Multi-Client Attribute-Based Unbounded Inner Product Functional Encryption, and More

Pairing-based cryptography (PBC), a variant of elliptic curve cryptography (ECC), uses bilinear maps between elliptic curves and finite fields to enable several novel applications beyond traditional key exchange and signatures [1]. Fig. 1 shows two such applications - (a) signature aggregation, where arbitrarily large number of signatures are aggregated into one to resolve communication bottleneck in mesh networks such as blockchain [9], and (b) functional encryption, which allows computation on encrypted data with a function embedded in the decryption key [7]. In particular, pairing-based function-hiding inner product functional encryption [10] can be used for privacy-preserving data classification, thus enabling a new paradigm in the field of secure computation.

Practical reusable garbled circuits with parallel updates

Access control schemes in predicate encryption can effectively reduce the risk of information leakage in the inner product function encryption (IPFE). However, when we try to transition from identity-based IPFE to attribute-based IPFE, the fine-grained nature of attributes induces some unprecedented access control problems. These problems not only lead to incorrect inner product computation results from attribute-based IPFE but also inevitable passive information leakage induced by large attribute set secret key. At the same time, since the above problems are not common in identity-based IPFE and traditional ABEs, they cannot be properly addressed by existing schemes. To address the above problems, we introduce a new scheme - Ciphertext Policy Based Inner Product Function Encryption (CP-IPFE). In this scheme, we propose to use a "label vector" to label the attributes of n-dimensional vectors and encode them onto the relevant information, so as to ensure that the attribute-based IPFE will not output incorrect inner-product computation results; establishing a leaf node set-based "reverse access control policy" to realize reverse access control on "risky ciphertext", ensures that "risky ciphertext" will not be leaked encrypted-information by the secret key of large attribute sets. In addition, CP-IPFE also has the characteristics of traditional attribute encryption and supports more fine-grained access control. Finally, we prove the CPA security of the CP-IPFE in the GGM model and show a detailed application of the CP-IPFE on a general-purpose platform.

Function-Hiding Zero Predicate Inner Product Functional Encryption from Pairings

Post-Quantum Secure Inner Product Functional Encryption Using Multivariate Public Key Cryptography

Lightweight devices, such as a smartcard associated with a top‐box decoder in pay‐TV or a SIM card coupled with a powerful (but not totally trusted) smartphone, play an important role in modern applications. The essential requirements for a cryptographic scheme to be truly implemented in lightweight devices are that it should have compact secret key size and support fast decryption. Attribute‐based broadcast encryption (ABBE) combines the functionalities of both broadcast encryption and attribute‐based encryption in an efficient way, ABBE is therefore a promising cryptographic scheme to be used in practical applications such as mobile pay‐TV, satellite transmission, or Internet of Things. Designing an ABBE scheme which can be truly implemented in lightweight devices is still an open question. In this study, the authors solve it by proposing an efficient constant‐size private key ciphertext‐policy ABBE scheme for disjunctive normal form supporting fast decryption and achieving standard security levels of an ABBE scheme. They concretely show that the authors’ scheme can be truly implemented in a prototype for a smartphone‐based cloud storage use case. In particular, they show how to alleviate some parts of their scheme so as to obtain a very practical system, and they give some concrete benchmarks.

Functional encryption (FE) which covers the notion of attribute-based encryption (ABE), is the cryptographic tool to realize fine-grained control on the accessibility of encrypted data. The traditional FE requires a central trusted authority to issue secret keys. It depends on the full-trust model, and is vulnerable to the security issue caused by key-escrow. While the registered FE (Reg-FE) achieves the zero-trust model and addresses the security issue by removing the use of central authority. It allows users to generate secret keys themselves and join the system by registering corresponding public keys to a curator. This work introduces delegated Reg-FE, which is a primitive with a new registration paradigm. It allows the registration of certain authorities that can issue secret keys for their respective classical FE sub-systems, beyond the prior work of registering plain users. Delegated Reg-FE implements a hybrid trust model within a two-level hierarchy. By redefining key escrow as a functional mechanism rather than a security concern, this model employs a zero-trust upper level which removes key-escrow, while the subsystem of each authority is locally full-trust and retains key-escrow mechanism. We construct four delegated Reg-FE schemes for functionalities that can be described as the $$2\times 2$$ combinations of linear function and policy check. Namely, Delegated Reg-IPFE, Delegated Reg-ABE, Reg-IPFE with delegated ABE, and Reg-ABE with delegated IPFE. All concrete schemes support bounded registrations and delegations, and achieve standard adaptive security under $$\textsc {MDDH}$$ assumption on prime-order bilinear group. Furthermore, these schemes only rely on black-box techniques. Technically, these schemes relies on dual-system techniques as prior registration-based works. And we devise a new “hierarchically invoked dual-system” technique on schemes which have sub-ABE delegation systems. Furthermore, we present a generic construction of Delegated Reg-FE from the combination of Reg-FE and FE. The instantiations of this generic construction demonstrate the feasibility of delegated Reg-FE, supporting arbitrary functions as well as unbounded numbers of registrations and delegations. However, this approach requires non-black-box techniques and achieves weaker semi-adaptive security without malicious registration, where the semi-adaptive means the adversary claims the challenge after seeing common reference string but before making any query. Its security relies solely on the underlying assumptions of the Reg-FE and FE components.

In a traditional public key encryption system, data is encrypted to a particular individual who is fixed by a public key, and the revealed information is all-or-nothing. Functional encryption (FE) gives a new way of sharing encrypted data, with fine-grained control over revealed information on encrypted data. In FE, a secret key enables a user to learn a specific function of the encrypted data and nothing else. Attribute-based encryption (ABE) can specify a wide variety of receiver sets by using relation between key and cipher text parameters. This survey for a wide audience will first give the notions of FE, ABE (and attribute-based signatures (ABS)), and describe several practical applications of FE schemes on dual pairing vector spaces (DPVS). The cryptosystems are implemented by using a pairing operation on an elliptic curve, which has achieved many new applications including FE in recent years. We also give a brief summary of the mathematical mechanism, e.g., The algorithm, parameter selection, and underlying security.

In addition to proof or argument based verifiable computing schemes and constructions that rely on homomorphic encryption or homomorphic authenticators, verifiable computing schemes can also be constructed using functional encryption or functional signatures. Thus, in this chapter we present the verifiable computing schemes using one of these primitives. Functional encryption refers to encryption schemes where ciphertexts can be decrypted only if they fulfill certain requirements. There are basically two approaches that use functional encryption to build a verifiable computing scheme. “Verifiable Computation from Attribute Based Encryption” by Parno et al. uses (key-policy) attribute-based encryption, a specific instantiation of functional encryption, while the approach presented in “Delegatable Homomorphic Encryption with Applications to Secure Outsourcing of Computation” by Barbosa and Farshim is constructed directly from functional encryption schemes. Functional signatures come with a secondary parameterized signing key, in addition to the master signing key, that allows to sign messages, but restricts the signing capabilities to messages in a certain range. This property allows to build verifiable computing schemes as shown by Boyle et al. in “Functional Signatures and Pseudorandom Functions”.

Attribute-based encryption (ABE) is a special type of cryptosystem, which provide encryption and decryption functions based on users attributes. Due to the functionality and flexibility of ABE, it is considered to be suitable for providing data security and privacy preserving security in the cloud storage environment. However, lack of user revocation mechanism is considered to be a disadvantage of traditional ABE. In this paper, we study the direct revocation mechanism of ciphertext-policy ABE (CP-ABE), construct a new directly revocable CP-ABE in the composite order group, and prove it to achieve adaptive security using dual system encryption in the standard model. On this basis, we introduce user revocation centre (URC) in this system, and outsource the revocation tasks to URC. Users need not to master the latest revocation list for encrypting, and need not to pay any additional computing for revocation. In addition, when revocation list changes, URC can update the ciphertexts for users. Finally, we introduce how to deploy our schemes in cloud storage environment.

This paper presents an attribute-based encryption (ABE) construction for monotone span programs achieving the shortest known ciphertext size under well-studied static complexity assumptions. Our ABE construction is built in composite order bilinear group setting and involves only 2 group elements in the ciphertexts. For proving selective security of the proposed ABE scheme under the Subgroup Decision assumptions, the most standard static assumptions in composite order bilinear group setting, we apply the extended version of the elegant Deja Q framework, which was originally proposed as a general technique for reducing the q-type complexity assumptions to their static counter parts. Our work thus demonstrates the power of this framework in overcoming the need of q-type assumptions, which are vulnerable to serious practical attacks, for deriving security of highly expressive ABE systems with compact parameters. We further introduce the concept of online-offline multi-input functional encryption (OO-MIFE), which is a crucial advancement towards realizing this highly promising but computationally intensive cryptographic primitive in resource bounded and power constrained devices. We also instantiate our notion of OO-MIFE by constructing such a scheme for the multi-input analog of the inner product functionality, which has a wide range of application in practice. Our OO-MIFE scheme for multi-input inner products is built in asymmetric bilinear groups of prime order and is proven selectively secure under the well-studied k -Linear assumption.

Predicate encryption (PE), a generalization of attribute-based encryption (ABE), is a versatile tool for providing access control over data. The underlying predicate for a PE is parametrized by an index, called system parameter or simply system-index. A system-index, in general, consists of component(s) from . Yamada et al. in PKC 2011 proposed a verifiability-based conversion from CPA to CCA-secure ABE. This conversion was generalized by Yamada et al. in PKC 2012 from ABE to PE. In the later conversion, the authors considered the system-index to be a single component. In practice, there are many schemes, e.g., functional encryption for general relations and hierarchical-inner product (HIP) encryption schemes of Okamoto-Takashima in CRYPTO 2010, CANS 2011 and EUROCRYPT 2012, where system-indices consist of more than a single component. Therefore, for these schemes, the conversion of Yamada et al. (in PKC, 2012) is out of scope. In this paper, we revisit the CPA to CCA conversion for PE and propose a new conversion based on verifiability. The proposed conversion works irrespective of the number of components in the system-indices. It generalizes the existing conversion of Yamada et al. (in PKC, 2011) from ABE to PE. The PE schemes which are realized by the conversion of Yamada et al. (2011) are also realized by our conversion. Therefore, the conversion of ours has more scope than the conversion proposed in 2012. We show that all the aforementioned CPA-secure schemes for general relations and HIP relation are easily converted to the corresponding CCA-secure schemes by our conversion. Further, we show a generic conversion from CPA to CCA-secure functional encryption for regular languages which captures the existing PE schemes for regular languages.

In recent years, a new, generalized notion of public-key primitive called Functional Encryption (FE) has emerged. In the FE setting, public keys and their matching secret keys can be associated with identities, attributes, policies, predicates and so on. FE covers a large number of primitives, notably, Identity-Based Encryption (IBE), Inner Product Encryption (IPE), Spatial Encryption (SE), Attribute-Based Encryption (ABE) and has numerous applications, particularly in the domains of access control, content distribution, mail filtering, data searching, broadcasting, tracing, and biometrics. Many works on FE in the literature have been targeting on improving the efficiency of constructions, simplifying the relevant assumptions, and achieving stronger security (e.g. full security and adaptively attribute-hiding).

To allow fine-grained access control of sensitive data, researchers have proposed various types of functional encryption schemes, such as identity-based encryption, searchable encryption and attribute-based encryption. We observe that it is difficult to define some complex access policies in certain application scenarios by using these schemes individually. In this paper, we attempt to address this problem by proposing a functional encryption approach named Key-Policy Attribute-Based Encryption with Attribute Extension (KP-ABE-AE). In this approach, we utilize extended attributes to integrate various encryption schemes that support different access policies under a common top-level KP-ABE scheme, thus expanding the scope of access policies that can be defined. Theoretical analysis and experimental studies are conducted to demonstrate the applicability of the proposed KP-ABE-AE. We also present an optimization for a special application of KP-ABE-AE where IPE schemes are integrated with a KP-ABE scheme. The optimization results in an integrated scheme with better efficiency when compared to the existing encryption schemes that support the same scope of access policies.

Recent advances in cryptographic approaches, such as Functional Encryption and Attribute-based Encryption and their variants, have shown significant promise for enabling public clouds to provide secure computation and storage services for users’ sensitive data. A crucial component of these approaches is a third-party authority (TPA) that must be trusted to set up public parameters, provide private key service, and so on. Components of deployed cryptographic mechanisms such as the certificate authorities (CAs) , which are the TPAs of the underlying PKI for the SSL/TLS protocol, have faced several types of attacks (e.g., stealthy targeted and censorship attacks), and certificate mis-issuance problems. Such practical challenges indicate that the successful deployment of newer emerging cryptographic schemes will also significantly depend on the trustworthiness of the TPAs. Furthermore, recently proposed decentralized TPA approaches that lower the threshold on the conditions required for an entity to become an authority can make the trust issue much worse. To address this issue, we propose an authority transparency framework to ensure the trustworthiness of TPAs of recent and emerging advanced cryptographic schemes. The framework includes a formal model and a secure logging -based approach to implement the framework. Further, to address the issues related to privacy, we also present a privacy-preserving authority transparency approach. We present security analysis and performance evaluation to show that authority transparency achieves the security and performance goals.