Continuous Leakage-Resilient Identity-Based Encryption Scheme with CCA Security

In the actual applications, an adversary can break the security of cryptography scheme through various leakage attacks (e.g. side-channel attacks, cold-boot attacks, etc.), even the continuous leakage attacks. That is, a practical cryptography scheme must maintain its claimed security in the continuous leakage setting. However, the previous constructions on the leakage-resilient identity-based encryption (IBE) scheme could tolerate a leakage that is bounded, and cannot resist the continuous leakage attacks. In order to further achieve the better security, a novel method to build the continuous leakage-resilient IBE scheme with tight security is presented in this paper, and the scheme’s security is proved, in the standard model, based on a stronger security assumption that depends on the number of queries made by the adversary. In addition, our proposal has several advantages over previous such constructions, e.g. shorter public parameters, higher communication efficiency, tight security, etc.

The goal of this paper is to design an id-based encryption (IBE) scheme that can flexibly tolerate leakage bounds, by only increasing the size of secret key proportionally, and the security level can be achieved to be against chosen-ciphertext attacks (CCA). As our main technical tool for CCA security, we introduce an initiation of all-but-one lossy filter, which is a simple version of all-but-many lossy filter to the leakage resilient settings. As our main result, we use the all-but-one lossy filter to construct an IBE scheme that is secure against leakage resilient chosen-ciphertext attacks (CCA), and the leakage rate is 1/2 − ο(1).

By a generic transformation by Canetti, Halevi, and Katz (CHK) every Identity-based encryption (IBE) scheme implies a chosen-ciphertext secure public-key encryption (PKE) scheme. In the same work it is claimed that this transformation maps the two existing IBE schemes to two new and different chosen-ciphertext secure encryption schemes, each with individual advantages over the other.In this work we reconsider one of the two specific instantiations of the CHK transformation (when applied to the “second Boneh/Boyen IBE scheme”). We demonstrate that by applying further simplifications the resulting scheme can be proven secure under a weaker assumption than the underlying IBE scheme.Surprisingly, our simplified scheme nearly converges to a recent encryption scheme due to Boyen, Mei, and Waters which itself was obtained from the other specific instantiation of the CHK transformation (when applied to the “first Boneh/Boyen IBE scheme”). We find this particularly interesting since the two underlying IBE schemes are completely different.The bottom line of this paper is that the claim made by Canetti, Halevi, and Katz needs to be reformulated to: the CHK transformation maps the two known IBE schemes to nearly one single encryption scheme.KeywordsEncryption SchemeMessage Authentication CodeChallenge CiphertextChoose Ciphertext AttackBilinear GroupThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In this paper, we propose a generic construction of forward-secure identity-based encryption. We first introduce a relaxed variant of hierarchical identity-based encryption called identity-based binary tree encryption and construct a concrete identity-based binary tree encryption scheme which is provably secure in the standard model. We then show that forward-secure identity-based encryption can be generically constructed from identity-based binary tree encryption. Based on the proposed identity-based binary tree encryption scheme, we obtain a direct chosen-ciphertext secure forward-secure identity-based encryption scheme without random oracles.

A generic construction of CCA-secure deterministic encryption

Middle-product learning with errors (MP-LWE) was recently introduced by Rosca, Sakzad, Steinfeld and Stehlé (CRYPTO 2017) as a way to combine the efficiency of Ring-LWE with the more robust security guarantees of plain LWE. While Ring-LWE is at the heart of efficient lattice-based cryptosystems, it involves the choice of an underlying ring which is essentially arbitrary. In other words, the effect of this choice on the security of Ring-LWE is poorly understood. On the other hand, Rosca et al. showed that a new LWE variant, called MP-LWE, is as secure as Polynomial-LWE (another variant of Ring-LWE) over any of a broad class of number fields. They also demonstrated the usefulness of MP-LWE by constructing an MP-LWE based public-key encryption scheme whose efficiency is comparable to Ring-LWE based public-key encryption. In this work, we take this line of research further by showing how to construct Identity-Based Encryption (IBE) schemes that are secure under a variant of the MP-LWE assumption. Our IBE schemes match the efficiency of Ring-LWE based IBE, including a scheme in the random oracle model with keys and ciphertexts of size $$\tilde{O}(n)$$ (for n-bit identities). We construct our IBE scheme following the lattice trapdoors paradigm of [Gentry, Peikert, and Vaikuntanathan, STOC’08]; our main technical contributions are introducing a new leftover hash lemma and instantiating a new variant of lattice trapdoors compatible with MP-LWE. This work demonstrates that the efficiency/security tradeoff gains of MP-LWE can be extended beyond public-key encryption to more complex lattice-based primitives.

Public-key encryption scheme with optimal continuous leakage resilience

In Identity-Based Encryption (IBE) system, the Private Key Generator (PKG) holds the master secret key and is responsible for generating private keys for the users. This incurs the key-escrow problem, i.e. the PKG can decrypt any user' any ciphertexts without any possible detection. Also, compromising the master secret key will enable an adversary to do anything to the whole system, and having the master secret key be unavailable implies that new users cannot obtain private keys from the PKG, and existing users cannot get their private keys back from the PKG when they lost them. To address the key-escrow problem and protect the master secret key as much as possible with strong security and availability, distributed PKG protocols supporting threshold policy have been adopted in some IBE schemes. In this paper, we propose a distributed PKG protocol that supports the policy to be any monotonic access structures. Also, we propose the first distributed PKG protocol that supports the dynamic changes of the PKGs and the policy, while remaining the master secret key unchanged. The two protocols do not need any third party acting as a trusted dealer to present, and the master secret key should never be generated or resided in any one single site. The protocols are applicable to a generic IBE template, which covers many existing important IBE schemes. When applied to this generic type of IBE schemes, the two distributed PKG protocols do not affect the encryption and decryption algorithms, and only each user knows his own private key.

In this paper, we propose a lattice-based encryption scheme for Identity-Based Encryption (IBE) which is secure against Chosen-Ciphertext Attacks (CCA), and it is deduced from a previous Chosen-Plaintext Attack (CPA) secure IBE scheme by applying Fujisaki-Okamoto transform. Also, we present the design of a lattice-based cryptoprocessor that performs the encryption or decryption of the proposed CCA IBE scheme for the security parameters $n=512$ and $n=1024$ . In this case, the cryptoprocessor is mainly composed of one Random Number Generator (RNG), two hash function cores based on the Secure Hash Algorithm-3 (SHA-3) standard, and one Number Theoretical Transform (NTT) core for performing the polynomial ring operations. NTT core is designed using a systolic array and radix-2 multiple-path delay commutator architecture. The cryptoprocessor was synthesized on FPGA EP4SGX230KF40C2 using Quartus Prime 17.1, and verified in hardware using DE4 board and SignalTap tool. According to the obtained synthesis results, for the security parameter $n =1024$ , the IBE cryptoprocessor performs the encryption in $21.10~\mu $ s, and the decryption in $24.87~\mu $ s.

We present IND-ID-CPA secure identity-based encryption (IBE) schemes with tight reductions to the bilinear Diffie-Hellman (BDH) problem. Since the methods for obtaining IND-ID-CCA secure schemes from IND-ID-CPA secure schemes with tight reductions are already known, we can consequently obtain IND-ID-CCA secure schemes with tight reductions to the BDH problem. Our constructions are based on IBE schemes with tight reductions to the list bilinear Diffie-Hellman (LBDH) problem, and the schemes are converted to those with tight reductions to the BDH problem. Interestingly, it can be shown that there exists a black box construction, in which the former IBE schemes are given as black boxes. Our constructions are very simple and reasonably efficient.

Condition proxy re-encryption is a promising security primitive for pervasive data sharing in such settings as cloud-based social networks and collaborations. However, it is challenging to create a secure condition proxy re-encryption scheme that is applicable for circumstances with multiple conditions. Based on secret sharing, Lan et al. proposed a conditional proxy re-encryption scheme that can support "AND" and "OR" gates over multiple conditions, and claimed that the scheme is secure against Chosen-Ciphertext Attack (CCA) in the random oracle model. However, by giving two concrete attacks, we show that their scheme is not CCA secure and even not secure against Chosen-Plaintext Attack (CPA) under their defined security model. Furthermore, we analyze why the scheme cannot satisfy the security mentioned above.

Secure distribution of digital goods is now a significantly important issue for protecting publishers' copyrights. In this paper, we study a useful primitive for constructing a secure and efficient digital rights management system (DRM) where a server which encrypts digital content and one which issues the corresponding decryption key works independently, and existing schemes lack this property. We first argue the desired property necessary of an encryption scheme for constructing an efficient DRM, and formally define an encryption scheme as split encryption scheme containing such property. Also, we show that an efficient split encryption scheme can be constructed from any identity-based scheme. However, since currently there is no identity-based encryption scheme which is based on well-known computational assumption and/or provable security without the random oracle, by reasonably tuning the system parameter, we show another construction of split encryption which is secure against chosen ciphertext attacks in the standard model assuming that the decision Diffie-Hellman problem is hard to solve.

The attribute-based encryption (ABE) scheme with monotonic access structure cannot deal with an access structure that is associated with the negation of attributes, which is not convenient for real world applications. In this paper, we attempt to propose a more expressive non-monotonic ABE scheme through a new method. To achieve this goal, we firstly propose a linear two-mode identity-based broadcast encryption (TIBBE) scheme based on an identity-based broadcast encryption (IBBE) scheme. We introduce the concept of identity-based revocation (IBR) for this scheme without increasing the size of parameters in IBBE. The scheme is selective identity secure under the m-DBDHE assumption. Then, we convert the TIBBE scheme into a non-monotonic key-policy attribute-based encryption (KP-ABE) scheme with compact parameters. Our KP-ABE scheme could achieve constant-size ciphertexts, and the scale of the private keys grows linearly with the scale of the attribute set. Besides, the computational cost is the lowest compared with other existing non-monotonic KP-ABE schemes.

The first practical identity based encryption (IBE) scheme was published by Boneh and Franklin at Crypto 2001, based on the elliptic curve pairing. Since that time, many other IBE schemes have been...

In this paper, we propose a notion of threshold tag-based encryption schemes that simplifies the notion of threshold identity-based encryption schemes, and we show a conversion from any stag-CCA-secure threshold tag-based encryption schemes to CCA-secure threshold public-key encryption schemes. Moreover, we give two concrete constructions of stag-CCA-secure threshold tag-based encryption schemes, under the decisional bilinear Diffie-Hellman assumption and the decisional linear assumption, respectively. Thus, we obtain two concrete constructions of threshold public-key encryption schemes, both of which are non-interactive, robust and can be proved secure without random oracle model. Our threshold public-key encryption schemes are conceptually more simple and shown to be more efficient than those of Boneh, Boyen and Halevi.Keywordsthreshold public-key encryption schemestag-based encryption schemesthe decisional bilinear Diffie-Hellman assumptionthe decisional linear assumption