Skip to main content

Willy Susilo

University of Wollongong, Computing and Information Technology, Faculty Member

University of Wollongong, School of Computer Science and Software Engineering, Faculty Member

Followers

404

Following

83

Co-authors

13

Mentions

1

Public Views

Willy Susilo obtained his Bachelor Degree in Computer Science from Universitas Surabaya, Indonesia with a "Summa Cum Laude" predicate. He received his Master and Doctor of Philosophy degrees from UOW in 1996 and 2001, respectively.His main research interest include cryptography and computer security, in particular the design of signature schemes. He was promoted as a Professor in the School of Computer Science and Software Engineering, University of Wollongong in 2009. Prior to his prestigious ARC Future Fellow role, he was the Head of School of SCSSE, Deputy Director of ICT Research Institute and the Academic Program Director for UoW (Singapore). He is currently the Head of School of Computing and Information Technology. He is also the Director of Institute of Cybersecurity and Cryptology.
Phone: +61-2-4221-5535
Address: School of Computer Science and Software Engineering
University of Wollongong
Northfields Avenue
Wollongong
NSW 2522
AUSTRALIA

less

Interests

Uploads

Papers by Willy Susilo

Fault Analysis of the KATAN Family of Block Ciphers

IACR Cryptology ePrint Archive, 2012

Design and Implementation of Personal Firewalls for Handheld Devices

Lattice-based IBE with Equality Test Supporting Flexible Authorization in the Standard Model

arXiv (Cornell University), Oct 26, 2020

Revocable identity-based encryption with server-aided ciphertext evolution

Theoretical Computer Science, May 1, 2020

A Generic Scheme of plaintext-checkable database encryption

Information Sciences, Mar 1, 2018

Cloud-Based Outsourcing for Enabling Privacy-Preserving Large-Scale Non-Negative Matrix Factorization

IEEE Transactions on Services Computing, 2022

Comments on “Public Integrity Auditing for Dynamic Data Sharing With Multiuser Modification”

IEEE Transactions on Information Forensics and Security, Mar 1, 2016

Generic construction for tightly-secure signatures from discrete log

Theoretical Computer Science, Oct 1, 2021

Abstract Tightly secure signature plays a significant role in the research of cryptography and ha... more Abstract Tightly secure signature plays a significant role in the research of cryptography and has been studied extensively in the literature. In this paper, we present a generic construction for tightly-secure signatures from the discrete log (DL) assumption in the existential-unforgeability against key only attacks (EUF-KOA) security model, where the adversary is allowed to obtain only the public key, but not any sample signature. Moreover, the generic construction can also be extended into the multi-user setting with corruptions (MU-C) model. Roughly speaking, given any signature scheme, we can efficiently convert it into a signature scheme that features tight security under the DL assumption in the MU-EUF-KOA-C security model with random oracles. Our transformation shows it is easy to construct a DL-equivalent signature in the EUF-KOA security model, although many known DL-based signatures are not equivalent to DL. If the given signature scheme is key-re-randomizable, the transformed scheme is also key-re-randomizable. Hence, our result provides a supplement to Bader et al.'s work (EUROCRYPT 2016).

PPDF: A Privacy-Preserving Cloud-Based Data Distribution System With Filtering

IEEE Transactions on Services Computing, 2023

Lightweight Public Key Encryption With Equality Test Supporting Partial Authorization in Cloud Storage

The Computer Journal, Dec 8, 2020

Public key encryption with equality test (PKEET) can check whether two ciphertexts are encrypted ... more Public key encryption with equality test (PKEET) can check whether two ciphertexts are encrypted from the same message or not without decryption. This attribute enables PKEET to be increasingly utilized in cloud storage, where users store their encrypted data on the cloud. In traditional PKEET, the tester is authorized by the data receiver to perform equality test on its ciphertexts. However, the tester can only test one ciphertext or all ciphertexts of one receiver with one authorization. It means that the receiver cannot adaptively authorize the test right of any number of ciphertexts to the tester. A trivial solution is authorizing one ciphertext each time and repeating multiple times. The corresponding size of trapdoor in this method is linear with the number of authorized ciphertexts. This will incur storage burden for the tester. To solve the aforementioned problem, we propose the concept of PKEET supporting partial authentication (PKEET-PA). We then instantiate the concept to a lightweight PKEET-PA, which achieves constant-size trapdoor. Besides, we prove the security of our PKEET-PA scheme against two types of adversaries. Compared with other PKEET schemes that can be used in trivial solution, our PKEET-PA is more efficient in receivers’ computation and has lower trapdoor size.

Certificateless aggregate signature scheme secure against fully chosen-key attacks

Information Sciences, Apr 1, 2020

Provably Secure Identity Based Provable Data Possession

Lecture Notes in Computer Science, 2015

Identity-Based Strong Designated Verifier Signature Schemes

Lecture Notes in Computer Science, 2004

In this paper, we propose an identity based strong designated verifier signature scheme. Firstly,... more

AAC-OT: Accountable Oblivious Transfer With Access Control

IEEE Transactions on Information Forensics and Security, Dec 1, 2015

Constant-size ciphertexts in threshold attribute-based encryption without dummy attributes

Information Sciences, Mar 1, 2018

Separable Threshold Decryption for Ad Hoc Wireless Networks

Springer eBooks, 2008

Multimodal Private Signatures

Lecture Notes in Computer Science, 2022

On the General Construction of Tightly Secure Identity-Based Signature Schemes

The Computer Journal, Mar 17, 2020

A tightly secure scheme has a reduction, where the reduction loss is a small constant. Identity-b... more A tightly secure scheme has a reduction, where the reduction loss is a small constant. Identity-based signature (IBS) is an important cryptographic primitive, and tightly secure IBS schemes enjoy the advantage that the security parameter can be optimal to achieve a certain security level. General constructions of IBS schemes (Bellare, M., Namprempre, C., and Neven, G. (2004) Security Proofs for Identity-Based Identification and Signature Schemes. In Proc. EUROCRYPT 2004, May 2–6, pp. 268–286. Springer, Berlin, Interlaken, Switzerland; Galindo, D., Herranz, J., and Kiltz, E. (2006) On the Generic Construction of Identity-Based Signatures With Additional Properties. In Proceedings of ASIACRYPT 2006, December 3–7, pp. 178–193. Springer, Berlin, Shanghai, China) and their security have been extensively studied. However, the security is not tight and how to generally construct a tightly secure IBS scheme remains unknown. In this paper, we concentrate on the general constructions of IBS schemes. We first take an insight into previous constructions and analyze the reason why it cannot achieve tight security. To further study possible tightly secure constructions, we propose another general construction, which could be seen as a different framework of IBS schemes. Our construction requires two traditional signature schemes, whereas the construction by Bellare et al. uses one scheme in a two-round iteration. There are no additional operations in our general construction. Its main advantage is providing the possibility of achieving tight security for IBS schemes in the random oracle model. Combining two known signature schemes, we present an efficient IBS scheme with tight security as an example.

Witness-based searchable encryption

Information Sciences, Jul 1, 2018

Abstract We put forward a new cryptographic primitive called witness-based searchable encryption ... more Abstract We put forward a new cryptographic primitive called witness-based searchable encryption (WBSE), namely if w and x satisfy a witness relation, an encryption of (m, w) could be tested by a trapdoor of (m′, x) whether the keyword m′ is equal to m. The benefit of this primitive is to solve the challenging problem of keyword guessing attack in public-key searchable encryption. We construct a WBSE scheme in a generic way using smooth projective hash function (SPHF) as a building block and prove its WB-IND-CCA ciphertext security, WB-IND-TD trapdoor security and EUFT-CIA trapdoor unforgeability. Thanks to an efficient SPHF instantiation from Decisional Diffie–Hellman (DDH) assumption, we obtain an efficient WBSE instance without any pairing operation.

SQL structure rebuilder: preventing SQL injection attacks

Fault Analysis of the KATAN Family of Block Ciphers

IACR Cryptology ePrint Archive, 2012

Design and Implementation of Personal Firewalls for Handheld Devices

Lattice-based IBE with Equality Test Supporting Flexible Authorization in the Standard Model

arXiv (Cornell University), Oct 26, 2020

Revocable identity-based encryption with server-aided ciphertext evolution

Theoretical Computer Science, May 1, 2020

A Generic Scheme of plaintext-checkable database encryption

Information Sciences, Mar 1, 2018

Cloud-Based Outsourcing for Enabling Privacy-Preserving Large-Scale Non-Negative Matrix Factorization

IEEE Transactions on Services Computing, 2022

Comments on “Public Integrity Auditing for Dynamic Data Sharing With Multiuser Modification”

IEEE Transactions on Information Forensics and Security, Mar 1, 2016

Generic construction for tightly-secure signatures from discrete log

Theoretical Computer Science, Oct 1, 2021

Abstract Tightly secure signature plays a significant role in the research of cryptography and ha... more Abstract Tightly secure signature plays a significant role in the research of cryptography and has been studied extensively in the literature. In this paper, we present a generic construction for tightly-secure signatures from the discrete log (DL) assumption in the existential-unforgeability against key only attacks (EUF-KOA) security model, where the adversary is allowed to obtain only the public key, but not any sample signature. Moreover, the generic construction can also be extended into the multi-user setting with corruptions (MU-C) model. Roughly speaking, given any signature scheme, we can efficiently convert it into a signature scheme that features tight security under the DL assumption in the MU-EUF-KOA-C security model with random oracles. Our transformation shows it is easy to construct a DL-equivalent signature in the EUF-KOA security model, although many known DL-based signatures are not equivalent to DL. If the given signature scheme is key-re-randomizable, the transformed scheme is also key-re-randomizable. Hence, our result provides a supplement to Bader et al.'s work (EUROCRYPT 2016).

PPDF: A Privacy-Preserving Cloud-Based Data Distribution System With Filtering

IEEE Transactions on Services Computing, 2023

Lightweight Public Key Encryption With Equality Test Supporting Partial Authorization in Cloud Storage

The Computer Journal, Dec 8, 2020

Public key encryption with equality test (PKEET) can check whether two ciphertexts are encrypted ... more Public key encryption with equality test (PKEET) can check whether two ciphertexts are encrypted from the same message or not without decryption. This attribute enables PKEET to be increasingly utilized in cloud storage, where users store their encrypted data on the cloud. In traditional PKEET, the tester is authorized by the data receiver to perform equality test on its ciphertexts. However, the tester can only test one ciphertext or all ciphertexts of one receiver with one authorization. It means that the receiver cannot adaptively authorize the test right of any number of ciphertexts to the tester. A trivial solution is authorizing one ciphertext each time and repeating multiple times. The corresponding size of trapdoor in this method is linear with the number of authorized ciphertexts. This will incur storage burden for the tester. To solve the aforementioned problem, we propose the concept of PKEET supporting partial authentication (PKEET-PA). We then instantiate the concept to a lightweight PKEET-PA, which achieves constant-size trapdoor. Besides, we prove the security of our PKEET-PA scheme against two types of adversaries. Compared with other PKEET schemes that can be used in trivial solution, our PKEET-PA is more efficient in receivers’ computation and has lower trapdoor size.

Certificateless aggregate signature scheme secure against fully chosen-key attacks

Information Sciences, Apr 1, 2020

Provably Secure Identity Based Provable Data Possession

Lecture Notes in Computer Science, 2015

Identity-Based Strong Designated Verifier Signature Schemes

Lecture Notes in Computer Science, 2004

In this paper, we propose an identity based strong designated verifier signature scheme. Firstly,... more

AAC-OT: Accountable Oblivious Transfer With Access Control

IEEE Transactions on Information Forensics and Security, Dec 1, 2015

Constant-size ciphertexts in threshold attribute-based encryption without dummy attributes

Information Sciences, Mar 1, 2018

Separable Threshold Decryption for Ad Hoc Wireless Networks

Springer eBooks, 2008

Multimodal Private Signatures

Lecture Notes in Computer Science, 2022

On the General Construction of Tightly Secure Identity-Based Signature Schemes

The Computer Journal, Mar 17, 2020

A tightly secure scheme has a reduction, where the reduction loss is a small constant. Identity-b... more A tightly secure scheme has a reduction, where the reduction loss is a small constant. Identity-based signature (IBS) is an important cryptographic primitive, and tightly secure IBS schemes enjoy the advantage that the security parameter can be optimal to achieve a certain security level. General constructions of IBS schemes (Bellare, M., Namprempre, C., and Neven, G. (2004) Security Proofs for Identity-Based Identification and Signature Schemes. In Proc. EUROCRYPT 2004, May 2–6, pp. 268–286. Springer, Berlin, Interlaken, Switzerland; Galindo, D., Herranz, J., and Kiltz, E. (2006) On the Generic Construction of Identity-Based Signatures With Additional Properties. In Proceedings of ASIACRYPT 2006, December 3–7, pp. 178–193. Springer, Berlin, Shanghai, China) and their security have been extensively studied. However, the security is not tight and how to generally construct a tightly secure IBS scheme remains unknown. In this paper, we concentrate on the general constructions of IBS schemes. We first take an insight into previous constructions and analyze the reason why it cannot achieve tight security. To further study possible tightly secure constructions, we propose another general construction, which could be seen as a different framework of IBS schemes. Our construction requires two traditional signature schemes, whereas the construction by Bellare et al. uses one scheme in a two-round iteration. There are no additional operations in our general construction. Its main advantage is providing the possibility of achieving tight security for IBS schemes in the random oracle model. Combining two known signature schemes, we present an efficient IBS scheme with tight security as an example.

Witness-based searchable encryption

Information Sciences, Jul 1, 2018

Abstract We put forward a new cryptographic primitive called witness-based searchable encryption ... more Abstract We put forward a new cryptographic primitive called witness-based searchable encryption (WBSE), namely if w and x satisfy a witness relation, an encryption of (m, w) could be tested by a trapdoor of (m′, x) whether the keyword m′ is equal to m. The benefit of this primitive is to solve the challenging problem of keyword guessing attack in public-key searchable encryption. We construct a WBSE scheme in a generic way using smooth projective hash function (SPHF) as a building block and prove its WB-IND-CCA ciphertext security, WB-IND-TD trapdoor security and EUFT-CIA trapdoor unforgeability. Thanks to an efficient SPHF instantiation from Decisional Diffie–Hellman (DDH) assumption, we obtain an efficient WBSE instance without any pairing operation.

SQL structure rebuilder: preventing SQL injection attacks