algorithm
has 40 decimal digits [5]. Odlyzko [20] estimated that for a given computational effort the
size of primes modulo which discrete logarithms can be computed is 10 to 15 digits smaller
than the size of integers that can be factored. Hence with the same computational effort
that was spent on the factorization of the 129-digit number of [1], one could compute
discrete logarithms for 115-digit prime moduli. To find an 80 digit factor with the elliptic
curve factoring algorithm takes roughly
longer than to find a 40 digit factor. On the other hand, computing discrete logarithms
for a 70-digit or an 80-digit prime modulus is about
respectively, times faster than for a 115-digit prime
modulus.
We now give a brief asymptotic analysis of the work factor of our system. As mentioned
above, the number field sieve is the asymptotically fastest known factoring algorithm. In
order to ensure that the above mentioned asymptotic work factor L p (1=2;
i.e., that the elliptic curve factoring algorithm is faster than the number field sieve for
finding a factor p of the modulus m, the number k of prime factors of m must be such
that L p k(1=3; c) ? L p (1=2;
2). This condition is equivalent to
c(k log p) 1=3 (log k log log p) 2=3 ?
2(log p) 1=2 (log log p) 1=2
which is satisfied when
log p for a constant d ? (
2=c) 3 . This analysis demonstates
that future progress in computer technology is to the cryptographer's advantage (or to
the cryptanalyst's disadvantage) and allows to increase the security of the system.
4. An Alternative Implementation
In the system discussed in Section 2, the trusted authority can feasibly compute discrete
logarithms modulo the prime factors of m because these primes are chosen sufficiently
small. As a consequence, several prime factors must be used to prevent feasible factorization
of the modulus by a general-purpose factoring algorithm. In this section we suggest an
alternative method for making the computation of discrete logarithms modulo the prime
factors p i of m feasible. There is no restriction on the size of the primes and therefore it
is sufficient to use two primes of appropriate size.
There exists a discrete logarithm algorithm for GF (p) due to Pohlig and Hellman [23]
whose running time is proportional to the square root of the largest prime factor of
the factorization of known. Hence the primes p i can be chosen such that (p
is the product of some primes of a certain relatively small size. Unfortunately, there also
exists a special purpose factoring algorithm due to Pollard [24] that is particularly efficient
for finding prime factors p for which relatively small prime factors. However,
the running time of Pollard's algorithm is proportional to the largest prime factor of
rather than its square root. Therefore there may exist a range for the size of the largest
prime factors of which a system based on this idea is both practical and secure.
A possible choice could be to let m be the product of 2 primes p 1 and p 2 of about 120
decimal digits each, where (p both are the product of several 15-digit
primes.
The choice attractive because it
implies that Hence Alice's modified identity I 0
A can therefore be defined as
I 0
I A if (I
2I A if (I
which can be obtained easily from I A without knowledge of the trapdoor and is guaranteed
to have a discrete logarithm.
When the computational effort spent by the trusted authority is increased by a factor
k, this forces an adversary to increase his computational effort by a factor k 2 . Thus
when k-fold faster computer hardware becomes available this system's security can also
be increased by a factor of k. This system is asymptotically superior to the system of
Section 2 for which the work factor could be increased only by a factor k
5. Conclusions
A non-interactive public-key distribution system based on the Diffie-Hellman scheme
with a composite modulus m has been proposed in which the modular exponentiation
function contains as a trapdoor the factorization of the modulus. This solves an open
problem suggested by Shamir in 1984 [27]. The trapdoor is known only to a mutually
trusted authority setting up the system. The problem that the group Z
m is not cyclic
and therefore not every element has a discrete logarithm is solved by squaring the identity
Clearly, the presented scheme can just as well be used in applications encorporating
user interaction. In fact, the proposed scheme might be superior to previously proposed
schemes in terms of the computational efficiency of the users' cipher key generation process
because only a single modular exponentiation, but no signature verification, is required.
A remarkable property of the system is that not only the cryptanalyst, but also the
trusted authority must spend time super-polynomial in the input size. However, because
the system is used for an appropriate fixed size of parameters, the trusted authority's
computation is nevertheless feasible. Progress in computer technology can be exploited to
increase the security of the system.
There may exist different approaches to making the discrete logarithm problem feasible
only when given the factorization of the modulus. Any progress in the discrete logarithm
problem not leading to a comparable progress in the factorization problem, especially
when applicable to primes of a certain special form, has the potential of leading to an
improvement of the presented system.
An interesting open question is whether it is possible to construct primes p of a special
form containing a trapdoor such that computing discrete logarithms modulo p is feasible if
and only if the trapdoor is known. One such method, which seems to be of little practical
significance, was discovered by Odlyzko [20] who suggested to generate a prime p of the
where the a i 's are small numbers, and to exploit the fact that when m
and d are carefully chosen and when the above representation of p is known, a faster number
field sieve can be used for computing discrete logarithms than when this representation is
not known. We hope that this paper stimulates research on special-purpose factoring and
discrete logarithm algorithms.

Acknowledgements

We are grateful to Arjen Lenstra for helpful comments. We would also like to thank
Tom Berson and Jim Massey for highly appreciated discussions. and K. Ohta for drawing
our attention to the paper [19] written in Japanese, which describes a scheme having some
similarities with the first scheme presented in this paper. The first author would like
to thank Dr. P. Schmid and Martin Benninger of Omnisec AG for their comments and
generous support of this work.



--R

The magic words are squeamish os- sifrage
Discrete logarithms and factoring
Discrete Logarithms in GF (p)
New directions in cryptography
Massively parallel elliptic curve factoring
A public key cryptosystem and a signature scheme based on discrete logarithms
Advances in Cryptology - EUROCRYPT '91
An identity-based key-exchange protocol


Factoring with two large primes
Factoring integers with elliptic curves
The number field sieve
Factoring with electronic mail
On the key predistribution system: a practical solution to the key distribution problem
Fast generation of prime numbers and secure public-key cryptographic param- eters
A key distribution system equivalent to factoring
Riemann's hypothesis and tests for primality


How to utilize the randomness of zero-knowledge proofs
Key distribution based on identification information
An improved algorithm for computing logarithms over GF (p) and its cryptographic significance

A method for obtaining digital signatures and public-key cryptosystems
Elliptic curves over finite fields and the computation of square roots mod p
Advances in Cryptology - CRYPTO '84
Introduction to the theory of numbers
Composite Diffie-Hellman public-key generating systems are hard to break

"paradox"
--TR
Discrete logarithms in <italic>GF</>(<italic>p</>)
cryptosystems and signature schemes
A key distribution system equivalent to factoring
The number field sieve
An identity-based key-exchange protocol
Factoring with two large primes (extended abstract)
A method for obtaining digital signatures and public-key cryptosystems
On the Key Predistribution System
Conference Key Distribution Systems
A Key Distribution "Paradox"
The Magic Words are Squeamish Ossifrage
How to Utilize the Randomness of Zero-Knowledge Proofs
Discrete Logarithms and Factoring

--CTR
Wei-Bin Lee , Kuan-Chieh Liao, Constructing identity-based cryptosystems for discrete logarithm based cryptosystems, Journal of Network and Computer Applications, v.27 n.4, p.191-199, November 2004
Cheng-Chi Lee , Min-Shiang Hwang , Li-Hua Li, A new key authentication scheme based on discrete logarithms, Applied Mathematics and Computation, v.139 n.2-3, p.343-349, 15 July
Chris J. Mitchell , Fred C. Piper , Peter R. Wild, ID-based cryptography using symmetric primitives, Designs, Codes and Cryptography, v.44 n.1-3, p.249-262, September 2007
Rgis Dupont , Andreas Enge, Provably secure non-interactive key distribution based on pairings, Discrete Applied Mathematics, v.154 n.2, p.270-276, 1 February 2006
Hhnlein , Michael J. Jacobson, Jr. , Damian Weber, Towards Practical Non-Interactive Public-Key Cryptosystems Using Non-Maximal Imaginary Quadratic Orders, Designs, Codes and Cryptography, v.30 n.3, p.281-299, November
Ueli M. Maurer , Stefan Wolf, The DiffieHellman Protocol, Designs, Codes and Cryptography, v.19 n.2-3, p.147-171, March 2000
key management;public-key cryptography;trapdoor functions;discrete logarithms