Fully secure wicked identity-based encryption resilient to continual auxiliary- inputs leakage

Hierarchical Identity Based Encryption (HIBE) is a well studied, versatile tool used in many cryptographic protocols. Yet, since the performance of all known HIBE constructions is broadly considered prohibitive, some real-world applications avoid relying on HIBE at the expense of security. A prominent example for this is secure messaging: Strongly secure messaging protocols are provably equivalent to Key-Updatable Key Encapsulation Mechanisms (KU-KEMs; Balli et al., Asiacrypt 2020); so far, all KU-KEM constructions rely on adaptive unbounded-depth HIBE (Poettering and Rösler, Jaeger and Stepanovs, both CRYPTO 2018). By weakening security requirements for better efficiency, many messaging protocols dispense with using HIBE. In this work, we aim to gain better efficiency without sacrificing security. For this, we observe that applications like messaging only need a restricted variant of HIBE for strong security. This variant, that we call Unique-Path Identity Based Encryption (UPIBE), restricts HIBE by requiring that each secret key can delegate at most one subordinate secret key. However, in contrast to fixed secret key delegation in Forward-Secure Public Key Encryption, the delegation in UPIBE, as in HIBE, is uniquely determined by variable identity strings from an exponentially large space. We investigate this mild but surprisingly effective restriction and show that it offers substantial complexity and performance advantages. More concretely, we generically build bounded-depth UPIBE from only bounded-collusion IBE in the standard model; and we generically build adaptive unbounded-depth UPIBE from only selective bounded-depth HIBE in the random oracle model. These results significantly extend the range of underlying assumptions and efficient instantiations. We conclude with a rigorous performance evaluation of our UPIBE design. Beyond solving challenging open problems by reducing complexity and improving efficiency of KU-KEM and strongly secure messaging protocols, we offer a new definitional perspective on the bounded-collusion setting.

We propose a leakage-resilient unbounded extensible set delegation encryption scheme, which tolerates amount of bounded key leakage and supports unbounded delegation depth. Our scheme provides the tolerance of key continual leakage that can capture both memory leakage and continual leakage, which has appealing applications since there are multiple secret keys per identity set and also can periodically update and refresh the secret key. We construct the scheme in composite order bilinear groups and prove the security with dual system encryption methodology.KeywordsLeakage-resilient encryptionstatistical indistinguishabilitysemantic securityunbounded delegation

In the problem of gradual key exposure, the secret key is assumed to be slowly compromised over time, so that more and more information about a secret key is eventually leaked. This models the general situation in the real world where memory, storage systems and devices cannot perfectly hide all information for long time. In this setting, in order to protect against exposure threats, the secret key is represented in an "exposure- resilient" form, which is periodically refreshed with the following guarantee: as long as the adversary does not learn "too much" information about the current representation of the secret between successive refreshes, the system should remain secure. To measure the efficiency of a given solution, one considers the "natural" secret key representation A, the "exposure- resilient" representation B, and examines the following three measures: (1) space loss which is the extra space required by B over A; (2) time loss which is the operation slowdown when B is used in place of A: and (3) exposure-resilience which is the fraction of B which can be "safely leaked". All the current solutions to the problem - including proactive secret sharing, all-or-nothing transforms and exposure-resilient functions - always suffered from non-trivial losses in both space and time in order to achieve varying levels of exposure-resilience. It was, therefore, informally believed that these losses are inevitable in even, reasonable application, since a "natural" representation A is unlikely to offer any exposure-resilience. We show this belief is false for the elegant "hierarchical identity-based encryption" (HIBE) of Gentry and Silverberg (2002), which is the only known fully junctional HIBE up to date. Specifically, we show that the natural secret key representation for the HIBE admits a simple and efficient refresh operation, which offers very high level of exposure-resilience, while incurring absolutely no space or time losses for decryption. We argue that this simple fact is quite powerful from a key storage security perspective, is highly applicable for such tasks as threshold decryption, and that it further makes HIBE a much more attractive alternative in various real life scenarios. On a philosophical level, while previous techniques protected against gradual key exposure in a generic way, oblivious to the application, we show that in certain situations one might achieve much better parameters by concentrating on the application at hand.

In this paper, we demonstrate that various cryptographic constructions--including ones for broadcast, attribute-based, and hierarchical identity-based encryption--can rely for security on only the static subgroup hiding assumption when instantiated in composite-order bilinear groups, as opposed to the dynamic q-type assumptions on which their security previously was based. This specific goal is accomplished by more generally extending the recent Deji Q framework Chase and Meiklejohn, Eurocrypt 2014 in two main directions. First, by teasing out common properties of existing reductions, we expand the q-type assumptions that can be covered by the framework; i.e., we demonstrate broader classes of assumptions that can be reduced to subgroup hiding. Second, while the original framework applied only to asymmetric composite-order bilinear groups, we provide a reduction to subgroup hiding that works in symmetric as well as asymmetric composite-order groups. As a bonus, our new reduction achieves a tightness of $$\log q$$ rather than q.

This paper presents an efficient transformation method that converts fully leakage resilient signature schemes which are weakly existentially unforgeable into ones which are strongly existentially unforgeable. To achieve our goal, we give a definition of leakage resilient chameleon hash function and present a construction based on the leakage resilient hard relation. Then we combine leakage resilient chameleon hash function with the technique presented by Steinfeld, Pieprzyk, and Wang to obtain a generic transformation that works well in the bounded leakage model.

Modern cryptographic schemes are constructed under the fundamental assumption that secret keys are perfectly hidden from all possible attackers. In practice, however, keys and internal states may partially be leaked. Recently, cryptographic construction with key-leakage resilience has been a crucial research topic. In this work, we proposed an anonymous hierarchical identity-based encryption that can tolerate partial leakage of secret keys. Our results were as follows. First, we provided a tolerance for continual key leakage that can capture both memory leakage and continual leakage. We extended a dual-system encryption mechanism in orthogonal subgroups to achieve key-leakage resilience and implicitly employed an update algorithm to guard against continual leakage. Second, the delegation depth is unbounded, which means that no predetermined depth was imposed in the setup algorithm, thus making the scheme very flexible in practice. We employed a secret-sharing approach to split the master key into multiple shares in key components corresponding to the elements. Third, we analyzed and discussed the performance of allowable leakage-tolerance bounds and the leakage rate of the proposed scheme and gave an evaluation that attains about 40-70% leakage rate under the Advanced Encryption Standard 112 security level. Copyright © 2013 John Wiley & Sons, Ltd.

Predicate encryption is an important cryptographic primitive (see [3,5,9,11]) that enables fine-grained control on the decryption keys. Roughly speaking, in a predicate encryption scheme the owner of the master secret key Msk can derive secret key SkP, for any predicate P from a specified class of predicates ℙ. In encrypting a message M, the sender can specify an attribute vector ${\ensuremath{\vec x}}$ and the resulting ciphertext $\tilde X$ can be decrypted only by using keys SkP such that $P({\ensuremath{\vec x}})=1$. Security is modeled by means of a game between a challenger $\mathcal{C}$ and a PPT adversary $\mathcal{A}$ that sees the public key, is allowed to ask for keys of predicates P of his choice and gives two challenge vectors${\ensuremath{\vec x}}_0$ and ${\ensuremath{\vec x}}_1$. $\mathcal{A}$ then receives a challenge ciphertext (an encryption of a randomly chosen challenge vector) and has to guess which of the two challenge vectors has been encrypted. The adversary $\mathcal{A}$ is allowed to ask queries even after seeing the challenge ciphertext. In the unrestricted queries model, it is required the adversary $\mathcal{A}$ to ask for keys of predicates P that do not discriminate the two challenge vectors; that is, for which $P({\ensuremath{\vec x}}_0)=P({\ensuremath{\vec x}}_1)$. It can be readily seen that this condition is necessary. In this paper, we consider hidden vector encryption (HVE in short), a notable case of predicate encryption introduced by Boneh and Waters [5] and further developed in [16,10,15]. In a HVE scheme, the ciphertext attributes are vectors ${\ensuremath{\vec x}}=\langle x_1,\ldots,x_\ell\rangle$ of length l over alphabet Σ, keys are associated with vectors ${\ensuremath{\vec y}}=\langle y_1,\ldots,y_\ell\rangle$ of length l over alphabet Σ∪{⋆} and we consider the ${\sf Match}({\ensuremath{\vec x}},{\ensuremath{\vec y}})$ predicate which is true if and only if, for all i, yi≠⋆ implies xi=yi. In [5], it is shown that HVE implies predicate encryption schemes for conjunctions, comparison, range queries and subset queries. We describe also constructions of secure predicate encryption for Boolean predicates that can be expressed as k-CNF and k-DNF (for any constant k) over binary variables. Our main contribution is a very simple, in terms of construction and security proof, implementation of the HVE primitive that can be proved fully secure against probabilistic polynomial-time adversaries in the unrestricted queries model under non-interactive constant sized (that is independent of l) hardness assumptions on bilinear groups of composite order. Our proof employs the dual system methodology of Waters [18], that gave one of the first fully secure construction in this area, blended with a careful design of intermediate security games that keep into account the relationship between challenge ciphertext and key queries.

Hierarchical identity-based encryption (HIBE) introduces the concept of hierarchical identity in identity-based encryption (IBE) which eases the burden of key generation centre. Anonymous identity-based encryption is another extension of IBE in which the ciphertext leaks no information about the target identity. In this paper, we propose a new anonymous hierarchical identity-based encryption system. Unlike previous anonymous HIBE system, our system needs no key delegation in decryption, i.e., the user can decrypt the ciphertext directly if his identity vector is the prefix of the target identity vector. So it is not necessary for the user to know the target identity vector, which enhances the practicality of anonymous HIBE systems. Our system is constructed in composite order groups and proven adaptive security and anonymity from four static assumptions by using the dual system encryption technique.

At EUROCRYPTi¾?2012 Pandey and Rouselakis introduced the notion of property preserving symmetric encryption which enables checking for a property on plaintexts by running a public test on the corresponding ciphertexts. Their primary contributions are: i a separation between 'find-then-guess' and 'left-or-right' security notions; ii a concrete construction for left-or-right secure orthogonality testing in composite order bilinear groups. This work undertakes a comprehensive cryptanalysis of property preserving symmetric encryption on both these fronts. We observe that the quadratic residue based property used in their separation result is a special case of testing equality of one-bit messages, suggest a very simple and efficient deterministic encryption scheme for testing equality and show that the two security notions, find-then-guess and left-or-right, are tightly equivalent in this setting. On the other hand, the separation result easily generalizes for the equality property. So contextualized, we posit that the question of separation between security notions is property specific and subtler than what the authors envisaged; mandating further critical investigation. Next, we show that given a find-then-guess secure orthogonality preserving encryption of vectors of length 2n, there exists left-or-right secure orthogonality preserving encryption of vectors of length n, giving further evidence that find-then-guess is indeed a meaningful notion of security for property preserving encryption. Finally, we cryptanalyze the scheme for testing orthogonality. A simple distinguishing attack establishes that it is not even the weakest selective find-then-guess secure. Our main attack extracts out the subgroup elements used to mask the message vector and indicates greater vulnerabilities in the construction beyond indistinguishability. Overall, our work underlines the importance of cryptanalysis in provable security.

Security models for two-party authenticated key exchange (AKE) protocols have developed over time to provide security even when the adversary learns certain secret keys. In this work, we advance the modelling of AKE protocols by considering more granular, continuous leakage of long-term secrets of protocol participants: the adversary can adaptively request arbitrary leakage of long-term secrets even after the test session is activated, with limits on the amount of leakage per query but no bounds on the total leakage. We present a security model supporting continuous leakage even when the adversary learns certain ephemeral secrets or session keys, and give a generic construction of a two-pass leakage-resilient key exchange protocol that is secure in the model; our protocol achieves continuous, after-the-fact leakage resilience with not much more cost than a previous protocol with only bounded, non-after-the-fact leakage.

Password-based authenticated key exchange are protocols that are designed to provide strong authentication for client-server applications, such as online banking, even when the users’ secret keys are considered weak (e.g., a four-digit pin). In this paper, we address this problem in the three-party setting, in which the parties trying to authenticate each other and to establish a session key only share a password with a trusted server and not directly among themselves. This is the same setting used in the popular Kerberos network authentication system. More precisely, we introduce a new three-party password-based authenticated key exchange protocol. Our protocol is reasonably efficient and has a per-user computational cost that is comparable to that of the underlying two-party authenticated key exchange protocol. The proof of security is in the random oracle model and is based on new and apparently stronger variants of the decisional Diffie-Hellman problem which are of independent interest.

By obfuscation we mean any efficient semantic-preserving transformation of computer programs aimed at bringing a program into such a form, which impedes the understanding of its algorithm and data structures or prevents the extracting of some valuable information from the plaintext of a program. The main difficulty in designing an effective program obfuscator is to guarantee security, i.e. to prove that no algorithm can break software protection in reasonable time. All obfuscation techniques and tools developed so far rely on the informal concept of security and therefore can’t be regarded as provably secure. In this paper we (1) introduce for the first time a formal information-theoretic definition of obfuscation security, (2) present a new obfuscation technique which takes advantage of cryptographic primitives (one-way functions, hard-core predicates), and (3) demonstrate, taking a conventional password identification scheme as a case study, how to prove security of the obfuscating transformations.

The post-quantum security of cryptographic schemes assumes that the quantum adversary only receives the classical result of computations with the secret key. Further, it is unknown whether the post-quantum secure schemes still remain secure if the adversary can obtain a superposition state of the results. In this paper, we formalize one class of public-key encryption schemes named oracle-masked schemes. Then we define the plaintext extraction procedure for those schemes and this procedure simulates the quantum-accessible decryption oracle with a certain loss. The construction of the plaintext extraction procedure does not need to take the secret key as input. Based on this property, we prove the IND-qCCA security of the Fujisaki-Okamoto (FO) transformation in the quantum random oracle model (QROM) and our security proof is tighter than the proof given by Zhandry (Crypto 2019). We also give the first IND-qCCA security proof of the REACT transformation in the QROM. Furthermore, our formalization can be applied to prove the IND-qCCA security of key encapsulation mechanisms with explicit rejection. As an example, we present the IND-qCCA security proof of $$\textsf {T}_{\textsf {CH}}$$ transformation, proposed by Huguenin-Dumittan and Vaudenay (Eurocrypt 2022), in the QROM.

Copyright protection is a major issue in distributing content on Internet or broadcasting service. One well-known method of protecting copyright is a traitor tracing scheme. With this scheme, if a pirate decoder is made, the content provider can check the secret key contained in it and trace the authorized user/subscriber (traitor). Furthermore, users require that they could obtain services anywhere they want (Anywhere TV). For this purpose, they would need to take along their secret keys and therefore key exposure has to be kept in mind. As one of countermeasures against key exposure, a forward secure public key cryptosystem has been developed. In this system, the user secret key remains valid for a limited period of time. It means that even if it is exposed, the user would be affected only for the limited time period. In this paper, we propose a traitor tracing scheme secure against adaptive key exposure (TTaKE) which contains the properties of both a traitor tracing scheme and a forward secure public key cryptosystem. It is constructed by using two polynomials with two variables to generate user secret keys. Its security proof is constructed from scratch. Moreover we confirmed its efficiency through comparisons. Finally, we show the way how its building blocks can be applied to anywhere TV service. Its structure fits current broadcasting systems.

In this paper, we attack Kyber’s key-generation algorithm using power analysis and lattice reduction. More specifically, we target the Centered Binomial Distribution (CBD) sampler which generates the secret data of the underlying Learning With Error (LWE) instance. From a side-channel perspective, our attack uses a single trace, leveraging classifiers developed through supervised learning. We enhance the classification with the AdaBoost strategy, which provides more reliable results and exploitable statistics, enabling the identification of error-free classified samples. In optimal scenarios, our classifiers, combined with the outputted statistics, allow us to recover up to 68% of the secret key’s coefficients from the trace, ensuring that these recovered coefficients are error-free. In such cases, we show that the secret keys can be recovered by Gaussian elimination over a finite field in a few seconds. For less advantageous cases, we assess the block-size in lattice reduction that would complete the key recovery, providing a fine-grained trade-offs between the correctly guessed proportion and the block-size, based on standard estimates. Finally, we conducted large-scale experiments, from power traces to secret key recovery (for most of the instances) under a threshold of 18 hours, targeting all three Kyber’s security levels. Our average rate of success across all security level is more than 96%.