在1976年，Diffie和Hellman最早提出了公開金鑰密碼系統（Public Key Cryptosystem, PKC）的概念，開啟了現代密碼學的研究與應用。在2005年，Sun、Hsieh與Hwang (S.H.H.)以傳統公開金鑰密碼系統做為基礎，利用在1998年F. Bao等學者提出植基於加密訊息作為簽章的憑證（Certificate of Encrypted Message Being a Signature, CEMBS）技術，來達到簽章的公平交換性並應用在電子郵件協定上，S.H.H.等學者共提出兩個可建立共享會議金鑰的電子郵件協定。同年A. Dent指出S.H.H.等學者提出之電子郵件協定，其中一個協定無法達到前推私密性。隨後於2006年，針對S.H.H.等學者提出之電子郵件協定的缺點，Kim、Koo與Lee (K.K.L.)提出了兩個電子郵件協定，利用1997年Zheng學者所提出簽密法（Signcryption）的概念，以解決S.H.H.等學者之電子郵件協定所面臨的前推私密性問題。在同年由Lin、Lin與Wang (L.L.W.)指出第二個協定無法達到前推私密性，並提出了改善S.H.H.等學者的協定方法。在2007年，針對K.K.L.等學者所提出之電子郵件協定，Yoon和Yoo指出他們的第二個協定，仍然脆弱容易受到兩個偽造攻擊。有鑑於此，本論文將以PKC金鑰協議協定與S.H.H.、K.K.L.與L.L.W.等學者所提出的安全電子郵件協定作為基礎，加以探討與改善，最後提出一套更有效率的安全電子郵件協定，同時我們的方法亦能符合「認證性安全」、「機密性安全」、「完整性安全」、「不可否認性安全」以及「前推私密性安全」等所有電子郵件協定的安全需求。

In 1976, Diffie and Hellman proposed the concept of public key cryptosystem (PKC). The application and research of public key cryptography are arisen in the modern cryptography. In 2005, Sun, Hsieh, and Hwang (S.H.H.) proposed an electronic mail protocol based on classic public key cryptography. The technique of the Certificate of Encrypted Message Being a Signature (CEMBS) that Bao proposed in 1998 is applied on session key sharing of their e-mail system. In the same year, Dent pointed out that the first one of S.H.H.’s e-mail protocols cannot suffice the property of forward secrecy. Thus, Kim, Koo, and Lee (K.K.L.) proposed two e-mail protocols based on signcryption concept which is proposed by Zheng in 1997 to overcome the flaw of S.H.H.’s e-mail protocol in 2006. Lin, Lin, and Wang (L.L.W.) pointed out that the second one of S.H.H.’s protocols cannot achieve forward secrecy and then they improved the protocol. In 2007, Yoon and Yoo claimed that the second one of K.K.L.’s protocols is still vulnerable to two possible forgery attacks. In this thesis, we will make deep discussions about secure e-mail protocols based on PKC with providing the property of forward secrecy and then build a novel e-mail protocol to withstand the above attacks. Our proposed e-mail protocol can achieve the properties of authentication, confidentiality, integrity, non-repudiation and forward secrecy.

致謝 Ⅰ
中文摘要 Ⅱ
英文摘要 Ⅲ
目錄 Ⅳ
圖目錄 Ⅴ
表目錄 Ⅵ
第一章　簡介 1
第一節　背景與動機 1
第二節　現行的安全電子郵件協定 4
第三節　論文架構 9
第二章　文獻探討 10
第一節　Diffie-Hellman金鑰交換協定 10
第二節　S.H.H.等學者所提出之電子郵件協定 13
第三節　A. Dent指出S.H.H.等學者協定之問題所在 19
第四節　K.K.L.等學者所提出之電子郵件協定 20
第五節　L.L.W.等學者所提出之電子郵件協定 26
第六節　Y.Y.指出K.K.L.等學者協定之問題所在 29
第三章　具高效率前推私密性之安全電子郵件協定 33
第一節　符號定義 33
第二節　我們所提出之安全電子郵件協定一 34
第三節　我們所提出之安全電子郵件協定二 38
第四章　安全性分析 42
第一節　特性分析 42
第二節　效率分析 45
第五章　結論 48
參考文獻 49

[1].A. Bacard, The Computer Privacy Handbook: A Practical Guide to E-Mail Encryption, Data Protection, and PGP Privacy Software, Peachpit Press, 1995.
[2].F. Bao, R. H. Deng and W. Mao, “Efficient and Practical Fair Exchange Protocols with Off-line TTP,” IEEE Symposium on Security and Privacy Proceedings, pp. 77-85, 1998.
[3].C. Boyd and A. Mathuria, Protocols for Authentication and Key Establishment, Springer Verlag, 2003.
[4].A. Dent, “Flaws in an E-Mail Protocol of Sun, Hsieh, and Hwang,” IEEE Communications Letters, vol. 9, no. 8, pp. 718-719, 2005.
[5].W. Diffie and M. E. Hellman, “New Directions In Cryptography,” IEEE Transaction on Information Theory, vol. 22, no. 6, pp. 644-654, 1976.
[6].T. ElGamal, “A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms,” IEEE Transaction on Information Theory, vol. 31, no. 4, pp. 469-472, 1985.
[7].B. Kim, J. Koo and D. Lee, “Robust E-mail Protocols with Perfect Forward Secrecy,” IEEE Communications Letters, vol. 10, no. 6, pp. 510-512, 2006.
[8].I. C. Lin, Y.B. Lin and C. M. Wang, “An Improvement on Secure E-mail Protocols Providing Perfect Forward Secrecy,” Proceedings of the 9th Joint Conference on Information Sciences (JCIS), pp. 697-700, 2006.
[9].B. Schneier, Applied Cryptography, 2nd Edition, John Wiley & Sons, 1996.
[10].B. Schneier, E-Mail Security: How to Keep Your Electronic Mail Private, John Wiley & Sons, 1995.
[11].D. R. Stinson, “Cryptography: Theory and Practice, 3nd Edition, CRC Press, 2005.
[12].H. Sun, B. Hsieh and H. Hwang, “Secure E-mail Protocols Providing Perfect Forward Secrecy,” IEEE Communications Letters, vol. 9, no. 1, pp. 58-60, 2005.
[13].E. J. Yoon and K. Y. Yoo, “Cryptanalysis of Robust E-Mail Protocols with Perfect Forward Secrecy,” IEEE Communications Letters, vol. 11, no. 5, pp. 372-374, 2007.
[14].Y. Zheng, “Digital Signcryption or How to Achieve Cost(Signature & Encryption) << Cost(Signature) + Cost(Encryption),” Proceedings of the 17th Annual International Cryptology Conference on Advances in Cryptology, pp. 165-179, 1997.