Efficient Chosen Ciphertext Secure Public Key Encryption under the Computational Diffie-Hellman Assumption

Anonymous certificate-based broadcast encryption with constant decryption cost

In this study, the authors present an efficient public-key broadcast encryption (PKBE) scheme with sub-linear size of public keys, private keys and ciphertexts and prove its adaptive security under standard assumptions. Compared with the currently best scheme of Garg et al. (CCS 2010) that provides adaptive security under standard assumptions and sub-linear size of various parameters, the ciphertext size of the author's scheme is 94% shorter and the encryption algorithm of their scheme is also 2.8 times faster than the scheme of Garg et al. To achieve their scheme, they adapt the dual system encryption technique of Waters. However, there is a challenging problem to use this technique for the construction of PKBE with sub-linear size of ciphertexts such as a tag compression problem. To overcome this problem, they first devise a novel tag update technique for broadcast encryption. Using this technique, they build an efficient PKBE scheme in symmetric bilinear groups, and prove its adaptive security under standard assumptions.

Broadcast Encryption (BE) schemes allow a sender to efficiently encrypt messages for a large set of receivers. The currently most efficient BE schemes in the stateless receiver scenario are based on symmetric cryptography. However, a variety of business models with mutually mistrusting senders necessitates the use of asymmetric cryptography. We propose a generic framework that allows to transform a large class of symmetric BE schemes into asymmetric schemes, where the transformation employs an arbitrary hierarchical identity based encryption scheme. Applying our framework, we transform a recent symmetric scheme, called layered punctured interval scheme, for which no asymmetric version has yet been published. In addition, we give a formal proof of the chosen ciphertext security of our framework, which allows to generically transform any future symmetric BE scheme within the large class into a chosen-ciphertext-secure asymmetric scheme with the same efficiency measures.

The Yao’s protocol based on garbled circuits is the foundation of secure two-party computation protocols, and Oblivious Transfer (OT), as a important tool in modern cryptography, plays a crucial role in transmitting garbled keys in the Yao’s protocol. In the past decades, considerable attentions have been paid to the Cut-and-Choose technique which is applied to OT protocols to prevent malicious P 1 (called circuit generator) from constructing wrong garbled circuits. Additionally, Bilateral OT becomes a focus point, which can simultaneously transmit P 1 ’s and P 2 ’s (called circuit evaluator) garbled keys to guarantee input consistency of two parties and improve transmission efficiency. As can be seen, some Cut-and-Choose Bilateral OT (CCBOT) protocols have been proposed. Since CCBOT has emerged, the probability of malicious P 1 constructing wrong garbled circuits without being found becomes lower and the input consistency problem is properly resolved too. However, the security of most CCBOT protocols are facing challenges since they are based on the Decisional Diffie-Hellman (DDH) assumption, Quadratic Residues (QR) assumption and Decisional Composite Residuosity (DCR) assumption. In this paper, we present a novel CCBOT protocol with the security against malicious adversaries based on the Computational Diffie-Hellman (CDH) assumption, and analysize the correctness, efficiency and security of the constructed protocol. Besides, we analysize the cheating probability of P 1 in the CCBOT and extend the CCBOT to Single-Choice CCBOT to make the protocol more applicable.

SUMMARYThis paper investigates authenticated key exchange (AKE) protocol under computational Diffie–Hellman assumption in the extended Canetti–Krawczyk model. The core technical component of our protocol is the trapdoor test technique, which is originally introduced to remove the gap Diffie–Hellman (GDH) assumption for the public key encryption schemes. Our contributions are twofold.First, we clarify some misunderstandings of the usage of the trapdoor test technique in AKE protocols showing its adaptation to the AKE protocols is not trivial. We point out some errors in some recent work which attempts to make use of the trapdoor test technique to remove GDH assumption.Second, based on trapdoor test technique, we propose an efficient extended Canetti–Krawczyk secure AKE protocol under computational Diffie–Hellman assumption instead of GDH assumption. Additionally, our protocol does not make use of NAXOS trick and has a tight reduction. In comparison with all existing AKE protocols with the properties as previously mentioned, our protocol with only three exponentiations is most efficient. Copyright © 2013 John Wiley & Sons, Ltd.

Password-based Authenticated Key Agreement (PAKA) protocols are widely used in wireless mobile networks, however many existing PAKA protocols have security flaws. In the 3GPP2 network, there are several PAKA protocols proposed to enhance the security of the Authentication Key distribution mechanism which is subjected to the Man-In-The-Middle attack. We point out the security flaws of such protocols in [10,6] and give two practical attacks on them. Moreover we propose an enhanced PAKA protocol which can resist both undetectable on-line and off-line password guessing attacks, and formally analyze its security in the random oracle model. In addition, we consider a special version of Diffie-Hellman problem called Degenerate Diffie-Hellman problem and propose two assumptions called Computational and Decisional Degenerate Diffie-Hellman assumption which are as difficult as CDH assumption and DDH assumption respectively.

Recently, blockchain technology has attracted much attention of the research community in several domains requiring transparency of data accountability, due to the removal of intermediate trust assumptions from third parties. One such application is enabling file sharing in blockchain enabled distributed cloud storage. Proxy re-encryption is a cryptographic primitive that allows such file sharing by re-encrypting ciphertexts towards legitimate users via semi-trusted proxies, without them learning any information about the underlying message. To facilitate secure data sharing in the distributed cloud, it is essential to construct efficient proxy re-encryption protocols. In this paper, we introduce the notion of proxy self re-encryption (SE-PRE) that is highly efficient, as compared to the existing PRE schemes in the literature. We show that our self encryption scheme is provably CCA secure based on the DLP assumption and our proxy re-encryption scheme with self encryption is CCA secure under the hardness of the Computational Diffie Hellman (CDH) and Discrete Logarithm (DLP) assumption. Our novel encryption scheme, called self encryption, has no exponentiation or costly pairing operation. Even the re-encryption in SE-PRE does not have such operations and this facilitates the service provider with efficiency gain.

Key agreement protocols are one of the fundamental primitives in cryptography. In this paper, we formalize the security model for certificateless one-way and two-party authenticated key agreement protocols and propose a concrete certificateless one-way and two-party authenticated key agreement protocol. The security of our protocol is proven under the computational Diffie-Hellman, square computational Diffie-Hellman and gap bilinear Diffie-Hellman assumptions. As for efficiency, the protocol requires only one pass and has low communication overhead.

A proxy signature scheme enables a signer to transfer its signing rights to any other user, called the proxy signer, to produce a signature on its behalf. Multi-proxy signature is a proxy signature primitive which enables a user to transfer its signing rights to a group of proxy signers in such a way that every member of the authorized group must “participate” to sign a document on behalf of the original signer. We propose an efficient and provably secure identity-based multi-proxy signature scheme from bilinear map based on the hardness of the computational Diffie-Hellman problem. The proposed scheme is proved secure against adaptive chosen message and adaptive chosen-ID attack in random oracle model under the computational Diffie-Hellman assumption. Moreover, we do an efficiency comparison with the existing identity-based multi-proxy signature schemes and show that our scheme is upto 56 % more efficient in computation than the existing schemes.KeywordsIdentity-based cryptographyDigital signatureBilinear mapMulti-proxy signatureProvably secureCDHP

Broadcast encryption is a primary technology that has been used for content protection. It enables a broadcaster to distribute content to a set of users so that only a privileged subset of users can access the content and another subset of revoked users cannot access the content. The main enabling block in a broadcast encryption scheme is the session key block, which each authorized user processes differently, but each gets the same valid session key. Currently all existing broadcast encryption schemes have assumed that the content and authorized users are equally privileged. There are emerging scenarios that demand protection for content with different privileges and for users with different privileges. In this paper we shall present a new broadcast encryption scheme that continues to employ single session key blocks but provides different privileged protections for different content and users. In particular we will expand the elegant subset-cover-based broadcast encryption scheme. We shall introduce a new concept called “security class” into the session key blocks. We use keys derived from a chain of one-way functions. Our approach is simple, efficient and secure.

Broadcast encryption is a novel concept for sending a special message to a subset of users. In broadcast encryption schemes, the distribution center broadcasts the message in encrypted form and expect that only the intended users be able to decrypt the message. This concept has several applications such as pay-per-service TVs. In this paper, we investigate one of the most recent broadcast encryption schemes and show that the introduced scheme does not provide the main requirement of broadcast encryption schemes. For this purpose, we demonstrate that all of the users, including authorized and unauthorized users, can decrypt the broadcasted encrypted message.

In Eurocrypt'2005, Waters' identity-based encryption scheme suffers a drawback that the scheme only guarantees chosen plaintext security but chosen ciphertext security, and to give concurrent consideration both the efficiency and intract-ability problem in the broadcast encryption, a new identity-based broadcast encryption of chosen ciphertext secure is proposed. The new scheme was regarded as the extended version of Waters' scheme and is based on the standard model. By adding an additional information in ciphertext, the adaptive selective-ID security and the chosen ciphertext security are gained simultaneously in the scheme. The scheme's security is reduced to the decisional bilinear Diffie-Hellman intractability assumption, so the security level is improved and it is suitable for high security environment.

We propose a new and efficient scheme for broadcast encryption. A broadcast encryption system allows a broadcaster to send an encrypted message to a dynamically chosen subset RS, |RS|=n, of a given set of users, such that only users in this subset can decrypt the message. An important component of broadcast encryption schemes is revocation of users by the broadcaster, thereby updating the subset RS. Revocation may be either temporary, for a specific cipher text, or permanent. In the existing public key schemes which support temporary revocation of the users, the broadcaster is required to keep track of the revoked users. We present the first public key broadcast encryption scheme that supports permanent revocation of users. Unlike previous schemes, the broadcaster in our scheme should not keep track of the revoked users (saving memory and computation power). Our scheme is fully collusion-resistant. In other words, even if all the revoked users collude, the revoked user cannot encrypt messages without receiving new keys from the broadcaster. The procedure is based on Cipher-text Policy Attribute-Based Encryption (CP-ABE). The overhead of revocation in our system is constant in all major performance measures including length of private and public keys, computational complexity, user's storage space, and computational complexity of encryption and decryption. The scheme we construct improves on our original scheme in a poster presentation [7] by a factor of O(log n) in all major performance measures.

We present generic frameworks for constructing efficient broadcast encryption schemes in the subset-cover paradigm, introduced by Naor et.al., based on various key derivation techniques. Our frameworks characterize any instantiation completely to its underlying graph decompositions, which are purely combinatorial in nature. This abstracts away the security of each instantiated scheme to be guaranteed by the generic one of the frameworks; thus, gives flexibilities in designing schemes. Behind these are new techniques based on (trapdoor) RSA accumulators utilized to obtain practical performances. We then give some efficient instantiations from the frameworks. Our first construction improves the currently best schemes, including the one proposed by Goodrich et.al., without any further assumptions (only pseudo-random generators are used) by some factors. The second instantiation, which is the most efficient, is instantiated based on RSA and directly improves the first scheme. Its ciphertext length is of order O(r), the key size is O(1), and its computational cost is O(n1/klog2n) for any (arbitrary large) constant k; where r and n are the number of revoked users and all users respectively. To the best of our knowledge, this is the first explicit collusion-secure scheme in the literature that achieves both ciphertext size and key size independent of n simultaneously while keeping all other costs efficient, in particular, sub-linear in n. The third scheme improves Gentry and Ramzan’s scheme, which itself is more efficient than the above schemes in the aspect of asymptotic computational cost.

Data stored in cloud storage sometimes requires long-term security due to its sensitivity (e.g., genome data), and therefore, it also requires flexible access control for handling entities who can use the data. Broadcast encryption can partially provide such flexibility by specifying privileged receivers so that only they can decrypt a ciphertext. However, once privileged receivers are specified, they can be no longer dynamically added and/or removed. In this paper, we propose a new type of broadcast encryption which provides long-term security and appropriate access control, which we call unconditionally secure revocable-storage broadcast encryption (RS-BE). In RS-BE, privileged receivers of a ciphertext can be dynamically updated without revealing any information on the underlying plaintext. Specifically, we define a model and security of RS-BE, and derive tight lower bounds on sizes of secret keys required for a one-time secure RS-BE scheme when the ciphertext size is equal to the plaintext size. Our lower bounds can be applied to traditional broadcast encryption. We then construct a one-time secure RS-BE scheme with a trade-off between sizes of ciphertexts and secret keys, and our construction for the smallest ciphertext size meets all bounds with equalities. Furthermore, to detect an improper update, we consider security against modification attacks to a ciphertext, and present a concrete construction secure against this type of attacks.