Efficient KDM-CCA Secure Public-Key Encryption for Polynomial Functions

In PKC 2014, Dachman-Soled showed a construction of a chosen ciphertext CCA secure public key encryption PKE scheme based on a PKE scheme which simultaneously satisfies a security property called weak and standard model plaintext awareness sPA1 in the presence of multiple public keys. It is not well-known if plaintext awareness for the multiple keys setting is equivalent to the more familiar notion of that in the single key setting, and it is typically considered that plaintext awareness is a strong security assumption because to achieve it we have to rely on a knowledge-type assumption. In Dachman-Soled's construction, the underlying PKE scheme needs to be plaintext aware in the presence of $$2k+2$$2k+2 public keys. The main result in this work is to show that the strength of plaintext awareness required in the Dachman-Soled construction can be somehow traded with the strength of a property of other building blocks. Furthermore, we also show that we can separate the assumption that a single PKE scheme needs to be both weakly simulatable and plaintext aware in her construction. Specifically, in this paper we show two new constructions of CCA secure key encapsulation mechanisms KEMs: Our first scheme is based on a KEM which is chosen plaintext CPA secure and plaintext aware only under the 2 keys setting, and a PKE scheme satisfying a slightly stronger than weak simulatability, called simulatability introduced by Choi et al. ASIACRYPT 2009. Our second scheme is based on a KEM which is 1-bounded CCA secure Cramer et al. ASIACRYPT 2007 and plaintext aware only in the single key setting, and a trapdoor simulatable PKE scheme. Our results add new recipes for constructing CCA secure PKE/KEM from general assumptions that are incomparable to those used by Dachman-Soled, and in particular show interesting trade-offs among building blocks with those used in Dachman-Soled's construction.

In homomorphic encryption schemes, anyone can perform homomorphic operations, and therefore, it is difficult to manage when, where and by whom they are performed. In addition, the property that anyone can ‘‘freely” perform the operation inevitably means that ciphertexts are malleable, and it is well-known that adaptive chosen ciphertext (CCA) security and the homomorphic property can never be achieved simultaneously. In this paper, we show that CCA security and the homomorphic property can be simultaneously handled in situations that the user(s) who can perform homomorphic operations on encrypted data should be controlled/limited, and propose a new concept of homomorphic public-key encryption, which we call keyed-homomorphic public-key encryption (KH-PKE). By introducing a secret key for homomorphic operations, we can control who is allowed to perform the homomorphic operation. To construct KH-PKE schemes, we introduce a new concept, a homomorphic transitional universal hash family, and present a number of KH-PKE schemes through hash proof systems. We also present a practical construction of KH-PKE from the DDH assumption. For ℓ-bit security, our DDH-based scheme yields only ℓ-bit longer ciphertext size than that of the Cramer-Shoup PKE scheme.Keywordshomomorphic public key encryptionCCA2 securityhash proof system

From the birth of the blockchain technology, multisignatures attract much attention as a tool for handling blockchain transactions. Concerning the application to the blockchain, multisignatures with public-key aggregation, which can compress public keys of signers to a single public key, is preferable to the standard multisignature because the public keys and the signature used in a transaction are stored to verify the transaction later. Several multisignature schemes with public key aggregation are proposed, however, there are no known schemes having a tight security reduction.We propose a first multisignature with public-key aggregation whose security is proven to be tightly secure under the DDH assumption in the random oracle model. Our multisignature is based on the DDH-based multisignature by Le, Yang, and Ghorbani, however, our security proof is different from theirs. The idea of our security proof originates from another DDH-based multisignature by Le, Bonnecaze, and Gabillon whose security proof is tightly one. By tailoring their security proof to a setting which admits the public-key aggregation, we can prove the tight security of our multisignature.

From the birth of the blockchain technology, multisignatures attract much attention as a tool for handling blockchain transactions. Concerning the application to the blockchain, multisignatures with public-key aggregation, which can compress public keys of signers to a single public key, is preferable to the standard multisignature because the public keys and the signature used in a transaction are stored to verify the transaction later. Several multisignature schemes with public key aggregation are proposed, however, there are no known schemes having a tight security reduction. We propose a first multisignature with public-key aggregation whose security is proven to be tightly secure under the DDH assumption in the random oracle model. Our multisignature is based on the DDH-based multisignature by Le, Yang, and Ghorbani, however, our security proof is different from theirs. The idea of our security proof originates from another DDH-based multisignature by Le, Bonnecaze, and Gabillon whose security proof is tightly one. By tailoring their security proof to a setting which admits the public-key aggregation, we can prove the tight security of our multisignature.

We provide a framework enabling the construction of IBE schemes that are secure under related-key attacks (RKAs). Specific instantiations of the framework yield RKA-secure IBE schemes for sets of related key derivation functions that are non-linear, thus overcoming a current barrier in RKA security. In particular, we obtain IBE schemes that are RKA secure for sets consisting of all affine functions and all polynomial functions of bounded degree. Based on this we obtain the first constructions of RKA-secure schemes for the same sets for the following primitives: CCA-secure public-key encryption, CCA-secure symmetric encryption and Signatures. All our results are in the standard model and hold under reasonable hardness assumptions.

Recently Cash, Kiltz, and Shoup [13] showed a variant of the Cramer-Shoup (CS) scheme [14] whose chosen-ciphertext (CCA) security relies on the computational Diffie-Hellman (CDH) assumption. The cost for this high security is that the size of ciphertexts is much longer than the CS scheme (which is based on the decisional Diffie-Hellman assumption). In this paper, we show how to achieve CCA-security under the CDH assumption without increasing the size of ciphertexts. We also show a more efficient scheme under the hashed Diffie-Hellman assumption. Both of our schemes are based on a certain broadcast encryption (BE) scheme while the Cash-Kiltz-Shoup scheme is based on the Twin DH problem. Of independent interest, we also show a generic method of constructing CCA-secure PKE schemes from BE schemes.

In this paper we show that RSA-OAEP is secure against related key attacks (RKA) in the random oracle model under the strong RSA (sRSA) assumption. The key related functions can be affine functions. Compared to the chosen ciphertext security proof of OAEP, we overcome two major obstacles: answering the decryption queries under related keys; and preventing the adversary from promoting queries that are corresponding to the same message with the challenge ciphertext. These two obstacles also exist in the RKA security proof of RSA-OAEP+ and RSA-SAEP\(^+\). By combining our technique and the chosen ciphertext security proofs, RSA-OAEP+ and RSA-SAEP\(^+\) can also be proved RKA secure. In our proof, the security of the scheme relies substantially on the algebraic property of the sRSA function.KeywordsRelated key attackRSA-OAEPStrong RSA assumptionRSA assumption

We construct secret-key encryption SKE schemes that are secure against related-key attacks and in the presence of key-dependent messages RKA-KDM secure. We emphasize that RKA-KDM security is not merely the conjunction of individual security properties, but covers attacks in which ciphertexts of key-dependent messages under related keys are available. Besides being interesting in their own right, RKA-KDM secure schemes allow to garble circuits with XORs very efficiently Applebaum, TCC 2013. Until now, the only known RKA-KDM secure SKE scheme due to Applebaum is based on the LPN assumption. Our schemes are based on various other computational assumptions, namely DDH, LWE, QR, and DCR. We abstract from Applebaum's construction and proof, and formalize three generic technical properties that imply RKA-KDM security: one property is IND-CPA security, and the other two are the existence of suitable oracles that produce ciphertexts under related keys, resp.i¾?of key-dependent messages. We then give simple SKE schemes that achieve these properties. Our constructions are variants of known KDM-secure public-key encryption schemes. To additionally achieve RKA security, we isolate suitable homomorphic properties of the underlying schemes in order to simulate ciphertexts under related keys in the security proof. RKA-KDM security for our schemes holds w.r.t. affine functions over the respective mathematical domain. From a conceptual point of view, our work provides a generic and extensible way to construct encryption schemes with multiple special security properties.

In AsiaCrypt 2013, Qin and Liu proposed a new approach to CCA-security of Public-Key Encryption (PKE) in the presence of bounded key-leakage, from any universal hash proof system (due to Cramer and Shoup) and any one-time lossy filter (a simplified version of lossy algebraic filters, due to Hofheinz). They presented two instantiations under the DDH and DCR assumptions, which result in leakage rate (defined as the ratio of leakage amount to the secret-key length) of 1/2 − o(1). In this paper, we extend their work to broader assumptions and to flexible leakage rate, more specifically to leakage rate of 1 − o(1).

Lossy trapdoor functions (LTDF) and all-but-one trapdoor functions (ABO-TDF) are fundamental cryptographic primitives. And given the recent advances in quantum computing, it would be much desirable to develop new and improved lattice-based LTDF and ABO-TDF. In this work, we provide more compact constructions of LTDF and ABO-TDF based on the learning with errors (LWE) problem. In addition, our LWE-based ABO-TDF can allow smaller system parameters to support super-polynomially many injective branches in the construction of CCA secure public key encryption. As a core building tool, we provide a more compact homomorphic symmetric encryption schemes based on LWE, which might be of independent interest. To further optimize the ABO-TDF construction, we employ the full rank difference encoding technique. As a consequence, the results presented in this work can substantially improve the performance of all the previous LWE-based cryptographic constructions based upon LTDF and ABO-TDF.

Non-malleability is an important and intensively studied security notion for many cryptographic primitives. In the context of public key encryption, this notion means it is infeasible for an adversary to transform an encryption of some message m into one of a related message m' under the given public key. Although it has provided a strong security property for many applications, it still does not suffice for some scenarios like the system where the users could issue keys on-the-fly. In such settings, the adversary may have the power to transform the given public key and the ciphertext. To withstand such attacks, Fischlin introduced a stronger notion, known as complete non-malleability, which requires that the non-malleability property be preserved even for the adversaries attempting to produce a ciphertext of some related message under the transformed public key. To date, many schemes satisfying this stronger security have been proposed, but they are either inefficient or proved secure in the random oracle model. In this work, we put forward a new encryption scheme in the common reference string model. Based on the standard DBDH assumption, the proposed scheme is proved completely non-malleable secure against adaptive chosen ciphertext attacks in the standard model. In our scheme, the well-formed public keys and ciphertexts could be publicly recognized without drawing support from unwieldy techniques like non-interactive zero knowledge proofs or one-time signatures, thus achieving a better performance.

We introduce the notion of complementary-witness-soundness for a witness indistinguishable proof system. We then present a new general framework for public key encryption schemes, denoted as CWSWI-type encryption, based on a complementary-witness-sound witness indistinguishable (CWSWI) proof system. The construction of a CWSWI-type encryption scheme is relatively straight forward, while the security thereof against adaptive chosen cipher text attack (denoted CCA2) can be rigorously proven. Many existing CCA2 public key encryption schemes can be interpreted as being of CWSWI-type, including the schemes of Lindell, Cramer-Shoup and Peikert-Waters. Thus, our CWSWI approach provides a novel means for designing and analyzing CCA2 secure public key encryption schemes.

The information-centric Internet of things (IC-IoT) is different from the traditional Internet of things (IoT) in that the device-to-device pattern is generalized to a device-to-network pattern. Furthermore, in an IC-IoT environment, there is a demand for protecting the security of all data generated from IC-IoT devices. A cryptography scheme named attribute-based encryption (ABE) represents a smart method of providing the fine-grained access control that can sufficiently protect data security. The most attractive advantage of ABE is its expressive access policy, which makes the access control of data flexible and manageable. However, there is a serious problem caused by such an access policy; it incurs a greater ciphertext redundancy and computational overhead. This implies that the current ABE scheme is hard to implement in the thin client devices of IC-IoT. In this paper, we propose a universalized policy-compacting method via sharing public parts of the policy. Compared with the original policy, the compacted policy applies a more compact ciphertext and requires less computation, communication, and storage cost. However, the policy-compacting problem is proved to be a non-deterministic polynomial complete (NPC) problem. Thus, a greedy algorithm is provided to obtain an approximate minimum compacted policy scale. Finally, we propose a compact ciphertext-policy attribute-based encryption (CCP-ABE) scheme with the policy-compacting method. A security proof and performance evaluation show that the proposed CCP-ABE scheme provides a comprehensive performance improvement.

HC-256 proposed by Wu Hongjun at FSE 2004 is a software-efficient stream cipher algorithm based on table-driven, which is proposed as a final candidate to the eSTREAM project. In this paper, we modified the original version of HC-256 by removing the constant in the key expansion function, which we denoted HC-256*. Then we make a related-key security analysis on HC-256* and receive a conclusion that HC-256* is provable security under the related-key attack.

While differential behavior of modern ciphers in a single secret key scenario is relatively well understood, and simple techniques for computation of security lower bounds are readily available, the security of modern block ciphers against related-key attacks is still very ad hoc. In this paper we make a first step towards provable security of block ciphers against related-key attacks by presenting an efficient search tool for finding differential characteristics both in the state and in the key (note that due to similarities between block ciphers and hash functions such tool will be useful in analysis of hash functions as well). We use this tool to search for the best possible (in terms of the number of rounds) related-key differential characteristics in AES, byte-Camellia, Khazad, FOX, and Anubis. We show the best related-key differential characteristics for 5, 11, and 14 rounds of AES-128, AES-192, and AES-256 respectively. We use the optimal differential characteristics to design the best related-key and chosen key attacks on AES-128 (7 out of 10 rounds), AES-192 (full 12 rounds), byte-Camellia (full 18 rounds) and Khazad (7 and 8 out of 8 rounds). We also show that ciphers FOX and Anubis have no related-key attacks on more than 4-5 rounds.KeywordsCryptanalysis toolsearch for best differential characteristicsrelated-key attackopen keyAESCamelliaKhazadAnubisFOX