Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Efficient ML-DSA Public Key Management Method with Identity for PKI and Its Application

Penghui Liu, Yi Niu, Xiaoxiong Zhong, Jiahui Wu, Weizhe Zhang, Kaiping Xue, Bin Xiao

Abstract

With the rapid evolution of the Industrial Internet of Things (IIoT), the boundaries and scale of the Internet are continuously expanding. Consequently, the limitations of traditional certificate-based Public Key Infrastructure (PKI) have become increasingly evident, particularly in scenarios requiring large-scale certificate storage, verification, and frequent transmission. These challenges are expected to be further amplified by the widespread adoption of post-quantum cryptography. In this paper, we propose a novel identity-based public key management framework for PKI based on post-quantum cryptography, termed \textit{IPK-pq}. This approach implements an identity key generation protocol leveraging NIST ML-DSA and random matrix theory. Building on the concept of the Composite Public Key (CPK), \textit{IPK-pq} addresses the linear collusion problem inherent in CPK through an enhanced identity mapping mechanism. Furthermore, it simplifies the verification of the declared public key's authenticity, effectively reducing the complexity associated with certificate-based key management. We also provide a formal security proof for \textit{IPK-pq}, covering both individual private key components and the composite private key. To validate our approach, formally, we directly implement and evaluate \textit{IPK-pq} within a typical PKI application scenario: Resource PKI (RPKI). Comparative experimental results demonstrate that an RPKI system based on \textit{IPK-pq} yields significant improvements in efficiency and scalability. These results validate the feasibility and rationality of \textit{IPK-pq}, positioning it as a strong candidate for next-generation RPKI systems capable of securely managing large-scale routing information.

Efficient ML-DSA Public Key Management Method with Identity for PKI and Its Application

Abstract

With the rapid evolution of the Industrial Internet of Things (IIoT), the boundaries and scale of the Internet are continuously expanding. Consequently, the limitations of traditional certificate-based Public Key Infrastructure (PKI) have become increasingly evident, particularly in scenarios requiring large-scale certificate storage, verification, and frequent transmission. These challenges are expected to be further amplified by the widespread adoption of post-quantum cryptography. In this paper, we propose a novel identity-based public key management framework for PKI based on post-quantum cryptography, termed \textit{IPK-pq}. This approach implements an identity key generation protocol leveraging NIST ML-DSA and random matrix theory. Building on the concept of the Composite Public Key (CPK), \textit{IPK-pq} addresses the linear collusion problem inherent in CPK through an enhanced identity mapping mechanism. Furthermore, it simplifies the verification of the declared public key's authenticity, effectively reducing the complexity associated with certificate-based key management. We also provide a formal security proof for \textit{IPK-pq}, covering both individual private key components and the composite private key. To validate our approach, formally, we directly implement and evaluate \textit{IPK-pq} within a typical PKI application scenario: Resource PKI (RPKI). Comparative experimental results demonstrate that an RPKI system based on \textit{IPK-pq} yields significant improvements in efficiency and scalability. These results validate the feasibility and rationality of \textit{IPK-pq}, positioning it as a strong candidate for next-generation RPKI systems capable of securely managing large-scale routing information.

Paper Structure

This paper contains 19 sections, 17 figures, 5 tables, 3 algorithms.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Resource Public Key Infrastructure
  4. Identity-based Cryptography Theory and Technology
  5. Certificate-chain-free RPKI: IPK-pq
  6. Model and Basic Algorithms
  7. System Private Key Seed Matrix Generation
  8. Collaborative Private Key Generation
  9. Self-Service Public Key Generation
  10. System Setup Stage
  11. Registration Stage
  12. Resource Allocation and ROA Issuance Stage
  13. ROA Verification Stage
  14. Theoretical Security Analysis of IPK-pq
  15. Evaluation and Analysis of IPK-pq
  16. ...and 4 more sections

Figures (17)

  • Figure 1: RPKI resource management technology based on IPK-pq
  • Figure 2: IPK-pq CA private key generation process
  • Figure 3: IPK-pq CA self-service public key generation
  • Figure 4: Differences in RC data fields between standard ML-DSA and IPK-pq
  • Figure 5: ROA generation performance comparison for ML-DSA-44
  • ...and 12 more figures