COVER FEATURE ATTRIBUTES OF QUALITY

Considerations for Decision

Makers and Developers
Toward the Adoption
of Decentralized Key
Management Systems
Technology in Emerging
Applications
Wei Yao , Nicholas Gorlewski, Fadi P. Deek , and Guiling Wang , New Jersey ­Institute of Technology

Public key infrastructure has been widely used in key

management systems (KMSs). This article undertakes a
comprehensive examination of the current decentralized KMS
(DKMS) approaches with the objective of providing organizational
decision makers and technical developers some guidance toward
the adoption of DKMS technology in their respective applications.

T
he public key infrastructure (PKI) was introduced management, such approaches can be seen as early as
in the 1990s to make the management of certif- 1996, with decentralized trust management2 and its pro-
icates and encryption keys possible.1 However, posed PolicyMaker system.
the notion of centralization is a major aspect of PolicyMaker aims to separate generic mechanisms
traditional PKIs. Because of this interest in decentralized from application-specific policy, appearing to appli-
cations as a database query engine. The system binds
Digital Object Identifier 10.1109/MC.2023.3339390
public keys to descriptions of actions instead of identi-
Date of current version: 26 June 2024 ties. One example is electronic voting systems requiring

CO M PUTE R 0018-9 162 / 24©2024I EEE PUBLISHED BY THE IEEE COMPUTER SOCIET Y J U LY 2 0 2 4  27
ATTRIBUTES OF QUALITY

users to assert that they are registered DKMS approaches and, to the best of Decentralized identity
voters while not allowing the system our knowledge, is the first survey spe- authentication and KM
to learn requestors’ identities.2 cifically focused on DKMS. Our aim SM9 is identity-based cryptography
In the following years, other key is to provide organizational decision that can avoid the PKI system and
decentralized systems emerged: Hydra makers and technical developers with allows solutions for lightweight appli-
cations, such as the IoT.3 A deficiency
of SM9, however, is that it needs a
trusted third party called a key gen-
erator center to generate and manage
THIS ARTICLE UNDERTAKES A keys. A decentralized solution using
COMPREHENSIVE EXAMINATION OF THE blockchain that includes an identity
CURRENT DKMS APPROACHES AND, TO generator center (IGC) solely to gener-
THE BEST OF OUR KNOWLEDGE, IS THE ate an identifier and key for first-time
registration is suggested.3 This identi-
FIRST SURVEY SPECIFICALLY FOCUSED fier can be used as a public key, while
ON DKMS. a private key or parameters would be
updated if necessary. The update of a
private key or SM9 parameters would
be done through transactions stored
in 2002, focusing on symmetric cryp- some guidance toward adopting DKMS on a blockchain. The update is essen-
tographic key distribution in large technology in their respective applica- tial because of the immutable nature
groups, and TrustMe in 2003, empha- tions. The main contributions are of blockchain that offers a meaning-
sizing anonymous trust management ful way to audit past behaviors, and
in peer-to-peer environments. The 1. an overview of critical rep- the approach starts with a parameter
mid-2000s saw further developments, resentative DKMS, from the initialization phase. In the parame-
such as the exploration of group keys general DKMS to DKMS for ter initialization phase, base points
in ad hoc networks and the introduc- the Internet of Things (IoT), P 1 ∈ 1 and P 2 ∈ 2 are established.
tion of new cryptographic techniques ending with the DKMS used in Afterward, the IGC generates a ran-
to enhance security. vehicular networks dom number that is used as the private
Despite these advancements, tra- 2. a detailed comparison of listed key SkI and computes PkI = [SkI]P 1 to
ditional PKI systems continue to face DKMS on various key aspects. use as the public key. The IGC would
challenges in scalability, flexibility, then keep the private key secret and
and vulnerability to centralized points The rest of the article is structured publish the public key. To make use of
of failure. This has led to a growing as follows: The “Representative DKMS” the SM9 signature algorithm, the IGC
need for more robust and decentral- section introduces several surveyed needs to generate another private key
ized approaches. Decentralized key DKMS schemes and implementa- according to its identifier IDI.3 The IGC
management systems (DKMS) have tions. The “Comparison of Surveyed computes t 1, the sum of the private key,
emerged as a potential solution to these DKMS” section evaluates, analyzes, and and the hash of the identifier, where N
challenges, offering enhanced security compares all DKMS covered in this arti- is the size of the finite field. Then, it
and distributed control mechanisms. cle. The “Future Studying” provides computes t2 through Tu et al.3
By exploring the evolution and capa- a summary of our research objectives
bilities of DKMS, this article aims to and proposes existing challenges and t 1 = H(ID i, N) + SkI(1)
highlight how these systems address future work. t2 = SkI ⋅ t 1 mod N.(2)
the limitations of traditional PKI and
provide a more resilient framework. REPRESENTATIVE DKMS When multiplied by a base point
This article undertakes a compre- This section discusses prominent pro- P 2, a signature skI is generated and
hensive examination of the current posed solutions to creating DKMS. stored on the blockchain through a

28 COMPUTER  W W W.CO M P U T E R .O R G /CO M P U T E R

transaction. The public key ID is given reencryption to delegate decryption Then, decryption can be done by
along with the parameters (P 1, P 2, PkI) rights. 5 Unlike traditional KMSs, the receiver (Egorov et al.5)
and a validity period of T. NuCypher does not require a central-
The next phase involves generat- ized party, and a network token is used ske = decrypt PKE(skB, sk′e)(9)
ing an identifier for a new user Ui. This to incentivize users to participate in m = decrypt PKE(ske, ce).(10)
user applies to the IGC, and the IGC network activities. In addition, NuCy-
generates a unique identifier ID i that pher is interoperable with different There are multiple reencryption
is used as a public key. Similar to the decentralized storage systems such as nodes to perform this reencryption
way in which the IGC generated its sig- InterPlanetary File System (IPFS) and and apply access management poli-
nature, it generates the user’s private Swarm.5 cies.5 This allows for a system that does
key Ski by computing t 1 and t2. Public-key encryption (PKE) is a not need an always-online entity, and
Then, the IGC computes Ski = [t2]P2 to type of encryption between two par- the benefit of using proxy reencryp-
get the private key. This is done offline ties and does not require a common tion in this scenario is that a proxy
to send keys safely while the process is secret. Each user has a public/private can transform ciphertexts from one
recorded on the blockchain.3 key pair (pkr/skr), and hybrid crypto- public key to another without chang-
If a key needs to be updated, the systems can be created to combine ing the underlying message.5 This
user can act independently to accom- this convenience with the efficiency allows for noncentralized key rotation
plish this by selecting a random num- of a symmetric encryption algo- and not having to expose unencrypted
ber k ∈ [1, N − 1] as a private key and rithm. An example is the use of the keys server side.
compute Pki = [k]P 1 as the public key. Elliptic-Curve Integrated Encryption With proxy reencryption, min-
Similar to the previous phases, t 1 and t2 Scheme (ECIES),5 which relies on a ers in the network can perform key
would be calculated to get the new Ski key-derivation function for deriving a rotation and are incentivized to do so
with the exception that the SkI in the Message Authentication Code key and with tokens. The steps are as follows.
previous equations would be replaced then deriving a symmetric encryp- Within a specified time interval, min-
by the random number k. This process tion key from the Elliptic-Curve Dif- ers can stake several tokens by using a
would be recorded in the blockchain as fie-Hellman (ECDH) shared secret.5 smart contract (SC). Miners reencrypt
a transaction.3 With this, a reencryption algorithm the data, and a challenge protocol is
Because cryptographic keys have creates a key by randomly generating performed to ensure that the reen-
the possibility of being leaked, there an ephemeral key pair ske/pke instead crypted data are not wrong or random.
needs to be an efficient way to give of having to use two private keys to This challenge is created by using
users new keys. In this approach, the generate a reencrypted key. With the multiple “fake” encryption keys and
IGC is used to generate a new key for use of a reencryption node rk A→ e, this requiring that the miners supply the
the user, if needed securely, and the would look like Egorov et al.5 hash before and after reencryption. If
identifier ID i of the user would remain the miner is challenged and exposes
the same, and t 1 and t2 would be cal- ske = random()(3) a “fake” reencryption, the challenger
culated in the same manner as a new rk A→ e = rekey(sk A, ske)(4) receives the miner’s stake.
user registration to get a new pri-
vate key Ski. The public information sk′e = encrypt pke(pkB, ske)(5) Blockchain-based KM
would be shared on the blockchain as rk A→ B = (rk A→ e, sk′e).(6) in unmanned aerial
a transaction.4 vehicle networks
Because sk′e would be needed to The immutable and decentralized
The NuCypher KMS decrypt the reencrypted ciphertext nature of blockchain technology
NuCypher KMS is a DKMS, encryption, cA, sk′e is attached to the reencryption makes it a promising solution for the
and access control service that enables result (Egorov et al.5) challenges of KM. Blockchain tech-
private data sharing between arbi- nology has been applied to develop a
trary numbers of participants in pub- ce = reencrypt(rk A→ e, cA)(7) DKMS for unmanned aerial vehicles
lic consensus networks and uses proxy cB = (ce, sk′e).(8) (UAVs).6 This is done because flying

J U LY 2 0 2 4  29
ATTRIBUTES OF QUALITY

ad hoc networks (FANETs) usually to create a random value rk. With this calculated by PK B = SK B ⋅ P. Once the
require base stations (BSs) or complex random value, each head UAV can public key is calculated, the following
infrastructure that can become attack compute the hash of Block k and subse- information is published: (n, q, P, PK B).
targets or increase the communication quently (as in Tan et al.) compute6 After the public key of a UAV is pub-
overheads of the UAVs.6 Decentraliz- lished, the BS authenticates the iden-
ing the KM process allows better per- H(Block′k) = H(rk H(Block k)).(11) tity of UAVs and divides all the authen-
formance against attacks and light- ticated UAVs into different clusters Cx,
weight energy consumption for UAVs After calculating this hash, the head where x denotes the cluster number,
in the network. UAVs calculate a miner election score and a computationally powerful UAV
The decentralized architecture used of each head UAV in the network; is selected as cluster head. The BS dis-
in this FANET includes clusters of UAVs heads can be denoted as UAVx0, where tributes key pairs to all members such
that have a “cluster head” UAV and BSs the x represents the xth cluster. Scores that the following set can be generated
(Tan et al.6):

LML x = {PK x1, PK x2, PK x3, …, PK xnx}.(13)

THE IMMUTABLE AND DECENTRALIZED
This set contains all the public keys
NATURE OF BLOCKCHAIN TECHNOLOGY of valid member UAVs in Cx (n x denotes
MAKES IT A PROMISING SOLUTION FOR the number of member UAVs in Cx).6
THE CHALLENGES OF KM. Each drone in Cx stores its key pair as
well as LML x, and public keys are used
as identifiers. Once all clusters are cre-
ated, the BS can generate the following
where UAVs are initialized. This head are calculated as in Tan et al.,6 where ⊕ set (Tan et al.6):
UAV has more computational resources denotes the XOR operation and PK x0 is
than the other UAVs in the cluster and the public key of UAVx0 CHL = {C1, PK10; C2, PK20; …; Cm, PKm0}
higher transmission power. Mem- (14)
ber UAVs can communicate only with score x0 = H(Block′k) ⊕ H(PK x0).(12) This set contains all the public
other members in the same cluster, keys of the head UAVs in the network.
while the head can maintain commu- Once these scores are calculated, the Each UAV receives and stores the CHL.
nications between different clusters.6 head UAV with the lowest score becomes Lastly, the BS generates the genesis
This means that the nonhead UAVs are the miner for Block k+1 . If there is block Block0 for the blockchain that
required to keep only the latest state some problem with the chosen miner, includes the initialization transaction
of the blockchain, containing the lat- the next lowest score is chosen as the for each drone, a signature based on
est member list and the cluster head alternative. the private key of the BS, and a time
list (CHL). Before UAVs are placed online and stamp.6 This genesis block is sent to all
Because these devices have lim- flown to do their work, they are ini- head UAVs.
ited resources, a different consen- tialized at a BS in an offline and secure Because confidentiality must be
sus approach is used. The consensus environment.6 This involves a gen- kept within clusters, head UAVs dis-
involves miner election to elect a glob- eration of system parameters where tribute cluster keys to encrypt data.
ally recognized generator of the next a nonsingular elliptic curve (n) is Head UAVs first generate a cluster
block from all the blockchain main- selected, where n is a large prime num- key Gkeyx and then use a cluster key
tainers (head UAVs) at each round.6 If ber and contains points that form an distribution algorithm η(⋅) combined
the system is at the kth block genera- additive cyclic group . P is a gener- with LML x to broadcast η(Gkeyx) and
tion phase, a Block k is generated and ator of this cyclic group with order Sign SK x0{H(η(Gkey x))} to all valid
distributed, while head UAVs use a dis- q. The BS randomly selects a secret members of the cluster Cx.6 Once a
tributed random generation protocol key SK B ∈ *, and the public key is different head UAV receives η(Gkeyx),

30 COMPUTER  W W W.CO M P U T E R .O R G /CO M P U T E R

it verifies the signature of UAVx0 and KDC can also establish one-time token for the new user. After updating
uses an inverse algorithm η−1(⋅) with communications to authenti- the key, the SKDC uses JoKeyDistrib-
its private key Sk xy to extract Gkeyx. cate a user or device. ute to distribute a rekeying message
in the group. This message is given to
Lightweight DKMS in The system is initialized by the the main KDC and all users subscribed
IoT environments group key manager, where the KDC to this group. Users that are already
Access control is a relevant subject in runs an MkeyGen algorithm to gener- established in the group update TEKj
enterprise computing environments ate a primary key and several subor- through a hash function to minimize
but can also suffer from the same pit- dinate keys to communicate with the overhead in the system, where TEK is
falls as other centralized architec- SKDCs under its control. If a new SKDC a traffic encryption key. This ensures
tures. A token management protocol is added to the system, the KDC runs that Ujoin cannot access the data that
for managing keys and a hierarchi- the MkeyGen algorithm again to gen- the group previously exchanged. The
cal architecture, named DLGKM-AC, erate a subordinate key and to update SKDC sends this, and the subordinate
which includes a key distribution cen- the primary key.7 After the primary token, to Ujoin via unicast message.7
ter (KDC) having ownership of many and subordinate keys are generated,
sub-KDCs (SKDCs), has been proposed.7 SKDCs initialize all key pairs, and Distributed KM in 5G
The number of SKDCs is not fixed, and multiple IoT DGs are created to group network small cells
they help alleviate potential overhead together devices with similar attri- With the advent of the 5G cellular
that a centralized architecture would butes. The KDC creates key encryption network, there is a call to implement
have when rekeying. keys (KEKs) for each device in the DGs, small-cell technolog y to f unction
The system model in this approach and a logical key hierarchy (LKH) tree in 5G environments. The use of net-
consists of three layers. is created to distribute updated keys to work coding-enabled mobile small
devices.7 For the LKH tree, devices in cells (NC-MSCs) can fill this void since
1. The publisher layer contains a DG are leaf nodes, and random keys these devices can be set up on the fly
groups of IoT devices, namely DKj are created and assigned to leaves and cover an urban landscape as nec-
device groups (DGs) with lim- in the tree. Each device Dj in a DG essary, and they also allow multihop
ited resources. If a new device receives path keys PK t from the root device-to-device (D2D) communica-
joins the system, it is assigned node to the parent node of the tree.7 tion. DISTANT, a decentralized KM
to one of these DGs. These path keys are used as KEKs to approach that uses NC-MSCs, has
2. In contrast, the subscriber layer encrypt the group key by the KDC in been introduced.8 The network model
is composed of a group of users, a rekeying process and to distribute for DISTANT builds off of the model
called a user group (UG), that updated keys to leaf nodes. by project SECRET in de Ree et al.8
wants access to the data from Multiple UGs UGK can also be con- and features a distributed certificate
the publisher layer. When a user structed, and each UGK can accommo- authority (CA) network within the
joins a UG, encryption keys are date rk users for a period T. Each user Ui model. The entire cellular network
distributed using the primary in the UG is authenticated before join- is divided into networks of NC-MSCs,
key encryption (MKE) technique. ing the system and shares a secret key and each is maintained by a hotspot
3. In the group key manager layer UK i with the SKDC.7 The UG is given an that performs the duties of a cluster
resides the KDC central server identifier ID by the SKDC, IDUGK. head. Each hotspot is controlled by
that relates publishers to the For updates to groups, such as when a centralized software-defined con-
rest of the system and manages a member joins or leaves, keys need to troller, and through the cooperation
the keys’ update process within be updated. An example is when a new of these hotspots, a wireless network
the DGs.7 This KDC has a backup user Ujoin joins a group. First, the user with several gateways is formed. Data
server to maintain the latest registers with the relevant SKDC after traffic between nodes is done through
keys in the system, and SKDCs authentication. The SKDC follows the multihop D2D communications where
manage group communications JoKeyUpdate algorithm to update the a node with data (source nodes) trans-
within the UG. If needed, the group key and generate a subordinate mits data to nodes that request the

J U LY 2 0 2 4  31
ATTRIBUTES OF QUALITY

data (destination nodes).8 Nodes are de Ree et al.8 This is done to establish hash computed in the Schnorr’s sig-
not required to be in the same mobile keying materials. First, the TTP selects nature step mentioned in the previous
small cell, owing to D2D communica- a random secret sv TTP ∈ * and com- section, then the signature is deemed
tions and relay nodes. The DISTANT putes the partial commitment cTTP . valid. For the verifier to accept the con-
protocol uses the difficulty of the dis- This is transmitted to node i so that it tent of the self-generated certificate,
crete logarithm problem to enable can compute its own commitment ci. the following equivalency must be
secure KM and is composed of the fol- Then, i can transmit (IDi, ci) to the TTP valid (de Ree et al.8):
lowing themes.8 so that the TTP can compute the partial
private key SKTTP that the node can use PK i,k ≡ ci,k ⋅ (ci,0 ⋅ PK M )
h(IDi,ci,0) h(IDi,ci,k)

Network initialization. A set of t to compute its key pair. When this pro- (mod p).(22)
nodes is selected and given keying cess is done for all t initial nodes, the
material that allows the t nodes to ini- TTP destroys f m(x) and the associated An efficient decentralized KM
tial join nodes during network deploy- primary private key SK M (de Ree et al.8) mechanism for vehicular ad
ment collectively. This means that an hoc networks with blockchain
online centralized trusted third party cTTP→ i ≡ gsv TTP (mod p)(19) Vehicular ad hoc networks (VANETs)
(TTP), such as a network operator, is sv i ⋅ bring essential modernization to
ci ≡ g cTTP→ i (mod p)(20)
not needed for KM services.8 transport systems through intelli-
To create the primary key pair SKTTP→ i.(21) gent transportation systems. With
and its shares, the TTP generates two such developments, practical secu-
large prime numbers p and q such that Self-generated certificate creation rity frameworks are needed. A DKMS,
q | p − 1. Also, the TTP selects a gener- and update. To reduce overhead on the DB-KMM, based on blockchain has
ator g of a cyclic multiplicative group system, nodes can independently gen- been proposed.9 It features automatic
* with order q and a hash function h(⋅) erate and update their own certificates registration, update, and revocation of
that is collision free. A random pri- as follows.8 The initial keying material a user’s public key while using a light-
mary polynomial f M(x) of degree t − 1 (ci,0, SK i,0, PK i,0) is kept secret during weight authentication and key agree-
is generated by the TTP where each network deployment and used to derive ment protocol based on the bivariate
coefficient of the terms in the polyno- keying material (ci,k, SK i,k, PK i,k) for polynomial. Vehicles are assumed to
mial is an element in *. The private the kth self-generated certificate. The be equipped with an on-board unit
key is SK M, and the public key is PK M. node i picks a random secret value and and wireless communication capabil-
The TTP gives each node i an identifier computes its new commitment, simi- ities, including a hardware security
ID i and a share si of the primary private lar to the commitment equation in net- module for secure storage.9
key. These shares will need the ability to work deployment. With this new com- In network initialization, a Vehicle
be verified, so the TTP computes wit- mitment, the node computes its new Service Provider (VSP) generates sys-
ness values wi for i = {0, …, t − 1}, and key pair that can be used for the kth tem parameters and algorithms. The
each node is provided public values p, self-generated certificate CERTi,k, which Elliptic-Curve Digital Signature Algo-
q, g, h(⋅), PK M, {wi} so that a node can includes the node’s identity, initial com- rithm (ECDSA) is used for authentica-
verify its share.8 This process includes mitment, new commitment, new public tion, and the ECIES is used for encryp-
the following calculations: key, new time stamp, and signature. tion and decryption.9 The VSP selects
n bivariate t-degree polynomials {f1,
SK M = f M (0) (15) Verifying a self-generated certificate. f2, …, fn} with a node p and where f is
PK M ≡ gSK M (mod p)(16) This certificate must be distributed and defined by Ma et al.9
verified by verifiers in the network.8
si ≡ f M(ID i) (mod q)(17) t
First, the verifier checks the validity
wi ≡ gai (mod p).(18) based on the time stamp of the certif-
f ( p, y) = ∑ a x y . (23)
ij
i j

i, j = 0
icate and then computes a hash α that
The TTP also initializes a proto- is derived from values in the certifi- Each polynomial coefficient aij is a
col with each node i, as described by cate CERTi,k. If this hash matches the positive integer randomly selected on

32 COMPUTER  W W W.CO M P U T E R .O R G /CO M P U T E R

a finite field GF(q), and each polyno- and the public key PubKRSU through a its private key PriK RSU as follows
mial generates t key values (KVs) and broadcast message from the RSU and (Ma et al.9):
calculates polynomial fragments (F) calculate Kv. V must also calculate a
with the KV through the following (Ma hash code HC1, where Mreq is the request S2 ← SigPriKRSU(IDRSU, KRSU, Mres, T RSU).
et al.9): message and Tv is the current time (28)
stamp of V.9 It is assumed that the hash-
t
ing algorithm H is collision resistant Upon V receiving the message (IDRSU,
gj = ∑ a p (0 ≤ j ≤ t). (24)
ij
i
Mres, S2, T RSU), V checks TRSU − Tv ≤ ΔT. If
i=0 Kv ← f(KVv, KVRSU)(25) this inequality is satisfied, V retrieves
The VSP registers each blockchain HC1 ← H(ID v, Kv, Mreq, Tv).(26) the public key of the RSU from the
node with the blockchain network using blockchain and checks the validity and
the account private key and address to To verify the legitimacy of the legitimacy of the public key, PubK RSU
generate an SC. Once on the network, request, V signs {ID v, Kv, Mreq, Tv} with (Ma et al.9) If verified, V asserts that the
the blockchain node automatically PriKv to obtain S1 and then send {ID v, RSU is legal, and the mutual authenti-
creates a contract address, and then, KVv, Mreq, Tv, HC1, S1 } to the RSU. The cation process is completed.
only the VSP and blockchain nodes are
allowed to send the transaction to trig-
ger the execution of an SC, which offers
four functions: registerPK, updatePK, THE DKMS ARCHITECTURES
updatePK, and voteUser. These func-
tions manage the public keys.9
DISCUSSED IN THIS ARTICLE COVER
SEVERAL DIFFERENT TECHNIQUES,
Registration. To register with the AND ALL ARE DECENTRALIZED OR
VSP, a user submits information such SEMIDECENTRALIZED.
as name, ID number, phone number,
driver’s license, license plate, etc.9 The
VSP generates a unique ID, a key pair
(PubK, PriK), and a validity period (VP). RSU then checks T RSU − Tv ≤ ΔT. If suc- COMPARISON OF
The VSP then randomly selects m poly- cessful, the RSU calculates a session SURVEYED DKMS
nomials where (1 ≤ m ≤ n) and distrib- key K RSU and computes V’s commit- This section examines and compares
utes the KV and corresponding seg- ment value HC1′ to see if it matches HC1 the different aspects of each DKMS
ment F to the registered user. The VSP (Ma et al.9) approach discussed in this article.
encapsulates binding data ID, PubK, Comparison characteristics include
VP in JavaScript Object Notation for- HC1′ ← H(ID v, K RSU, Mreq, Tv).(27) the architectures, use case areas, cryp-
mat and encodes the data as hexadeci- tographic algorithms, and blockchain
mal embedded into the data field of the If it does not match, the process is implementations.
transaction.9 This is sent to the block- term inated. Ot her w ise, t he RSU
chain network and the SC function reg- retrieves PubKv and VP from the block- Overall architecture
isterPK is triggered. After successful chain. After ensuring the legality of The DKMS architectures discussed
execution and mining, this transaction the public key, the RSU applies PubKv in this article cover several different
is recorded on the blockchain. The VSP to verify the correctness of signature techniques, and all are decentralized
provides secret material containing the S 1 , and if successful, V can join the or semidecentralized. The approach
binding data and polynomial parame- VANET.9 Vehicles must also authen- of Sandoval et al.15 uses a trustless
ters to the newly registered users.9 ticate RSUs so that adversaries cannot Dolev–Yao model with untrusted buf-
imitate RSUs. To enable authentica- fer/relay servers, contrasting with
Authentication. A vehicle V can get a tion, the RSU signs a response mes- SM9’s decentralized network of IGCs.3
roadside unit’s (RSU’s) key value KVRSU sage {IDRSU, K RSU, Mres, T RSU} with Here, IGCs generate unique identifiers

J U LY 2 0 2 4  33
ATTRIBUTES OF QUALITY

and initial key pairs for users, seen as a VANETs differ from IoT networks in and low-resource applications, such as
trustworthy element. that vehicular networks need to have SCADA systems, while the architecture
NuCypher’s architecture includes a much higher flexibility when it comes of de Ree8 is specifically designed for
decentralized network of reencryption to the mobility of users. This is tradi- wireless mobile networks. The use of
nodes, allowing users to rotate or update tionally done through a decentral- RSUs in Ma et al.,9 Lu et al.,10 and Javaid
their keys with a minimum stake. Yu ized network of RSUs along roads, and et al.12 makes these approaches imprac-
et al.14 propose a serverless architecture these RSUs form nodes in a blockchain tical outside of a VANET setting.
inspired by the Web-of-Trust, where network and allow for indirect vehi- When it comes to scenarios involving
user trust is established through a net- cle interaction with the blockchain to an unavailable cryptographic key or legal
work of introductions, and message sets perform KM. This can also be seen in investigation into messaging systems,
are stored in a digest tree using Chrono- Javaid et al.12 with the exception that the multiagent key recovery system in
Sync for synchronization. user identity is generated from physi- Kanyamee and Sathitwiriyawong11 can
Kanyamee et al.11 focus on decen- cal unclonable functions (PUFs). be used. The decentralization of the key
tralized key recovery using a net- The architecture of Lu et al.10 uses a recovery agent in this KMS allows for
work of agents, enhancing reliability law enforcement agency for managing high system availability and possible
against key recovery center attacks. the network and storing pairs of public malicious attacks on key recovery sys-
Tan et al.6 implement a system where a keys with real identities in case there tems used by law enforcement.
BS deploys UAVs forming clusters with are disputes. Lu et al.10 also use two sets
cluster heads managing keys via block- of Merkle trees, where a chronological Cryptographic algorithms
chain. Similarly, Khasawneh et al.13 Merkle tree is used for hashing trans- Key agreement in Sandoval et al.15 uses
divide sensors into grids with heads for actions chronologically and including the ECDH protocol. This allows users in
intragrid communication, and De Ree the root of the tree in the blockchain. the network to go through a round of
et al.8 use a hierarchical structure with The other Merkle tree used is the lexi- password-authenticated key exchange
mobile hotspots and a central control- cographical Merkle tree to keep track of and share their shared secrets as neces-
ler for small-cell networks. any keys revoked in the KMS.17 sary. Sandoval et al.15 also discuss using
Within the field of the IoT, many use the ring learning with errors problem
cases involve devices or sensors sending Use case areas for quantum safety in the future as
their data to a central computing sys- In the Overall Architecture section higher quantum bit (qubit) quantum
tem, where they can then be interpreted mentioned previously, Yu et al.14 and computers are becoming more stable.
by users, as done in supervisor control Sandoval et al.15 are focused on e-mail Public-key cryptography is also
and data acquisition (SCADA) systems. and messaging applications. SM93 and employed in SM93 through the use of the
If this is extended to KM, it is imperative NuCypher5 have many different use SM9 algorithm. This is different from
to increase the availability for the user, cases, including encrypted messaging ECDH due to the use of identity as the
and Dammak et al.7 do this by using systems. This allows for chat function- public key for a user. SM9 is an asymmet-
an architecture that decentralizes a alities, much like in Yu et al.14 ric algorithm, and the implementation
KDC using SKDCs, splits devices into The group-centric architecture of involves a user applying to an IGC for an
DGs based on functionality, and splits Zhou et al.16 allows for data-intensive identifier that is used as a public key for
users into groups with similar inter- services, such as video streaming, due the user. Once the identifier is calculated,
ests. SKDCs can then be used to manage to the ability of group heads to cre- the IGC can calculate the private key and
group communications for users and ate new session keys whenever a user send both keys securely to the user. Tu
take the load off of the KDC,7 resulting leaves or joins the group. This princi- et al.3 use a blockchain for key updates,
in a more flexible system where the KDC ple can be extended into other services so SM9 digital signatures are used to sign
interacts with devices and SDKCs inter- that require a subscription, such as transactions on the blockchain to guar-
act with users. Having the KDC as the music streaming or GPS services. Other antee that transactions cannot be forged;
party to store public keys allows for a group-centric architectures, such as Tan the SM9 digital signature algorithm uses
logical key hierarchy (LKH) for efficient et al.,6 Dammak et al.,7 and Khasawneh a key generation center to generate the
storage and retrieval of keys. et al.,13 can be used for IoT systems digital signature of a signer.

34 COMPUTER  W W W.CO M P U T E R .O R G /CO M P U T E R

 The NuCypher KMS5 uses an ECIES the KDC generates a secondary key for (IGC), which initializes the system, gen-
in its proxy reencryption approach; a new SKDC and update its primary erates its key pair, creates a unique iden-
proxy reencryption is a type of PKE that key. Upon this initialization, each tifier and key pair for a user in the sys-
allows for reencryption without alter- SKDC initializes the system for many tem (registration), changes identity for
ing ciphertext. When data are stored in users by generating a primary key and a user if needed, participates in the key
a cloud or decentralized storage, they a set of N public-private key pairs (sec- update process, and allows for a user to
are encrypted with the owner’s pub- ondary keys) for users in the network. change their private key if the key has
lic key, and the data themselves are Like other approaches in this arti- been leaked. The changing of a private
encrypted with a random symmetric cle, de Ree et al.8 rely on the discrete key or the changing of identity requires
key with one key per file. logarithm problem for its security. A the signature of the IGC. This places
The use of multilinear forms in Zhou primary key pair and primary polyno- much responsibility on the IGC, and
et al.16 uses the Computational Multi- mial are generated upon network ini- because of this, IGCs are decentralized
linear Diffie-Hellman (CMDH) problem, tialization, and each node in the net- into a network of IGCs to avoid the prob-
which is computationally hard. These work is given a share of the primary lems associated with a central authority.
multilinear forms reduce the rekeying private key. The decentralized trusted When the IGC wants to update its own
cost for group keys when there is leav- third party (TTP) assists a node in gen- key, the process is recorded on the block-
ing or switching by users in the net- erating its key pair, and once the ini- chain as a transaction through a consen-
work. Public/private keys are gener- tial nodes have obtained their keying sus mechanism.3
ated for servers in the architecture. In material, the TTP destroys the primary Key updates and key rotations with
the NDN Chat applications of Yu et al.,14 polynomial and primary private key.8 the blockchain in NuCypher5 involve
all data packets are authenticated with In VANETs, Ma et al.9 use a VSP that the use of SCs with a minimum stake
digital signatures, and data packets are chooses a bivariate function and employs amount for reencryption services.
signed with public-key cryptography. ECDSA or ECIES (elliptic-curve cryptog- Blockchain for decentralization in
Symmetric cryptography is used raphy) to generate key pairs for new vehi- IoT drone networks is explored in Tan
in Kanyamee and Sathitwiriyawong11 cles. Public keys are updated through et al.,6 where there is a BS that deploys
with parties sharing a secret session transactions on a blockchain and are all the drones and distributes public and
key. A decentralized network of trusted stored in the RSUs. Asymmetric cryptog- private keys to all members of the net-
key recovery agents helps to recover raphy is also used in Lu et al.,10 with the work. Once deployed, many users form
keys in the case of loss or investigation. exception being that certificates contain- a single group that contains a group
The generation of system param- ing public keys and signatures of authori- head. Group heads have more comput-
eters in Tan et al.6 involves the BS ties are also used. This differs from Javaid ing resources and communicate with a
selecting a nonsingular elliptic curve et al.,12 which relies on the PUFs that offer blockchain used for KM purposes.
to generate a private key and a corre- cryptographic identifiers based on the Using blockchain for KM is also
sponding public key. For drones in the hardware’s inherent differences when extended to VANETs in Ma et al.,9 Lu
network, the public and private key manufactured and can establish a root of et al.,10 and Javaid et al.12 with the use
pair is also created by the BS when first trust and replace secret keys. of RSUs. While all of these articles use
deployed into the network. approaches with RSUs, the responsibil-
The grid architecture of Khasawneh Decentralization with blockchain ity of the RSUs differs across approaches.
et al.13 has sensors in the network Blockchain is used as a means for inter- Ma et al.9 use RSUs as nodes in the block-
establishing shared secret keys with action and storage in several of the chain network that participate as min-
the grid head in their group. A common approaches discussed here. In Tu et al.,3 ers, host the blockchain, interact with
key is established between grid heads Egorov et al.,5 Tan et al.,6 Ma et al.,9 and the blockchain to receive public key
that lie on the same row and share a Javaid et al.,12 a single blockchain is data, broadcast public keys, and verify
common key between grid heads that used, while Lu et al.10 employ two sepa- vehicles’ signatures.
lie on the same column. rate blockchains to improve the scalabil- Lu et al.10 require that the RSUs verify
With the use of the KDC and SKDCs ity of the decentralized KM scheme. Tu all broadcasted messages and transac-
in Dammak et al.,7 MKE is used where et al.3 use an Identity Generation Center tions that are recorded on the blockchain.

J U LY 2 0 2 4  35
ATTRIBUTES OF QUALITY

The RSUs also must update data for provide enhanced security and effec- design their own specialized DKMS. We
authentication that are stored in each tiveness compared to traditional cen- also recognize that further research is
vehicle through vehicle-to-infrastructure tralized PKI systems. This article has needed to address the challenges and
communication. presented a detailed demonstration of limitations of current DKMS and to
Javaid et al.12 also use the RSUs as select DKMS systems. The other out- develop new approaches to enhancing
miners that also host the blockchain and comes of our systematization effort, their performance, scalability, security,
SCs. However, in Javaid et al.,12 the RSUs as illustrated in Table 1, highlight the usability, and governance.
also act as a decentralized CA network varying levels of support for gover- We outline some of the key research
and, therefore, must store all certifi- nance, privacy, and security across dif- directions as follows:
cates that have been issued to vehicles. ferent DKMS platforms. Overall, our
This allows an enforcer SC to verify that intent for this article is to provide orga- 1. Interoperability standards: Estab-
a vehicle is registered with the network. nizational decision makers and devel- lish protocols and standards to
opers with a comprehensive under- foster secure communication
FUTURE STUDYING standing of the current landscape of and key exchanges among vari-
DKMS represent a significant improve- DKMS. We trust that this will aid them ous DKMS.
ment in the field of KM. By leverag- in making informed decisions about 2. Performance and scalability:
ing decentralized networks and cryp- adopting existing DKMS frameworks Devise efficient consensus
tography technologies, these systems or leveraging essential technologies to algorithms, enhance data

TABLE 1. Comparisons of selected DKMS.

DKMS Cryptographic Consensus

schema Architecture Use case areas ­methodologies Blockchain algorithms SC

BARS10 Decentralized VANET Hardware based Customized blockchain PoW x

9
DB-KMM — VANET ECDSA/ECIES Ethereum PoW ü

LGKM-AC7 Semidecentralized The IoT and wireless networks primary key and — — —
secondary keys

FANET6 Semidecentralized The IoT and wireless networks PKI — — —

HADM-KRS11 Decentralized General purpose Session key — — —

Javaid et al.12 Decentralized VANET PKI Ethereum Dynamic PoW ü

Khasawneh Semidecentralized The IoT and wireless networks Shared secret key — — —
et al.13

NDN14 Decentralized Message service PKI — — —

NuCypher5 Decentralized General purpose ECIES Consortium/private PoS ü

blockchain

PakeMail15 Semidecentralized E-mail or message services ECDH — — —

SM93 Decentralized General purpose SM9 Not mentioned PoW ü

Zhou et al.16 — Video streaming CMDH — — —

PoW: proof of work; PoS: proof of stake.

36 COMPUTER  W W W.CO M P U T E R .O R G /CO M P U T E R

 storage techniques, and man-
age distributed systems adeptly
to improve the performance ABOUT THE AUTHORS
and scalability of DKMS.
3. Security and privacy: Foster WEI YAO is a Ph.D. candidate in computer science at New Jersey Institute of
advanced KM approaches to Technology, Newark, NJ 07102-1982 USA. His research interests include the
mitigate the risks of key loss Internet of Things, cybersecurity, blockchain technologies, and applications in
or theft while heightening various areas. Yao received an M.S. in electronic engineering from the Univer-
authentication and authoriza- sity of Hartford and an M.S. in computer science from Central Connecticut State
tion mechanisms for superior University. He is a Graduate Student Member of IEEE. Contact him at wy95@
security and privacy.18 njit.edu.
4. User experience: Create user-
friendly interfaces accessible NICHOLAS GORLEWSKI is a machine learning engineer at Prudential Finan-
to a broad user base, including cial, Newark, NJ 07102 USA. His research interests include blockchain technol-
those with limited technical ogies, software systems, and applied machine learning. Gorlewski received an
expertise, to encourage wide- M.S. in computer science from the New Jersey Institute of Technology. Contact
spread DKMS adoption. him at [email protected].
5. Governance and regulation:
Develop governance struc- FADI P. DEEK is a distinguished professor at the New Jersey Institute of Tech-
tures to maintain system nology (NJIT), Newark, NJ 07102-1982 USA. His faculty appointments are in
integrity and formulate regu- two departments: informatics (in the College of Computing) and mathematical
latory frameworks to ensure sciences (in the College of Science and Liberal Arts). He also serves as a
legal and ethical DKMS member of the graduate faculty at Rutgers University-Newark. Deek received
operations.19 a Ph.D. in computer and information science from NJIT. Contact him at fadi.
6. Applications: Explore innova- [email protected].
tive applications of DKMS in
fields like identity manage- GUILING (GRACE) WANG is a distinguished professor of computer science and
ment, data security, and supply associate dean for research at the Ying Wu College of Computing, New Jersey
chain management, leveraging Institute of Technology (NJIT), Newark, NJ 07102-1982 USA, and the founding
the unique features of DKMS director of the NJIT Center for AI Research. She also holds a joint appointment
to enhance their relevance in at the MT School of Management. Her research interests include FinTech, deep
various domains.20 learning, blockchain technologies, and intelligent transportation. She received
a Ph.D. in computer science and engineering with a minor in statistics from

W
Pennsylvania State University. She is a Fellow of IEEE and the Asia-Pacific Arti-
e encourage researchers ficial Intelligence Association and a Chartered Financial Analyst. Contact her at
and developers to continue [email protected].
exploring the potential of
DKMS to build a more secure, decen-
tralized, and user-friendly future for
digital identity and KM.
REFERENCES 2. M. Blaze, J. Feigenbaum, and J. Lacy,
ACKNOWLEDGMENT 1. U. Maurer, “Modelling a pub- “Decentralized trust management,”
The authors gratefully acknowledge lic-key infrastructure,” in Proc. in Proc. IEEE Symp. Secur. Privacy,
that this research is partially supported Eur. Symp. Res. Comput. Secur., 1996, pp. 164–173, doi: 10.1109/
by Federal Highway Administra- Berlin, Germany: Springer-Ver- SECPRI.1996.502679.
tion Exploratory Advanced Research lag, 1996, pp. 325–350, doi: 3. Y. Tu, J. Gan, Y. Hu, R. Jin, Z. Yang,
(FHWA EAR) Grant 693JJ320C000021. 10.1007/3-540-61770-1_45. and M. Liu, “Decentralized identity

J U LY 2 0 2 4  37
ATTRIBUTES OF QUALITY

authentication and key manage- key management mechanism for NDN chat application,” University of
ment scheme,” in Proc. IEEE 3rd Conf. VANET with blockchain,” IEEE Trans. California, Los Angeles, USA, Tech.
Energy Internet Energy Syst. Integr. Veh. Technol., vol. 69, no. 6, pp. Rep. NDN-0023, 2014.
(EI2), Changsha, China: IEEE, Nov. 5836–5849, Jun. 2020, doi: 10.1109/ 15. I. V. Sandoval, A. Atashpendar, G.
2019, pp. 2697–2702, doi: 10.1109/ TVT.2020.2972923. [Online]. Avail- Lenzini, and P. Y. A. Ryan, “PakeMail:
EI247390.2019.9062013. [Online]. able: Https://ieeexplore.ieee.org/ Authentication and key management
Available: https://ieeexplore.ieee.org/ document/8990046/ in decentralized secure email and
document/9062013/ 10. Z. Lu, W. Liu, Q. Wang, G. Qu, and Z. messaging via PAKE,” Jul. 2021, arXiv:
4. W. Yao, F. P. Deek, R. Murimi, and G. Liu, “A privacy-preserving trust model 2107.06090.
Wang, “Sok: A taxonomy for critical based on blockchain for VANETs,” 16. W. Zhou, Y. Xu, and G. Wang, “Decen-
analysis of consensus mechanisms in IEEE Access, vol. 6, pp. 45,655– tralized group key management for
consortium blockchain,” IEEE Access, 45,664, Aug. 2018, doi: 10.1109/ hierarchical access control using
vol. 11, pp. 79572–79587 , Jul. 2023, ACCESS.2018.2864189. [Online]. multilinear forms,” Concurrency Com-
doi: 10.1109/ACCESS.2023.3298675. Available: https://ieeexplore.ieee. put., Pract. Experience, vol. 28, no. 3,
5. M. Egorov, M. Wilkison, and D. org/document/8428638/. pp. 631–645, Mar. 2016, doi: 10.1002/
Nunez, “NuCypher KMS: Decentral- 11. K. Kanyamee and C. Sathitwiri- cpe.3328. [Online]. Available:
ized key management system,” Nov. yawong, “High-availability decen- https://onlinelibrary.wiley.com/
2017, arXiv: 1707.06140. tralized multi-agent key recovery doi/10.1002/cpe.3328.
6. Y. Tan, J. Liu, and N. Kato, “Block- system,” in Proc. 8th IEEE/ACIS Int. 17. Y. Yuan and F.-Y. Wang, “Towards
chain-based key management for het- Conf. Comput. Inf. Sci., Shanghai, blockchain-based intelligent trans-
erogeneous flying ad hoc network,” China: IEEE, 2009, pp. 290–294, portation systems,” in Proc. IEEE 19th
IEEE Trans. Ind. Informat., vol. 17, no. doi: 10.1109/ICIS.2009.187. [Online]. Int. Conf. Intell. Transp. Syst. (ITSC),
11, pp. 7629–7638, Nov. 2021, doi: Available: http://ieeexplore.ieee.org/ 2016, pp. 2663–2668, doi: 10.1109/
10.1109/TII.2020.3048398. [Online]. document/5222875/ ITSC.2016.7795984.
Available: https://ieeexplore.ieee. 12. U. Javaid, M. N. Aman, and B. Sik- 18. M. de Ree, G. Mantas, J. Rodriguez,
org/document/9311800/ dar, “A scalable protocol for driv- and I. E. Otung, “DECENT: Decentral-
7. M. Dammak, S.-M. Senouci, M. A. ing trust management in internet ized and efficient key management to
Messous, M. H. Elhdhili, and C. of vehicles with blockchain,” IEEE secure communication in dense and
Gransart, “Decentralized light- Internet Things J., vol. 7, no. 12, pp. dynamic environments,” IEEE Trans.
weight group key management 11,815–11,829, Dec. 2020, doi: 10.1109/ Intell. Transp. Syst., vol. 24, no. 7, pp.
for dynamic access control in IoT JIOT.2020.3002711. [Online]. Avail- 7586–7598, Jul. 2023, doi: 10.1109/
environments,” IEEE Trans. Netw. able: https://ieeexplore.ieee.org/ TITS.2022.3160068.
Service Manag., vol. 17, no. 3, pp. document/9119117/ 19. C. Zhang, W. Li, Y. Luo, and Y. Hu,
1742–1757, Sep. 2020, doi: 10.1109/ 13. S. Khasawneh, Z. Chang, R. Liu, “AIT: An AI-enabled trust manage-
TNSM.2020.3002957. M. Kadoch, and J. Lu, “A decentral- ment system for vehicular networks
8. M. de Ree, G. Mantas, J. Rodriguez, ized hierarchical key management using blockchain technology,” IEEE
and I. E. Otung, “Distributed trusted scheme for grid-organized wireless Internet Things J., vol. 8, no. 5, pp.
authority-based key management for sensor networks (DHKM),” in Proc. 3157–3169, Mar. 2021, doi: 10.1109/
beyond 5G network coding-enabled Int. Wireless Commun. Mobile Comput. JIOT.2020.3044296.
mobile small cells,” in Proc. IEEE 2nd (IWCMC), Limassol, Cyprus: IEEE, 20. M. A. Kandi, D. E. Kouicem, M.
5G World Forum (5GWF), Dresden, Ger- Jun. 2020, pp. 1613–1617, doi: 10.1109/ Doudou, H. Lakhlef, A. Bouabdal-
many: IEEE, Sep. 2019, pp. 80–85, doi: IWCMC48107.2020.9148362. [Online]. lah, and Y. Challal, “A decentralized
10.1109/5GWF.2019.8911711. [Online]. Available: https://ieeexplore.ieee. blockchain-based key management
Available: https://ieeexplore.ieee. org/document/9148362/. protocol for heterogeneous and
org/document/8911711/ 14. Y. Yu, A. Afanasyev, Z. Zhu, and L. dynamic IoT devices,” Comput. Com-
9. Z. Ma, J. Zhang, Y. Guo, Y. Liu, X. Liu, Zhang, “An endorsement-based key mun., vol. 191, pp. 11–25, Jul. 2022,
and W. He, “An efficient decentralized management system for decentralized doi: 10.1016/j.comcom.2022.04.018.

38 COMPUTER  W W W.CO M P U T E R .O R G /CO M P U T E R