Efficient chosen ciphertext secure identity‐based encryption against key leakage attacks

Abstract

AbstractDue to the proliferation of side‐channel attacks, many efforts have been made to construct cryptographic systems that remain provably secure even if part of the secret information is leaked to the adversary. Recently, there have been many identity‐based encryption (IBE) schemes proposed in this context, almost all of which, however, can only achieve chosen plaintext attack (CPA) security. As far as we know, Alwen et al.'s IBE is the unique practical scheme secure against adaptive chosen ciphertext attacks (CCA2) in the standard model. Unfortunately, this scheme suffers from an undesirable shortcoming that the leakage parameter λ and the message length m are subject to λ + m≤ logp − ω(logκ), where κ and p denote the security parameter and the prime order of the underlying group, respectively. Beyond that, the leakage ratio in this scheme is very low, which can just reach 1/6. In this work, we put forward two new IBE schemes, both of which are λ‐leakage‐resilient CCA2 secure in the standard model. Specifically, the first construction is proposed based on Gentry's IBE, which is quite practical and almost as efficient as the original scheme. Moreover, its leakage parameter, λ≤ logp − ω(logκ), is independent of the size of the message space. To the best of our knowledge, it is the first practical leakage‐resilient fully CCA2 secure IBE scheme in the standard model, tolerating up to (logp − ω(logκ))‐bit leakage of the private key and its leakage parameter being independent of the message length. As to the second construction, it is proposed based on the scheme of Alwen et al., which has the same leakage parameter as Alwen et al., but has a better efficiency performance and a higher leakage ratio. As far as we know, it is the first practical and fully CCA2 secure leakage‐resilient IBE scheme with leakage ratio up to 1/4. Copyright © 2016 John Wiley & Sons, Ltd.