New forward-secure public-key encryption without random oracles

One important property of group signatures is forward-security, which prevents an attacker in possession of a group signing key to forge signatures produced in the past. In case of exposure of one group member’s signing key, group signatures lacking forward-security need to invalidate all group public and secret keys (by re-initializing the whole system) but also invalidate all previously issued group signatures. Most of the existing forward-secure group signatures (FS-GS) are built from number-theoretic security assumptions which are vulnerable to quantum computers. The only post-quantum secure FS-GS scheme is built from lattices by Ling et al. (PQCrypto 19) in the random oracle model, following the classical framework of encrypt-then-prove, thus using non-interactive zero-knowledge (NIZK) proofs. In this work, we achieve the first FS-GS from lattices in the standard model. Our starting point is the group signature of Katsumada and Yamada (Eurocrypt 19) which replaces NIZK by attribute-based signatures (ABS), thus removing the need for random oracles. We first modify the underlying ABS of Tsabary (TCC 17) to equip it with forward-security property. We then prove that by plugging it back in the group signature framework of Katsumada and Yamada (Eurocrypt 19), we can design a FS-GS scheme secure in the standard model with public key and signature size constant in the number of users. Our constant size is achieved by relying on complexity leveraging, which further implies relying on the subexponential hardness of the Short Integers Solution (SIS) assumption.

Recently, the notion of the key-insulated public- key system has been suggested to protect the security of users' private keys. A general idea of this system is changing the user's private key along with the time, but the user's public key remains unchanged. In this paper, we propose a new identity (ID)-based key-insulated signature scheme from bilinear pairings. As compared with the recently proposed ID-based key-insulated signature schemes, our proposed scheme has better performance in the batch verifying phase. For security analysis, our scheme is a provably secure key-insulated signature scheme in the random oracle model and under the computational Diffie-Hellman assumption. Meanwhile, to demonstrate the additional advantage of a key-insulated signature, we present a novel application based on the proposed scheme, called full delegation ID-based proxy signature scheme with time restriction. To our best knowledge, no such a proxy signature scheme is proposed until now.

Code-based public key encryption (PKE) is a popular choice to achieve post-quantum security, partly due to its capability to achieve fast encryption/decryption. However, code-based PKE has larger ciphertext and public key sizes in comparison to conventional PKE schemes (e.g., those based on RSA). In 2018, Lau and Tan proposed a new rank metric code-based PKE scheme, which has smaller public key and ciphertext sizes compared to other code-based PKE schemes. They also proved that their scheme achieves IND-CPA security, assuming the intractability of the decisional rank syndrome decoding problem. It is known that IND-CCA2 security is the strongest and most popular security assurance for PKE schemes. Therefore, in this paper, we obtain a new code-based PKE scheme from Lau and Tan’s scheme, in order to inherit the underlying small public key and ciphertext sizes. However, our new scheme is shown to achieve IND-CCA2 security, instead of the weaker IND-CPA security. Specifically, the respective public key size and ciphertext size in our new scheme are 15.06 KB and 1.37 KB under 141-bit security level, and 16.76 KB and 1.76 KB under 154-bit security level. We then present a use case for the proposed scheme, that is for secure cloud storage.

Certificate-based encryption is a useful primitive that combines identity-based encryption and traditional public key encryption while preserving some of their most attractive features. It not only simplifies the cumbersome certificate management in traditional public key encryption, but also overcomes the key escrow and distribution problems inherent in identity-based encryption. In this paper, we extend the concept of key encapsulation mechanism to the primitive of certificate-based encryption and introduce the notion of certificate-based key encapsulation mechanism. We propose two provably secure certificate-based key encapsulation mechanism schemes. We prove that one is chosen-ciphertext secure in the random oracle model and the other is chosen-ciphertext secure in the standard model. Performance analysis shows that the proposed schemes are quite efficient and practical.

Cryptographic Primitives that Resist Backdooring and Subversion

Traitor tracing schemes [Chor–Fiat–Naor, Crypto ’94] help content distributors fight against piracy and are defined with the content distributor as a trusted authority having access to the secret keys of all users. While the traditional model caters well to its original motivation, its centralized nature makes it unsuitable for many scenarios. For usage among mutually untrusted parties, a notion of *ad hoc* traitor tracing (naturally with the capability of broadcast and revocation) is proposed and studied in this work. Such a scheme allows users in the system to generate their own public/secret key pairs, without trusting any other entity. To encrypt, a list of public keys is used to identify the set of recipients, and decryption is possible with a secret key for any of the public keys in the list. In addition, there is a tracing algorithm that given a list of recipients’ public keys and a pirate decoder capable of decrypting ciphertexts encrypted to them, identifies at least one recipient whose secret key must have been used to construct the said decoder. Two constructions are presented. The first is based on functional encryption for circuits (conceptually, obfuscation) and has constant-size ciphertext, yet its decryption time is linear in the number of recipients. The second is a generic transformation that reduces decryption time at the cost of increased ciphertext size. A matching lower bound on the trade-off between ciphertext size and decryption time is shown, indicating that the two constructions achieve all possible optimal trade-offs, i.e., they fully demonstrate the Pareto front of efficiency. The lower bound also applies to broadcast encryption (hence all mildly expressive attribute-based encryption schemes) and is of independent interest.

We propose a key-evolving paradigm to deal with the key exposure problem of public key encryption schemes. The key evolving paradigm is like the one used for forward-secure digital signature schemes. Let time be divided into time periods such that at time period j, the decryptor holds the secret key SKj, while the public key PK is fixed during its lifetime. At time period j, a sender encrypts a message m as ?j, c?, which can be decrypted only with the private key SKj. When the time makes a transit from period j to j + 1, the decryptor updates its private key from SKj to SKj+1 and deletes SKj immediately. The key-evolving paradigm assures that compromise of the private key SKj does not jeopardize the message encrypted at the other time periods.We propose two key-evolving public key encryption schemes with z- resilience such that compromise of z private keys does not affect confidentiality of messages encrypted in other time periods. Assuming that the DDH problem is hard, we show one scheme semantically secure against passive adversaries and the other scheme semantically secure against the adaptive chosen ciphertext attack under the random oracle.

With the continuous development of quantum technology, the quantum signature as an application of quantum cryptography has received great attention. In this paper, we propose a public-key quantum group blind signature scheme based on single-qubit rotations. In this scheme, the group manager generates a public key. Each group member randomly generates his own private key according to the public key. The signer uses his private key and random sequence to generate the signature. The verifier uses the public key to verify the correctness of the quantum signature. The public and private keys can be reused, which simplifies the key management of the signature system. In this scheme, the random sequence is used to enhance the security of the scheme. At the same time, the quantum efficiency is improved by using single-qubit rotations. The security analysis shows that our scheme can ensure the security of the keys, the unforgeability and the non-deniability of the signature.

Data exchange has been rapidly increased recently by increasing the use of mobile networks. Sharing information (text, image, audio and video) over unsecured mobile network channels is liable for attacking and stealing. Encryption techniques are the most suitable methods to protect information from hackers. Hill cipher algorithm is one of symmetric techniques, it has a simple structure and fast computations, but weak security because sender and receiver need to use and share the same private key within a non-secure channel. Therefore, a novel hybrid encryption approach between elliptic curve cryptosystem and hill cipher (ECCHC) is proposed in this paper to convert Hill Cipher from symmetric technique (private key) to asymmetric one (public key) and increase its security and efficiency and resist the hackers. Thus, no need to share the secret key between sender and receiver and both can generate it from the private and public keys. Therefore, the proposed approach presents a new contribution by its ability to encrypt every character in the 128 ASCII table by using its ASCII value direct without needing to assign a numerical value for each character. The main advantages of the proposed method are represented in the computation simplicity, security efficiency and faster computation.

Non-malleability is an important and intensively studied security notion for many cryptographic primitives. In the context of public key encryption, this notion means it is infeasible for an adversary to transform an encryption of some message m into one of a related message m' under the given public key. Although it has provided a strong security property for many applications, it still does not suffice for some scenarios like the system where the users could issue keys on-the-fly. In such settings, the adversary may have the power to transform the given public key and the ciphertext. To withstand such attacks, Fischlin introduced a stronger notion, known as complete non-malleability, which requires that the non-malleability property be preserved even for the adversaries attempting to produce a ciphertext of some related message under the transformed public key. To date, many schemes satisfying this stronger security have been proposed, but they are either inefficient or proved secure in the random oracle model. In this work, we put forward a new encryption scheme in the common reference string model. Based on the standard DBDH assumption, the proposed scheme is proved completely non-malleable secure against adaptive chosen ciphertext attacks in the standard model. In our scheme, the well-formed public keys and ciphertexts could be publicly recognized without drawing support from unwieldy techniques like non-interactive zero knowledge proofs or one-time signatures, thus achieving a better performance.

For most of the traditional IBEs (identity-based encryptions), security totally relies on the safekeeping of private keys. In case the private key is exposed, all the previously generated ciphertext need to be reissued. Due to increased usage of unprotected devices or mobiles, the key exposure is frequent. Therefore, it is important to mitigate the threat originated due to the key exposure in case of IBE. To deal with this issue, in this paper, we construct a novel IBE based on group ring that also provides forward security. We show that the security of our novel IBE is based on the hardness of discrete logarithm problem in group ring. Moreover, against the chosen plaintext attack, we show that it is semantically secure in random oracle model. Finally, we compare our IBE with several other existing IBEs in terms of execution cost.

In this paper, we study the problem of secure integrating public key encryption with keyword search (PEKS) with public key data encryption (PKE). We argue the previous security model is not complete regarding keyword privacy and the previous constructions are secure only in the random oracle model. We solve these problems by first defining a new security model, then give a generic construction which is secure in the new security model without random oracles. Our construction is based on secure PEKS and tag-KEM/DEM schemes and achieves modular design. We also give some applications and extensions for our construction. For example, instantiate our construction with proper components, we have a concrete scheme without random oracles, whose performance is even competitive to the previous schemes with random oracles.

The optimal operation problem of a reactive batch distillation column is solved for various types of models and also for different objective functions. As the base case a detailed model, including a dynamic energy balance, is developed for the process producing ethyl acetate. The reflux ratio and the heat duty are selected as the variables to be optimized and are assumed to be piecewise constant. First, the effect of the number of piecewise constant time periods on the value of the objective function is investigated. The result indicates that the performance is considerably improved with an increase in the number of time periods. The optimization results, evaluating the effect of the reaction on the trays, show that, compared with the case where the reaction occurs only in the reboiler, the reaction of the trays sometimes has a negative impact on the progress of the reaction. The results obtained from the models of different preciseness show that the assumptions of an algebraic energy balance sometimes overestimate the performance of the column. The effects of the holdup dynamics, the type of objective function, and the non-ideality of the VLE model are also discussed by comparing various optimization results.

Threshold Public Key Encryption allows a set of servers to decrypt a cipher text if a given threshold of authorized servers cooperate. Forward security allows one to mitigate the damage caused by exposure of secret keys. Forward-secure public encryptions are used to the threshold setting, this model guarantees that even if an adversary have broken into more than t distinct servers(for some i), messages encrypted during all time periods prior to i remain secret. In this paper, we present the first probably secure (non-interactive) forward-secure threshold public-key encryption scheme against chosen-cipher text attacks in the random oracle model. The encryption and update operations are very efficient when compared with the scheme presented by Libert et al. A formal definition, as well as a detailed analysis of the security performance of this scheme, is presented. The security of this scheme is based on the Computational Bilinear Diffie Hellman assumption, which leads to a unique approach to prove security in the random oracle model. Furthermore, in our model, the servers update their keys individually and asynchronously, without any communication between them.

In this paper, we propose two authenticated key distribution protocols and one conference key protocol using identity-based, self-certified public keys. These proposed protocols have the following properties:(i) No extra public key certificates and computational efforts are required for verification of authenticity for public keys.(ii) Key establishment and validation of the desired public keys are integrated in a logically single step.(iii) Each registering user can use his derived private key to check the validity of his public key issued by the system authority.(iv) The system authority cannot access to users' private keys. Hence, all private keys cannot be compromised in case of disruption or corruption of the system authority.(v) The proposed protocols provide the security property of key authentication whereby one user is assured that no other user aside from specifically identified user (s) may gain access to the derived shared key/conference key.