Pith. sign in

REVIEW 5 major objections 5 minor 55 references

Lightweight and High-Throughput Secure Logging for Internet of Things and Cold Cloud Continuum

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read POSLO is the first aggregate-signature logging scheme to combine constant-size keys, near-optimal signing, and a GPU verifier hitting 2^31 entries per second.

desk verdict Solid GPU-verification engineering undone by a verifier that trusts attacker-chosen R, making the A-EU-CMA security claim false as stated. read the letter →

arxiv 2506.08781 v1 pith:NIXCHBHZ submitted 2025-06-10 cs.CR

Saif E. Nouma , Attila A. Yavuz This is my paper
classification cs.CR MSC 94A60
keywords aggregatesignaturessecureloggingInternetofThingscoldstorageGPUbatchverificationseedmanagementSchnorrrandomoraclemodel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a single aggregate-signature framework, POSLO, can satisfy both ends of the IoT–cold-storage continuum at once: loggers that run on 8-bit microcontrollers sign each entry with only PRF and hash operations (no elliptic-curve scalar multiplication), while the archive verifies a terabyte of logs in about 25 seconds on a consumer GPU. The framework combines a tree-based one-time-seed manager, additive/multiplicative aggregation of Schnorr-like tags, and two variants (coarse-grained POSLO-C and fine-grained POSLO-F) with tunable verification granularity. POSLO is claimed to be the first scheme to offer constant-size final signatures and public keys together with near-optimal signing and high-throughput batch verification, and the paper proves A-EU-CMA security in the random oracle model under the discrete-logarithm assumption. If these claims hold, secure, publicly verifiable, non-repudiable logging becomes practical for resource-constrained IoT deployments.

What carries the argument

The load-bearing object is the POSLOT tree-based seed manager: a binary tree in which each leaf is a one-time seed $x_j^i$ derived from a root $x_D[0]$ via two PRFs, with inner nodes disclosed progressively so the signer keeps only O(log n1) state and finally discloses the root. Around it, POSLO builds Schnorr-like aggregate signatures: each entry gives $s_j^i = r_j^i - e_j^i y \bmod q$ with $e_j^i = H(m_j^i \| x_j^i)$; the verifier reconstructs the $x_j^i$ from the disclosed seeds, aggregates the $s$-values by addition and the commitments $R_i$ by multiplication, and checks $\tilde{R} = Y^{\tilde{e}} \alpha^{\tilde{s}} \bmod p$. This additive/multiplicative aggregation is what makes both coarse-grained (one tag per epoch) and fine-grained (per-entry) verification possible, and it is also what the GPU verifier exploits: each thread hashes one entry independently and a tree-based reduction sums the $e_j^i$ into sub-aggregates.

What would settle it

Instrument the A-EU-CMA experiment to record the ephemeral randomness $r$ used in each signing query, then run an automated search for a valid aggregate forgery whose verification equation holds with an $r$ that does not match any recorded query—or, more directly, attempt to instantiate the reduction's extraction step on a forged tag; if the two equations require different $r$ values, the claimed reduction to the discrete-log problem fails.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that Schnorr-like signatures can be made aggregate and signer-cheap by separating the one-time commitment from the message through a disclosed seed: the signer computes $s_j^i = r_j^i - e_j^i \cdot y \bmod q$ with $e_j^i = H(m_j^i \| x_j^i)$, where the one-time randomness $x_j^i$ is derived from a tree (POSLOT) whose root is eventually disclosed, allowing the verifier to reconstruct all seeds with O(1) final storage. The per-entry signatures aggregate additively ($\tilde{s} = \sum s_j^i$) while the corresponding commitments aggregate multiplicatively ($\tilde{R} = \prod \tilde{R}_i$), so a single equation $\tilde{R} = Y^{\tilde{e}} \alpha^{\tilde{s}} \bmod p$ verifies an entire epoch or batch. This structure yields near-optimal signing cost (a few PRF and hash calls plus one modular multiplication per entry), constant-size aggregated tags and final public keys, and a natural decomposition into independent per-message hashes that a GPU can compute in parallel. The paper reports that its AES-based instantiation POSLO+ with the GPU verifier POSLO.PAVer reaches about $2^{31}$ log-entry verifications per second on an NVIDIA GTX 3060.

Load-bearing premise

The security proof relies on the assumption that a successful forger's output reuses the exact ephemeral randomness that the simulator assigned in an earlier signing query, so that the secret key can be extracted from two verification equations; the proof does not establish that a forgery must reuse that randomness.

Editorial extensions

If this is right

  • A low-end 8-bit IoT device can sign each log entry in about 2–5 ms and with energy usage comparable to a single sensor sample, making secure logging battery-friendlier than Ed25519, SchnorrQ, BLS, or C-RSA.
  • Cold storage can audit a 1 TB log archive in about 25 seconds on a mid-range consumer GPU, versus hours or days for existing aggregate and non-aggregate schemes.
  • Cryptographic storage per log archive drops to about 0.06 KB for 2^35 entries, because the final aggregate tag and public key are constant-size.
  • Operators can tune verification granularity: verify the whole valid set with one tag, verify umbrella sub-batches to localize corruptions, or verify flagged entries individually.
  • The three instantiations (SHA-256, AES-based MMO/MDC-2, and modular-addition hashing) let deployers trade standard-compliance and input-size flexibility for speed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The GPU batch-verification strategy of offloading per-message hashing and aggregating ephemeral keys is not specific to POSLO; it could be transplanted to other additive-homomorphic aggregate signature schemes to improve their archive-side throughput.
  • The seed-tree disclosure pattern could serve as a lightweight key-rotation mechanism for other authentication tasks on constrained devices, such as firmware updates or sensor attestation.
  • A direct testable extension would be to benchmark POSLO against the newest BLS-based aggregate schemes on the same GPU; the claimed orders-of-magnitude gap depends on replacing pairings and map-to-point hashing with cheap AES-based hashing, a comparison the paper runs only against a handful of baselines.
  • The combination of coarse and fine granularity suggests a resource-adaptive protocol where the distiller's choice of umbrella granularity could be set dynamically based on detected corruption rates, an optimization the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The manuscript proposes POSLO, a family of aggregate signature schemes for secure logging in IoT-to-cold-storage settings. Two main variants are presented: POSLO-C, which aggregates an entire epoch into one tag and uses a tree-based seed disclosure stack, and POSLO-F, which provides per-entry signatures with a constant-size public key. The paper also introduces POSLO.PAVer, a CUDA-based parallel verifier, and reports very high verification throughput (about 2^31 entries per second on a GTX 3060 for the AES-based instantiation) together with detailed benchmarks on an 8-bit AVR logger, commodity CPUs, and a GPU. The formal claim is A-EU-CMA security in the random oracle model under the DLP assumption, stated as Theorem 5.1, Lemma 5.2, and Corollary 5.3, with proofs in Appendix A.

Significance. If the security claim were correct, the work would be a valuable engineering contribution: it combines an open-source implementation, reproducible benchmarks, a plausible signer-side efficiency story, and a GPU verifier with impressive measured speedups. The tree-based seed management and the distillation granularity ideas are useful. However, the central security theorem is not merely missing a proof step; the scheme as defined admits a direct existential forgery because the verifier accepts an attacker-chosen aggregate commitment. This invalidates the claimed A-EU-CMA security and, with it, the paper's principal theoretical contribution. The efficiency results may still be of interest, but the paper cannot be accepted in its present form.

major comments (5)
  1. [§4.2.1, Fig. 3a, POSLO-C.AVer] The verification algorithm is existentially forgeable. In Step 2, AVer accepts an aggregate commitment R from the signature whenever one is present, and Step 9 checks R = Y^e * alpha^s mod p without verifying that R is the aggregate of the public-key commitments for the relevant epochs. An adversary can therefore choose any desired message batch m*, any s*, and set R* = Y^{e*} * alpha^{s*} mod p for the e* it computes; the verification equation holds by construction. If a signing query on epoch i has already revealed x0[i] via ds_i, the adversary can compute all x_j^i = PRF0(x0[i]||j), form a new batch m* not equal to the queried batch, and satisfy the A-EU-CMA condition of Definition 3.1. This is a concrete existential forgery and directly contradicts Theorem 5.1.
  2. [Appendix A, proof of Theorem 5.1] The extraction step assumes that the forgery's aggregate commitment R is the same commitment that the reduction used when answering signing queries, so that two equations r = y'*e + s and r = y'*e* + s* share the same r. The proof never establishes this: because AVer accepts an R supplied by the adversary, the forged R* need not be any of the simulated R_l or any aggregate of them. The reader's concern about a missing forking argument is real but not the core issue; the core issue is that the reduction is proving security for a verification equation that is already satisfiable by a trivial choice of R. The proof therefore does not provide the claimed reduction to DLP.
  3. [§4.3, Fig. 4, POSLO-F.AVer] The same attacker-supplied-R flaw affects POSLO-F. In POSLO-F.Sig, the one-time seed x_t is transmitted in the signature, and AVer computes e = H(m||x) from that x. An adversary can choose any x and any s, set R* = Y^{H(m*||x)} * alpha^{s} mod p, and the verification equation passes for any message m*. Thus POSLO-F is forgeable without any signing query, and Lemma 5.2, which claims POSLO-F is as secure as POSLO-C, is also unsupported because the underlying POSLO-C security claim is false.
  4. [Abstract and §4.2.1, Kg] The claim of constant-size public keys is overstated for POSLO-C. POSLO-C.Kg Step 8 sets PK = (Y, R) where R = {~R_i}_{i=1}^{n1}, so the public key is initially linear in the number of epochs, O(n1). It becomes O(1) only after all epochs are completed and the POSLOT root is disclosed, a fact acknowledged later in the paper, e.g., Table 1 lists POSLO-C's public key as O(n/n1)/O(1). The unqualified phrase "constant-size public keys" in the abstract and contributions should be revised to state the initial/final distinction explicitly.
  5. [Corollary 5.3] Because Theorem 5.1 is invalid, the security of the POSLO+ and POSLO++ instantiations is not established by the stated reduction. The argument for POSLO++ additionally relies on replacing H with modular addition, citing Chen et al. [9]; even if that replacement is accepted, the resulting scheme still inherits the AVer flaw. A corrected security proof must cover the exact verification algorithm used in the implementation and in the experiments.
minor comments (5)
  1. [§4.2.1, Kg Step 2] The text says "generate large primes q and p>q such that (p-1) divides q"; this is backwards and impossible for q > p-1. The intended condition is q | (p-1), i.e., the group of order q is a subgroup of Z_p^*.
  2. [Fig. 3b, Distill and SeBVer] The pseudocode has inconsistent granularity notation: Distill uses "if i ≡ 0 mod floor(n1/n_u)" while SeBVer uses "i_l * floor(n_u/n)", and one of these floor expressions appears to invert the ratio. The condition should be stated consistently in terms of n1, n_u, and the epoch index i.
  3. [Table 1] The table lists two rows labeled POSLO-F+ with different key sizes and verification times; one appears to be a copy of the POSLO-C row. This makes the comparison confusing and should be corrected.
  4. [§1.2.1 and §4.1] The seed-storage reduction is described as going from O(n) to "intermediate O(log^2 n)" in the introduction, while Section 4.1 and the analysis in Section 6.3.1 state the stack size is log(n1) nodes, i.e., O(log n1). The notation should be made consistent.
  5. [Definition 3.1] The condition "m* ⊄ {m_j}^{n1}_{j=1}" is ambiguous because m* is a batch and the right-hand side is the set of all batches queried. It should be rephrased to say that the forged batch is not equal to any previously queried batch.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: throughput and energy claims are measured, and the flawed DLP reduction is a soundness gap, not a self-referential derivation.

full rationale

POSLO is a systems and construction paper. Its central quantitative claims, such as about 2^31 log verifications per second on a GTX 3060, 24.8 seconds for 1 TB, and signer-side energy on an 8-bit ATmega2560, are reported from the benchmarks in Section 6 on stated hardware, not produced by fitting parameters to the target quantity. No fitted-input-called-prediction pattern appears. The scheme extends the authors' earlier OSLO paper, which is cited as the preliminary version and as a comparison baseline, but the new tree-based seed management, POSLO-C and POSLO-F variants, GPU verifier, and ROM/DLP reduction are developed in this paper rather than imported by self-citation. The self-citation is descriptive and not load-bearing; no uniqueness theorem or ansatz is justified solely from the authors' prior work. The security reduction in Appendix A (proof of Theorem 5.1) has serious soundness gaps: the signing simulation does not state how s_j^i is chosen, and the extraction step writes r = y'*e + s and r = y'*e* + s* with the same r even though POSLO-C.AVer (Figure 3a, Step 2) permits R to come from the signature; no forking or rewinding argument forces the forgery to reuse a queried randomness. Those are correctness and rigor defects in the proof as written, not circular derivations. The theorem's conclusion is not equivalent to its assumptions by construction, and the measured performance is independent of the proof. Verdict: no significant circularity (score 0), which should not be read as endorsing the security proof's correctness.

Assumptions & free parameters 0 free parameters · 7 assumptions · 0 invented entities

No free parameters are fitted to data; the scheme's constants are standard security parameters and configuration choices. The central security claim rests on DLP, the random oracle model, and the security of the underlying PRF/hash constructions, all standard assumptions. No new physical or algorithmic entities are invented beyond the POSLOT tree data structure, which is a construction, not a postulated entity.

assumptions (7)
  • standard math Discrete Logarithm Problem (and ECDLP) is intractable for the chosen prime-order group.
    Invoked in Definition 2.4 and throughout the security reduction in Appendix A; the public key and signature equations rely on the hardness of extracting y from alpha^y.
  • domain assumption The cryptographic hash function H (SHA-256, MMO-AES, or MDC-2 variants) behaves as a random oracle.
    Used in Theorem 5.1 and Corollary 5.3 to justify the security reduction; the RO model is a standard assumption in signature proofs.
  • standard math PRF0 and PRF1 derived from SHA-256 or MMO-AES are pseudorandom functions.
    The tree seed derivation (Section 4.1) and ephemeral key generation (Figures 3a, 4) require that outputs are indistinguishable from random.
  • standard math AES-128 is a pseudorandom permutation (or ideal cipher) for MMO and MDC-2 constructions.
    Corollary 5.3 and Section 6.2 rely on the security of AES-128 as the underlying block cipher in POSLO+ and POSLO++.
  • standard math MDC-2 is collision resistant in the ideal cipher model (Steinberger et al.).
    Used in Corollary 5.3 to argue POSLO+ has comparable security to SHA-256-based POSLO.
  • domain assumption Modular addition is a sufficient hash for Schnorr-style signatures when inputs are unpredictable and smaller than the modulus (Chen et al.).
    Adopted for the POSLO++ instantiation in Section 6.2.2; the claim is cited to [9] and not re-proven here.
  • domain assumption The A-EU-CMA security model captures the adversarial goals for secure logging.
    Definition 3.1 defines the threat model; it is standard for aggregate signatures but not directly connected to all real-world logging attacks (e.g., truncation, ordering).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Lightweight and High-Throughput Secure Logging for Internet of Things and Cold Cloud Continuum." pith.science (2026). https://pith.science/paper/NIXCHBHZ

@misc{pith2026250608781,
  author       = {Pith},
  title        = {Pith review of: Lightweight and High-Throughput Secure Logging for Internet of Things and Cold Cloud Continuum},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NIXCHBHZ}},
  note         = {Machine review of arXiv:2506.08781}
}
read the original abstract

The growing deployment of resource-limited Internet of Things (IoT) devices and their expanding attack surfaces demand efficient and scalable security mechanisms. System logs are vital for the trust and auditability of IoT, and offloading their maintenance to a Cold Storage-as-a-Service (Cold-STaaS) enhances cost-effectiveness and reliability. However, existing cryptographic logging solutions either burden low-end IoT devices with heavy computation or create verification delays and storage inefficiencies at Cold-STaaS. There is a pressing need for cryptographic primitives that balance security, performance, and scalability across IoT-Cold-STaaS continuum. In this work, we present Parallel Optimal Signatures for Secure Logging (POSLO), a novel digital signature framework that, to our knowledge, is the first to offer constant-size signatures and public keys, near-optimal signing efficiency, and tunable fine-to-coarse-grained verification for log auditing. POSLO achieves these properties through efficient randomness management, flexible aggregation, and multiple algorithmic instantiations. It also introduces a GPU-accelerated batch verification framework that exploits homomorphic signature aggregation to deliver ultra-fast performance. For example, POSLO can verify 231 log entries per second on a mid-range consumer GPU (NVIDIA GTX 3060) while being significantly more compact than state-of-the-art. POSLO also preserves signer-side efficiency, offering substantial battery savings for IoT devices, and is well-suited for the IoT-Cold-STaaS ecosystem.

Figures

Figures reproduced from arXiv: 2506.08781 by the authors.

Figure 1
Figure 1. A high-level illustration of POSLO system model 2) New Instantiations (POSLO+ and POSLO++). We instantiate the message processing and enhanced seed manager of POSLO with symmetric/arithmetic primitives [15] beyond cryptographic hash functions: (i) POSLO+ : is an AES-based instantiation, optimized for energy efficiency and parallelism on low-end IoT [42] and Cold-STaaS [48]. (ii) POSLO++: combines AES and modular ari… view at source ↗
Figure 3
Figure 3. Coarse-grained signer-optimal POSLO (POSLO-C) commitments for each epoch as in Steps 5-7, which results in initial O (𝑛1) and final O (1) storage at the verifier via aggregation. The private/public keys and public parameters are as in Steps 8-9. POSLO-C.Agg(.) is a keyless signature aggregate function with dual signature combination mode. That is, given a signature element 𝑠 ∈ 𝜎 or 𝑅 ∈ 𝜎, it performs an additive or … view at source ↗
Figure 4
Figure 4. Fine-grained public-key POSLO (POSLO-F) 4.4 POSLO Parallel Batch Verification (POSLO.PAVer) POSLO signature verification, as well as other batch verification algorithms (e.g., [14]), offers significantly increased computational efficiency compared to traditional per-message verification. This improvement stems primarily from reducing the number of expensive operations, such as EC scalar multiplications in ECDLP-base… view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: High-level illustration of the parallel batch verification algorithm ( [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: Parallel POSLO signature verification algorithm (POSLO.PAVer) 𝑛2 = 8. Each batch 𝒎𝒊 is first loaded from global memory into shared memory, and each log entry 𝑚 𝑗 𝑖 is placed into the register space of thread 𝑗 in block 𝑖 ∈ 𝑰. Each thread 𝑗 ∈ {1, . . . , 𝑛2} computes th…
Figure 7
Figure 7. Figure 7: Energy consumption of POSLO schemes and their counterparts at the logger side 3https://pulsesensor.com/ 4https://cdn-shop.adafruit.com/datasheets/1900_BMP183.pdf [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]
Figure 8
Figure 8. Figure 8: Storage and verification time (on x86/64) comparison of [PITH_FULL_IMAGE:figures/full_fig_p022_8.png]
Figure 9
Figure 9. Figure 9: Performance of (parallel) batch verification ( [PITH_FULL_IMAGE:figures/full_fig_p024_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

55 extracted references · 55 canonical work pages

  1. [9]

    Yilei Chen, Alex Lombardi, Fermi Ma, and Willy Quach. 2021. Does Fiat-Shamir require a cryptographic hash function?. InAnnual International Cryptology Conference. Springer, 334–363

    work page 2021

  2. [1]

    Adil Ahmad, Sangho Lee, and Marcus Peinado. 2022. Hardlog: Practical tamper-proof system auditing using a novel audit device. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1791–1807

    work page 2022

  3. [2]

    Gaspard Anthoine, Jean-Guillaume Dumas, Mélanie de Jonghe, Aude Maignan, Clément Pernet, Michael Hanling, and Daniel S Roche. 2021. Dynamic proofs of retrievability with low server storage. In30th USENIX Sec. Symp.537–554

    work page 2021

  4. [3]

    Giuseppe Ateniese, Roberto Di Pietro, Luigi V Mancini, and Gene Tsudik. 2008. Scalable and efficient provable data possession. InProc. of the 4th international conference on Security and privacy in communication netowrks. 1–10

    work page 2008

  5. [4]

    Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang

    Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. 2012. High-speed high-security signatures.Journal of Cryptographic Engineering2, 2 (01 Sep 2012), 77–89

    work page 2012

  6. [5]

    Dan Boneh, Ben Lynn, and Hovav Shacham. 2004. Short Signatures from the Weil Pairing.J. Cryptol.17, 4 (2004), 297–319

    work page 2004

  7. [6]

    Victor Boyko, Marcus Peinado, and Ramarathnam Venkatesan. 1998. Speeding up Discrete Log and Factoring Based Schemes via Precomputations. InEUROCRYPT ’98(eurocrypt ’98 ed.). 221–235

    work page 1998

  8. [7]

    2001.Parallel programming in OpenMP

    Rohit Chandra. 2001.Parallel programming in OpenMP. Morgan kaufmann

    work page 2001

Show all 55 references
  1. [8]

    Changhua Chen, Tingzhen Yan, Chenxuan Shi, Hao Xi, Zhirui Fan, Hai Wan, and Xibin Zhao. 2024. The Last Mile of Attack Investigation: Audit Log Analysis towards Software Vulnerability Location.IEEE Transactions on Information Forensics and Security(2024)

    2024

  2. [10]

    Mucong Chi, Jun Liu, and Jie Yang. 2020. ColdStore: a storage system for archival data.Wireless Personal Communica- tions111, 4 (2020), 2325–2351

    2020

  3. [11]

    Craig Costello and Patrick Longa. 2016. Schnorrq: Schnorr signatures on fourq.MSR Tech Report(2016)

    2016

  4. [12]

    Jiankuo Dong, Fangyu Zheng, Niall Emmart, Jingqiang Lin, and Charles Weems. 2018. sDPF-RSA: Utilizing floating- point computing power of GPUs for massive digital signature computations. In2018 IEEE International Parallel and Distributed Processing Symposium (IPDPS). IEEE, 599–609

    2018

  5. [13]

    Zonghao Feng, Qipeng Xie, Qiong Luo, Yujie Chen, Haoxuan Li, Huizhong Li, and Qiang Yan. 2022. Accelerating elliptic curve digital signature algorithms on GPUs. InSC22: International Conference for High Performance Computing, Networking, Storage and Analysis. IEEE, 1–13

    2022

  6. [14]

    Anna Lisa Ferrara, Matthew Green, Susan Hohenberger, and Michael Østergaard Pedersen. 2009. Practical short signature batch verification. InCryptographers’ Track at the RSA Conference. Springer, 309–324

    2009

  7. [15]

    Benjamin Glas, Jorge Guajardo, Hamit Hacioglu, Markus Ihle, Karsten Wehefritz, and Attila A. Yavuz. 2012. Signal- based Automotive Communication Security and Its Interplay with Safety Requirements. ESCAR, Embedded Security in Cars Conference, Germany, November 2012

    2012

  8. [16]

    Vipul Goyal, Omkant Pandey, Amit Sahai, and Brent Waters. 2006. Attribute-based encryption for fine-grained access control of encrypted data. InProc of the 13th ACM conference on Computer and communications security. 89–98

    2006

  9. [17]

    Mohamed Grissa, Attila A Yavuz, and Bechir Hamdaoui. 2019. TrustSAS: A trustworthy spectrum access system for the 3.5 GHz CBRS band. InIEEE INFOCOM 2019-IEEE Conference on Computer Communications. IEEE, 1495–1503. 26 Saif E. Nouma and Attila A. Y avuz

    2019

  10. [18]

    Omid Hajihassani, Saleh Khalaj Monfared, Seyed Hossein Khasteh, and Saeid Gorgin. 2019. Fast AES implementation: A high-throughput bitsliced approach.IEEE Transactions on parallel and distributed systems30, 10 (2019), 2211–2222

    2019

  11. [19]

    Gunnar Hartung. 2016. Secure Audit Logs with Verifiable Excerpts. InTopics in Cryptology - CT-RSA 2016, Kazue Sako (Ed.). Springer International Publishing, Cham, 183–199

  12. [20]

    Gunnar Hartung. 2017. Attacks on Secure Logging Schemes. InFinancial Cryptography and Data Security. Springer International Publishing, Cham, 268–284

    2017

  13. [21]

    Gael Hofemeier and Robert Chesebrough. 2012. Introduction to intel aes-ni and intel secure key instructions.Intel, White Paper62 (2012), 6

    2012

  14. [22]

    1983.Data structures and algorithms

    John E Hopcroft, Jeffrey D Ullman, and Alfred Vaino Aho. 1983.Data structures and algorithms. V ol. 175. Addison- wesley Boston, MA, USA:

    1983

  15. [23]

    Xinyi Hu, Debiao He, Min Luo, Cong Peng, Qi Feng, and Xinyi Huang. 2023. High-performance implementation of the identity-based signature scheme in IEEE P1363 on GPU.ACM Transactions on Embedded Computing Systems22, 2 (2023), 1–35

    2023

  16. [24]

    DongCheon Kim, HoJin Choi, and Seog Chung Seo. 2024. Parallel Implementation of SPHINCS+ With GPUs.IEEE Transactions on Circuits and Systems I: Regular Papers(2024)

    2024

  17. [25]

    Jihye Kim and Hyunok Oh. 2019. FAS: Forward secure sequential aggregate signatures for secure logging.Information Sciences471 (2019), 115 – 131

    2019

  18. [26]

    David Kirk et al. 2007. NVIDIA CUDA software and GPU parallel computing architecture. InISMM, V ol. 7. 103–104

    2007

  19. [27]

    Sokjoon Lee, Hwajeong Seo, Hyeokchan Kwon, and Hyunsoo Yoon. 2019. Hybrid approach of parallel implementation on CPU–GPU for high-speed ECDSA verification.The Journal of Supercomputing75 (2019), 4329–4349

    2019

  20. [28]

    Tian Li, Huaqun Wang, Debiao He, and Jia Yu. 2020. Permissioned blockchain-based anonymous and traceable aggregate signature scheme for Industrial Internet of Things.IEEE Internet of Things Journal8, 10 (2020), 8387–8398

    2020

  21. [29]

    Xin Li, Huazhe Wang, Ye Yu, and Chen Qian. 2017. An IoT data communication framework for authenticity and integrity. In2017 IEEE/ACM 2nd International Conf. on Internet-of-Things Design and Implementation (IoTDI). 159–170

    2017

  22. [30]

    Zhenyuan Li, Qi Alfred Chen, Runqing Yang, Yan Chen, and Wei Ruan. 2021. Threat detection and investigation with system-level provenance graphs: A survey.Computers & Security106 (2021), 102282

    2021

  23. [31]

    Wenhao Liao, Jia Sun, Haiyan Wang, Zhaoquan Gu, and Jianye Yang. 2024. Semantic-Integrated Online Audit Log Reduction for Efficient Forensic Analysis. InInternational Conf. on Advanced Data Mining and Applications. 318–333

    2024

  24. [32]

    Zhe Liu, Johann Großschädl, and Ilya Kizhvatov. 2010. Efficient and side-channel resistant RSA implementation for 8-bit A VR microcontrollers. InWorkshop on the Security of the Internet of Things-SOCIOT, V ol. 10

    2010

  25. [33]

    Di Ma and Gene Tsudik. 2009. A New Approach to Secure Logging.Trans. Storage5, 1, Article 2 (2009), 21 pages

    2009

  26. [34]

    Giorgia Azzurra Marson and Bertram Poettering. 2014. Even More Practical Secure Logging: Tree-Based Seekable Sequential Key Generators. InComputer Security - ESORICS 2014. Cham, 37–54

    2014

  27. [35]

    Menezes, P

    A.J. Menezes, P. C. van Oorschot, and S.A. Vanstone. 1996.Handbook of Applied Cryptography. CRC Press

    1996

  28. [36]

    Roberto Minerva, Gyu Myoung Lee, and Noel Crespi. 2020. Digital twin in the IoT context: A survey on technical features, scenarios, and architectural models.Proc. IEEE108, 10 (2020), 1785–1824

    2020

  29. [37]

    MITRE. [n. d.]. Indicator Removal: Clear Linux or Mac System Logs . https://attack.mitre.org/techniques/T1070/002/. Accessed: April 5, 2025

    2025

  30. [38]

    Arsalan Mosenia and Niraj K Jha. 2016. A comprehensive study of security of internet-of-things.IEEE Transactions on emerging topics in computing5, 4 (2016), 586–602

    2016

  31. [39]

    Saif E Nouma and Attila A Yavuz. 2023. Practical Cryptographic Forensic Tools for Lightweight Internet of Things and Cold Storage Systems. InProc. of the 8th ACM/IEEE Conf. on Internet of Things Design and Implementation. 340–353

    2023

  32. [40]

    Muslum Ozgur Ozmen, Rouzbeh Behnia, and Attila A. Yavuz. 2019. Energy-Aware Digital Signatures for Embedded Medical Devices. In7th IEEE Conf. on Communications and Network Security (CNS), June

    2019

  33. [41]

    Wuqiong Pan, Fangyu Zheng, Yuan Zhao, Wen-Tao Zhu, and Jiwu Jing. 2016. An efficient elliptic curve cryptography signature server with GPU acceleration.IEEE Trans. on Information Forensics and Security12, 1 (2016), 111–122

    2016

  34. [42]

    Sebastian Rohde, Thomas Eisenbarth, Erik Dahmen, Johannes Buchmann, and Christof Paar. 2008. Fast hash-based sig- natures on constrained devices. InSmart Card Research and Advanced Applications: 8th IFIP WG 8.8/11.2 International Conference, CARDIS 2008, London, UK, September ...

    2008

  35. [43]

    Tinshu Sasi, Arash Habibi Lashkari, Rongxing Lu, Pulei Xiong, and Shahrear Iqbal. 2024. A comprehensive survey on IoT attacks: Taxonomy, detection mechanisms and challenges.J. of Information and intelligence2, 6 (2024), 455–513

    2024

  36. [44]

    Schneier and J

    B. Schneier and J. Kelsey. 1999. Secure audit logs to support computer forensics.ACM Transaction on Information System Security2, 2 (1999), 159–176

    1999

  37. [45]

    Claus-Peter Schnorr. 1991. Efficient signature generation by smart cards.Journal of cryptology4, 3 (1991), 161–174

    1991

  38. [46]

    Aashaka Shah, Vinay Banakar, Supreeth Shastri, Melissa Wasserman, and Vijay Chidambaram. 2019. Analyzing the impact of{GDPR}on storage systems. In11th USENIX Workshop on Hot Topics in Storage and File Systems. Lightweight and High-Throughput Secure Logging for Internet of Thin...

    2019

  39. [47]

    John P Steinberger. 2007. The collision intractability of MDC-2 in the ideal-cipher model. InAdvances in Cryptology- EUROCRYPT: 26th Annual International Conf. on the Theory and Applications of Cryptographic Techniques. 34–51

    2007

  40. [48]

    Cihangir Tezcan. 2021. Optimization of advanced encryption standard on graphics processing units.IEEE Access9 (2021), 67315–67326

    2021

  41. [49]

    Vallent, Damien Hanyurwimfura, and Chomora Mikeka

    Thokozani F. Vallent, Damien Hanyurwimfura, and Chomora Mikeka. 2021. Efficient certificate-less aggregate signature scheme with conditional privacy-preservation for vehicular adhoc networks enhanced smart grid system.Sensors21, 9 (2021)

    2021

  42. [50]

    Girraj Kumar Verma, Neeraj Kumar, Prosanta Gope, BB Singh, and Harendra Singh. 2021. SCBS: a short certificate- based signature scheme with efficient aggregation for industrial-internet-of-things environment.IEEE Internet of Things Journal8, 11 (2021), 9305–9316

    2021

  43. [51]

    Cong Wang, Ning Cao, Jin Li, Kui Ren, and Wenjing Lou. 2010. Secure ranked keyword search over encrypted cloud data. In2010 IEEE 30th international conference on distributed computing systems. 253–262

    2010

  44. [52]

    Cong Wang, Sherman SM Chow, Qian Wang, Kui Ren, and Wenjing Lou. 2011. Privacy-preserving public auditing for secure cloud storage.IEEE transactions on computers62, 2 (2011), 362–375

    2011

  45. [53]

    Attila A. Yavuz. [n. d.]. System and method for secure review of audit logs. Robert Bosch, Provisional Application No. 62/006,476, Filing Date: June 2, 2014, PCT Application: June 2, 2015

    2014

  46. [54]

    Attila A. Yavuz. 2018. Immutable Authentication and Integrity Schemes for Outsourced Databases.IEEE Trans. Dependable Sec. Comput.15, 1 (2018), 69–82

    2018

  47. [55]

    A. A. Yavuz, Peng Ning, and Michael K. Reiter. 2012. BAF and FI-BAF: Efficient and Publicly Verifiable Cryptographic Schemes for Secure Logging in Resource-Constrained Systems.ACM Trans. on Inf. System Sec.15, 2 (2012), 28 pages. APPENDIX A We provide the security proof ofPOSL...

    2012

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.