The zero-trust security model enhances enterprise security through proactive and real-time security strategies. It assumes that no entities within or outside the network are inherently trustworthy. Therefore, the authentication of users is given strong importance in a zero-trust system, such that, only authenticated entities can be allowed access to any of the resources of a zero-trust system. Very often, during the authentication process, verification of the digital certificates of the entities is considered indispensable. In this paper, we illustrate how the entities are registered and on-boarded into a zero-trust system using an integrated approach by the Public Key Infrastructure (PKI) and Identity and Access Management System (IAMS). The IAMS in a zero trust system can maintain the user attributes and credentials to offload some of the activities of registration authority in the PKI. We emphasize the generation of a digital certificate for the user during the registration process. Therefore, we have demonstrated the simple steps for building a Certificate Authority (CA) of the PKI of zero trust system using the Open Source Secure Sockets Layer (OpenSSL) tool, which generates the digital certificate for valid users/devices during the registration or entity onboarding. Besides, we demonstrate the authentication based on the digital certificate in the zero trust system by the Policy Enforcement Point (PEP) using its IAMS and authentication server. We show here the effectiveness of a coordinated and integrated PKI, AIMS, and PEP in user/entity onboarding, digital certificate generation, and authentication for a zero-trust system.
In a Public Key Infrastructure (PKI), it is important to store the private keys in a well-protected storage as they provide ownership and control over the digital assets. The compromise of private keys may bring the security breakdown of the system with no possible recovery. This article focuses on the security considerations of the PKI entities in distributed applications using permissioned blockchain i.e., Hyperledger Fabric (HLF). The PKI based Certificate Authority (CA) in HLF is responsible for identity management in the framework by generating the public-private key pairs and certificates for each entity in the fabric. The private keys of the entities are stored in a readily accessible format. There are various protected storages like hot and cold wallets, secures databases that have been discussed throughout the literature. Hardware Security Modules (HSMs) are the devices that follow defacto cryptographic standard for securing keys in any cryptographic implementation. This paper presents the prototype for integration of our indigenous CA for HLF with HSM. The practical demonstration of the study is done using softHSM an emulation of physical HSM that is available in open source.
In the realm of modern drone communication, where the exchange of sensitive data is ubiquitous, the assur-ance of authentication, confidentiality and integrity stands as paramount. This research paper delves into the application of Public Key Infrastructure (PKI) as a robust cryptographic frame-work to fortify the communication channels utilized by drones. Through a comprehensive exploration of PKI's mechanisms, this paper elucidates its role in ensuring the confidentiality of trans-mitted data through encryption and the preservation of integrity via digital certificates and authentication processes. Drawing upon theoretical foundations and practical implementations, this paper underscores the critical importance of PKI in safeguarding drone communication against eavesdropping, tampering, and unauthorized access. Furthermore, it examines contemporary challenges and emerging trends in PKI integration within drone networks, offering insights into potential avenues for future research and development. Drones are now essential instruments in several fields, such as emergency response, surveillance, and agriculture. Nonetheless, protecting drone communication from manipulation, illegal access, and data breaches is crucial. In addition to PKI, this paper explores the specific roles of certificate pinning and key pinning in enhancing drone communication security. Both techniques serve to further solidify the trust and authenticity of the communication endpoints, providing additional layers of protection. The purpose of this paper is to examine how PKI protects the authentication, integrity, and confidentiality of drone communications. The significance of PKI in strengthening the security posture of drone systems is emphasized by this research through an extensive examination of the body of literature and an analysis of PKI deployment options.
Code-based cryptography is one of the main candidates in quantum-resistant cryptographic techniques. LEDAcrypt is a code-based cryptographic scheme submitted in the 2nd round to the National Institute of Standards and Technology (NIST) postquantum cryptography contest. Information set decoding (ISD) attacks, first introduced by Eugene Prange, are well-known non-structural attacks used effectively for code-based cryptography. After several improvements of the basic ISD algorithm, Stern's ISD $(ISD_{Stern})$ and two recent improvements by Finiasz and Sendrier's ISD $(ISD_{FS})$ and May, Meurer and Thomae's ISD $(ISD_{MMT})$ draw significant attention. This paper demonstrates a detailed security analysis of key-recovery attacks using ISD and a comparative study of three ISD algorithms concerning the QC-LDPC-based McEliece cryptosystem variant of LEDAcrypt. Additionally, we have updated the LEDAcrypt parameter table from the original submission, incorporating two new parameters based on the ISD analysis. Simulation results show that the computational cost of $ISD_{MMT}$ is lower than the $ISD_{Stern}$ and $ISD_{FS}$ when applied for LEDAcrypt.
Traditional encryption systems, such as DES and Triple DES, face challenges when applied to images due to their high redundancy and large size. To address these challenges, this paper explores secure image encryption by comparing two hybrid cryptosys-tems, AES-256-GCM-SHA384 and ChaCha20-Poly1305-SHA256. Implemented locally in Python, these systems use the Elliptic Curve Diffie-Hellman (ECDH) algorithm for key exchange and their respective algorithms for bulk encryption, similar to those used in TLS 1.3. This work evaluates the performance and security of these systems using metrics including Mean Squared Error (MSE), Peak Signal-to-Noise Ratio (PSNR), Structural Similar-ity Index (SSIM), entropy, total encryption/decryption process time, Number of Pixel Change Rate (NPCR), Unified Average Changing Intensity (UACI), correlation coefficients, and Bit Error Rate (BER). A dataset of 10 satellite images is used for testing. The results show that AES-based cryptosystems outperform ChaCha20-based systems in speed, and both exhibit robust security features. Visual analysis, histogram, and correlation plots further validate the strength of the encryption. The paper concludes with proposed future research directions, including analysis of various image types, integration of post-quantum cryptography, and exploration of lightweight cryptography for resource-constrained PKI environments.
