certificateless

Certificateless cryptography is a class of public-key cryptosystems designed to remove the need for digital certificates to bind public keys to users. The best-known form, certificateless public-key cryptography (CL-PKC), was introduced by Al-Riyami and Paterson in 2003 as a middle ground between identity-based encryption (IBE) and traditional PKI, addressing the key escrow problem of IBE while avoiding certificate management.

In CL-PKC, a trusted authority called a key generation center (KGC) issues a partial private key to a user based on the user’s identity. The user then selects a secret value and computes a public key. The full private key is obtained by combining the KGC-issued partial key with the user’s secret value. Crucially, the KGC cannot reconstruct the user’s complete private key, because it does not know the user’s secret value, mitigating key escrow concerns. The user’s public key is linked to the identity and is used with the partial key in cryptographic operations; signatures or encryption can be performed without separate certificates in the typical CL-PKC constructions.

Advantages include removing the burden of certificate management and reducing reliance on PKI, while avoiding the key-escrow drawback of IBE. Trade-offs include ongoing trust in the KGC and the need for careful binding between identities, public keys, and partial keys to resist rogue-key and key-substitution attacks. Security proofs typically rely on standard cryptographic assumptions related to pairings and discrete logarithms and may require additional mechanisms for key revocation.

Terminology and variants: CL-PKC encompasses schemes for certificateless encryption (CLE) and certificateless signatures (CLS). It has been studied for efficiency in resource-constrained environments, cloud services, and IoT, where certificate management is burdensome. Ongoing research addresses threats such as key usage management and cross-protocol attacks, as well as practical deployment considerations.