@article {15094,
	title = {Key-insulated public key cryptosystems},
	journal = {Advances in Cryptology{\textemdash}Eurocrypt 2002},
	year = {2002},
	month = {2002///},
	pages = {65 - 82},
	abstract = {Cryptographic computations (decryption, signature generation, etc.) are often performed on a relatively insecure device (e.g., a mobile device or an Internet-connected host) which cannot be trusted to maintain secrecy of the private key. We propose and investigate the notion of key-insulated security whose goal is to minimize the damage caused by secret-key exposures. In our model, the secret key(s) stored on the insecure device are refreshed at discrete time periods via inter-action with a physically-secure - but computationally-limited - device which stores a {\textquotedblleft}master key{\textquotedblright}. All cryptographic computations are still done on the insecure device, and the public key remains unchanged. In a (t, N)-key-insulated scheme, an adversary who compromises the insecure device and obtains secret keys for up to t periods of his choice is unable to violate the security of the cryptosystem for any of the remaining N - t periods. Furthermore, the scheme remains secure (for all time periods) against an adversary who compromises only the physically-secure device. We focus primarily on key-insulated public-key encryption. We construct a (t, N)-key-insulated encryption scheme based on any (standard) public-key encryption scheme, and give a more efficient construction based on the DDH assumption. The latter construction is then extended to achieve chosen-ciphertext security.},
	doi = {10.1007/3-540-46035-7_5},
	author = {Dodis,Y. and Katz, Jonathan and Xu,S. and Yung,M.}
}
