CCA-secure Public-key Encryption Research Articles

A CCA secure public key encryption scheme based on finite groups of Lie type

A CCA secure public key encryption scheme based on finite groups of Lie type

Receiver Selective Opening CCA Secure Public Key Encryption from Various Assumptions

Receiver Selective Opening CCA Secure Public Key Encryption from Various Assumptions

Non-malleable Encryption: Simpler, Shorter, Stronger

One approach toward basing public-key encryption (PKE) schemes on weak and credible assumptions is to build “stronger” or more general schemes generically from “weaker” or more restricted ones. One particular line of work in this context was initiated by Myers and Shelat (FOCS ’09) and continued by Hohenberger, Lewko, and Waters (Eurocrypt ’12), who provide constructions of multi-bit CCA-secure PKE from single-bit CCA-secure PKE. It is well known that encrypting each bit of a plaintext string independently is not CCA-secure—the resulting scheme is malleable. We therefore investigate whether this malleability can be dealt with using the conceptually simple approach of applying a suitable non-malleable code (Dziembowski et al., ICS ’10) to the plaintext and subsequently encrypting the resulting codeword bit by bit. We find that an attacker’s ability to ask multiple decryption queries requires that the underlying code be continuously non-malleable (Faust et al., TCC ’14). Since, as we show, this flavor of non-malleability can only be achieved if the code is allowed to “self-destruct,” the resulting scheme inherits this property and therefore only achieves a weaker variant of CCA security. We formalize this new notion of so-called indistinguishability under self-destruct attacks (IND-SDA) as CCA security with the restriction that the decryption oracle stops working once the attacker submits an invalid ciphertext. We first show that the above approach based on non-malleable codes yields a solution to the problem of domain extension for IND-SDA-secure PKE, provided that the underlying code is continuously non-malleable against (a reduced form of) bit-wise tampering. Then, we prove that the code of Dziembowski et al. is actually already continuously non-malleable against bit-wise tampering. We further investigate the notion of security under self-destruct attacks and combine IND-SDA security with non-malleability under chosen-ciphertext attacks (NM-CPA) to obtain the strictly stronger notion of non-malleability under self-destruct attacks (NM-SDA). We show that NM-SDA security can be obtained from basic IND-CPA security by means of a black-box construction based on the seminal work by Choi et al. (TCC ’08). Finally, we provide a domain extension technique for building a multi-bit NM-SDA scheme from a single-bit NM-SDA scheme. To achieve this goal, we define and construct a novel type of continuous non-malleable code, called secret-state NMC, since, as we show, standard continuous NMCs are insufficient for the natural “encode-then-encrypt-bit-by-bit” approach to work.

Improved lattice-based CCA2-secure PKE in the standard model

Based on the identity-based encryption (IBE) from lattices by Agrawal et al. (Eurocrypt’10), Micciancio and Peikert (Eurocrypt’12) presented a CCA1-secure public-key encryption (PKE), which has the best known efficiency in the standard model and can be used to obtain a CCA2-secure PKE from lattices by using the generic BCHK transform (SIAM J Comput, 2006) with a cost of introducing extra overheads to both computation and storage for the use of other primitives such as signatures and commitments. In this paper, we propose a more efficient standard model CCA2-secure PKE from lattices by carefully combining a different message encoding (which encodes the message into the most significant bits of the LWE’s “secret term”) with several nice algebraic properties of the tag-based lattice trapdoor and the LWE problem (such as unique witness and additive homomorphism). Compared to the best known lattice-based CCA1-secure PKE in the standard model due to Micciancio and Peikert (Eurocrypt’12), we not only directly achieve the CCA2-security without using any generic transform (and thus do not use signatures or commitments), but also reduce the noise parameter roughly by a factor of 3. This improvement makes our CCA2-secure PKE more efficient in terms of both computation and storage. In particular, when encrypting a 256-bit (respectively, 512-bit) message at 128-bit (respectively, 256-bit) security, the ciphertext size of our CCA2-secure PKE is even 33%–44% (respectively, 36%–46%) smaller than that of their CCA1-secure PKE.

Updatable Lossy Trapdoor Functions Under Consecutive Leakage

Abstract Lossy trapdoor functions (LTFs), introduced by Peikert and Waters (STOC’08), have already been found to be a very useful tool in constructing complex cryptographic primitives in a black-box manner, such as one-way trapdoor functions, deterministic public-key encryption, CCA-secure public-key encryption, etc. Due to the existence of the side-channel attack, the leakage of trapdoor information in lossy trapdoor function systems can lead to the impossibility of provable security. Recently, Zhang et al. introduced a model of consecutive and continual leakage-resilient and updatable lossy trapdoor functions (ULTFs) and provided a concrete construction to achieve the security. Meanwhile, they proposed a consecutive and continual leakage-resilient public-key encryption scheme. However, in this paper, we demonstrate that the correctness of injective function can not be satisfied. Furthermore, the attacker can easily distinguish the evaluation key of ULTFs generated by the challenger according to the security model. Finally, we show two new constructions based on the continual leakage-resilient public-key encryption scheme of Brakerski et al. (FOCS 2010) and demonstrate the security of our scheme in the consecutive and continual leakage model.

Cryptography with Disposable Backdoors

Backdooring cryptographic algorithms is an indisputable taboo in the cryptographic literature for a good reason: however noble the intentions, backdoors might fall in the wrong hands, in which case security is completely compromised. Nonetheless, more and more legislative pressure is being produced to enforce the use of such backdoors. In this work we introduce the concept of disposable cryptographic backdoors which can be used only once and become useless after that. These exotic primitives are impossible in the classical digital world without stateful and secure trusted hardware support, but, as we show, are feasible assuming quantum computation and access to classical stateless hardware tokens. Concretely, we construct a disposable (single-use) version of message authentication codes, and use them to derive a black-box construction of stateful hardware tokens in the above setting with quantum computation and classical stateless hardware tokens. This can be viewed as a generic transformation from stateful to stateless tokens and enables, among other things, one-time programs and memories. This is to our knowledge the first provably secure construction of such primitives from stateless tokens. As an application of disposable cryptographic backdoors we use our constructed primitive above to propose a middle-ground solution to the recent legislative push to backdoor cryptography: the conflict between Apple and FBI. We show that it is possible for Apple to create a one-time backdoor which unlocks any single device, and not even Apple can use it to unlock more than one, i.e., the backdoor becomes useless after it is used. We further describe how to use our ideas to derive a version of CCA-secure public key encryption, which is accompanied with a disposable (i.e., single-use, as in the above scenario) backdoor.

Simulation-based receiver selective opening CCA secure PKE from standard computational assumptions

In the situation where there are one sender and multiple receivers and the sender transmits ciphertexts of correlated plaintexts, a receiver selective opening (RSO) attack for a public key encryption (PKE) scheme considers adversaries that can corrupt some of the receivers and get their secret keys and plaintexts. Security against RSO attacks for a PKE scheme ensures confidentiality of ciphertexts of uncorrupted receivers. Simulation-based RSO security against chosen ciphertext attacks (SIM-RSO-CCA) is the strongest security notion in all RSO attack scenarios. Jia, Lu, and Li (2016) [19] proposed the first SIM-RSO-CCA secure PKE scheme. However, their scheme used indistinguishability obfuscation, which is not known to be constructed from any standard computational assumption. In this paper, we give two contributions for constructing SIM-RSO-CCA secure PKE from standard computational assumptions. Firstly, we propose a generic construction of SIM-RSO-CCA secure PKE using an IND-CPA secure PKE scheme and a non-interactive zero-knowledge proof system satisfying one-time simulation soundness. Secondly, we propose an efficient and concrete construction of SIM-RSO-CCA secure PKE based on the decisional Diffie-Hellman (DDH) assumption. Moreover, we give a method for efficiently expanding the plaintext space of the DDH-based construction. By applying this method to the construction, we obtain the first DDH-based SIM-RSO-CCA secure PKE scheme supporting a super-polynomially large plaintext space with compact ciphertexts.

A countermeasure against cryptographic key leakage in cloud: public-key encryption with continuous leakage and tampering resilience

Public-key encryption is an important security mechanism used in cloud environment. To ensure the confidentiality of data encrypted using public-key encryption, countermeasures against cryptographic key leakage by side-channel attacks should be applied to the encryption scheme implemented both in locality and in cloud server. Traditional public-key encryption does not capture side-channel attacks. Moreover, the adversary can inject fault to tamper with the secret key and observe the output of the public-key encryption scheme under this modified key which is called “tampering attack”. In this paper, we present two continuous leakage and tampering resilient CCA secure public-key encryption schemes. For implementations of our schemes during the key update, bounded number of tampering queries for arbitrary key relations and bounded leakage is allowed. By updating the secret key, our schemes are secure against continuous leakage and tampering attacks.

Regular lossy functions and their applications in leakage-resilient cryptography

In STOC 2008, Peikert and Waters introduced a powerful primitive called lossy trapdoor functions (LTFs). In a nutshell, LTFs are functions that behave in one of two modes. In the normal mode, functions are injective and invertible with a trapdoor. In the lossy mode, functions statistically lose information about their inputs. Moreover, the two modes are computationally indistinguishable. In this work, we put forward a relaxation of LTFs, namely, regular lossy functions (RLFs). Compared to LTFs, the functions in the normal mode are not required to be efficiently invertible or even unnecessary to be injective. Instead, they could also be lossy, but in a regular manner. We also put forward richer abstractions of RLFs, namely all-but-one regular lossy functions (ABO-RLFs) and one-time regular lossy filters (OT-RLFs).We show that (ABO)-RLFs admit efficient constructions from both a variety of number-theoretic assumptions and hash proof system (HPS) for subset membership problems satisfying natural algebraic properties. Thanks to the relaxations on functionality, the constructions enjoy much compact key size and better computational efficiency than that of (ABO)-LTFs.We demonstrate the utility of RLFs and their extensions in the leakage-resilient cryptography.•As a special case of RLFs, lossy functions imply leakage-resilient injective one-way functions with optimal leakage rate 1−o(1).•ABO-RLFs (or OT-RLFs) immediately imply leakage-resilient one-time message authentication code (MAC) with optimal leakage rate 1−o(1).•ABO-RLFs together with HPS give rise to leakage-resilient chosen-ciphertext (CCA) secure key encapsulation mechanisms (KEM) (this approach extends naturally to the identity-based setting). Combining the construction of ABO-RLFs from HPS, this gives the first leakage-resilient CCA-secure public-key encryption (PKE) with optimal leakage rate based solely on HPS, and thus goes beyond the barrier posed by Dodis et al. (Asiacrypt 2010). Our construction also applies to the identity-based setting, yielding LR-CCA secure IB-KEM with higher leakage rate than previous works.

Strong continuous non-malleable encoding schemes with tamper-detection

A non-malleable encoding scheme is a keyless encoding scheme which is resilient to tampering attacks. Such a scheme is said to be continuously secure if the scheme is resilient to attacks containing more than one tampering procedure. Moreover, such a scheme is said to have the T-tamper-detection property if any kind of tampering attack by an adversary chosen from a predetermined class of algorithms T is detected. Faust et al. have introduced a continuous non-malleable encoding scheme based on non-interactive zero-knowledge (NIZK) which is secure in a strong model for which the adversary receives the tampered codeword as a response to its tampering query if the tampered codeword is not identical to the original codeword but is decodable, while it receives a failure signal ⊥ after sending the first undecodable tampered codeword.In this article, on the one hand, we propose a unified framework for security models related to tamper-detection and leakage-resilience, and on the other hand, we introduce a new strongly secure continuous non-malleable encoding scheme having tamper-detection property with respect to all polynomial-time adversaries, satisfying a better leakage bound whose security is based on the existence of secure MAC’s. Also, as a byproduct, we introduce and justify the importance of an intermediate security model called semistrong continuous non-malleability, while we discuss different variants of these security models and provide a secure semistrong continuous non-malleable encoding scheme whose security is based on the existence of CCA-secure public-key encryption. We provide concrete proofs indicating that there is a trade-off between tamper-detection for all efficient Turing machines and being plain-CRS (i.e. the property that any user including adversaries can encode arbitrary messages), and we deduce that any tamper-detection encoding scheme for all efficient Turing machines cannot be re-encodable.Considering applications, it is instructive to note that our proposed schemes can be used to implement an algorithmic tamper-detection at a software level while satisfying the necessary security conditions.

Consecutive Leakage-Resilient and Updatable Lossy Trapdoor Functions and Application in Sensitive Big-Data Environments

Lossy trapdoor functions (LTFs) are very useful tools in constructing complex cryptographic primitives in a black-box manner, such as injective trapdoor functions, collision-resistant hashes, CCA secure public-key encryption, and so on. However, the trapdoor is very sensitive in lossy trapdoor function systems, and the attacker can obtain partial sensitive information of trapdoor by the side-channel attacks, which leads to not only the leakage of sensitive information but also the impossibility of provable security . In this paper, we present the new model of updatable lossy trapdoor functions in presence of consecutive and continual leakage-resilient , to provide a more efficient mechanism in solving the sensitive trapdoor leakage problem in LTF systems. Our contribution has threefold: 1) we give the definition and model of consecutive and continual leakage-resilient LTFs, and provide the concrete construction to achieve the lossiness of 50%; 2) using the proposed LTF scheme as a primitive, we present a updatable public-key encryption in the presence of consecutive and continual leakage-resilience, in which the leakage of secret key can occur during the updates that can simulate the real leakage scenarios; and 3) We provide a secure application deployment in sensitive-data revealing environments that employ the proposed $\textsf {CCLR-PKE}$ scheme as a building block, in which a side-channel analyzer might obtain some sensitive information by controlling the secret channel, watching the private memory and detecting the algorithm executing and so on.

Compact public key encryption without full random oracles

Achieving shorter ciphertext length under weaker assumptions in chosen-ciphertext (CCA) secure public-key encryption (PKE) is one of the most important research topics in cryptography. However, it is also known that it is hard to construct a CCA-secure PKE whose ciphertext overhead is less than two group elements in the underlying prime-order group under non-interactive assumptions. A naive approach for achieving more compactness than the above bound is to use random oracles (ROs), but the full RO has various ideal properties like programmability. In this paper, we pursue how to achieve compact PKE only with a minimum ideal property of ROs. Specifically, only with observability, we can give three CCA-secure PKE schemes whose ciphertext overhead is less than two group elements. Our schemes are provably secure under standard assumptions such as the CDH and DDH assumptions. This study shows that ideal properties other than observability are not necessary to construct compact PKE beyond the bound.

Post-challenge leakage in public-key encryption

When an adversary can measure the physical memory storing the decryption key, decryption functionality often comes in handy. Halevi and Lin (TCC'11) studied after-the-fact (or post-challenge) leakage in public-key encryption (PKE), in which an adversary can make leakage queries from a split state after seeing the challenge ciphertext, but left security against chosen-ciphertext attacks (CCA) as a future work. In this paper, we follow their work and formulate the definition of entropic leakage-resilient CCA-secure PKE, which we show can be realized by the Naor–Yung “double encryption” paradigm (STOC'90). We then leverage it to get a CCA-secure key-encapsulation mechanism in the presence of post-challenge leakage, in the same model of bounded memory leakage from a split state. Finally, we prove that the hybrid encryption framework is still applicable by presenting a construction of CCA-secure PKE in the presence of post-challenge leakage. As additional results, we extend these concepts to the identity-based setting, where many identity-based secret-keys can be leaked after the adversary got the challenge, and give a construction of identity-based encryption in the presence of post-challenge leakage in the split-state model, which can be instantiated by the identity-based hash proof systems of Alwen et al. (Eurocrypt'10) and Chow et al. (CCS'10).

Complementary witness soundness for witness indistinguishable proof system and CCA2 public-key encryption schemes

We introduce the notion of complementary-witness-soundness for a witness indistinguishable proof system. We then present a new general framework for public key encryption schemes, denoted as CWSWI-type encryption, based on a complementary-witness-sound witness indistinguishable CWSWI proof system. The construction of a CWSWI-type encryption scheme is relatively straightforward, while the security thereof against adaptive chosen ciphertext attack denoted CCA2 can be rigorously proven. Many existing CCA2 public key encryption schemes can be interpreted as being of CWSWI-type, including the schemes of Lindell, Cramer-Shoup and Peikert-Waters. Thus, our CWSWI approach provides a novel means for designing and analysing CCA2 secure public key encryption schemes.

Post-Challenge Leakage Resilient Public-Key Cryptosystem in Split State Model

SUMMARY Leakage resilient cryptography is often considered in the presence of a very strong leakage oracle: An adversary may submit arbitrary efficiently computable function f to the leakage oracle to receive f (x), where x denotes the entire secret that a party possesses. This model is somewhat too strong in the setting of public-key encryption (PKE). It is known that no secret-key leakage resilient PKE scheme exists if the adversary may have access to the secret-key leakage oracle to receive only one bit after it was given the challenge ciphertext. Similarly, there exists no sender-randomness leakage resilient PKE scheme if one-bit leakage occurs after the target public key was given to the adversary. At TCC 2011, Halevi and Lin have broken the barrier of after-the-fact leakage, by proposing the so-called split state model, where a secret key of a party is explicitly divided into at least two pieces, and the adversary may have not access to the entire secret at once, but each divided pieces, one by one. In the split-state model, they have constructed post-challenge secret-key leakage resilient CPA secure PKEs from hash proof systems, but the construction of CCA secure post-challenge secret-key leakage PKE has remained open. They have also remained open to construct sender-randomness leakage PKE in the split state model. This paper provides a solution to the open issues. We also note that the proposal of Halevi and Lin is post-challenge secret-key leakage CPA secure against a single challenge ciphertext; not against multiple challenges. We present an efficient generic construction that converts any CCA secure PKE scheme into a multiple-challenge CCA secure PKE that simultaneously tolerates post-challenge secret-key and sender-randomness leakage in the split state model, without any additional assumption .I n addition, our leakage amount of the resulting schemes is the same as that of

CCA-secure publicly verifiable public key encryption scheme without pairings

Publicly verifiable encryption scheme is a very powerful tool to construct many other interesting cryptographic schemes or protocols, and the existing publicly verifiable encryption schemes are based on special characters of bilinear pairings. But the inefficient computing restricts its application badly. So it is quite attractive and significantly worthwhile to construct cryptographic algorithms without pairings. Hofheinz and Kiltz's 2009b scheme is a Chosen-Ciphertext Attacks CCA-secure public key encryption scheme under factoring assumption without pairings, but not a publicly verifiable construction. We improved Hofheinz and Kiltz's 2009b scheme and realised publicly verifiable construct with CCA security by using the gap property that the decisional Diffie-Hellman problem is easy but the computational Diffie-Hellman problem is difficult as factoring over the group of signed quadratic residues. Furthermore, we improved the efficiency by instantiating this scheme over a semi-smooth subgroup. It can be used to construct threshold schemes without pairings.

New signature schemes in the standard model based on publicly verifiable CCA-secure public key encryption

Till now, there are not many ways to construct signature schemes in the standard model and recently many researchers show great interest in construction secure signatures in the standard model. CCA secure publicly verifiable public key encryption in the standard model PVPKE is a new interesting primitive, in which the ciphertext's validity/integrity can be publicly verified. In this paper, we propose a new way to construct signature schemes in the standard model. That is, transforming CCA secure publicly verifiable public key encryption schemes into signature schemes. Our transformation based on the following facts: 1 the signature scheme and CCA secure publicly verifiable public key encryption scheme share the same 'publicly verifiability' property; 2 the signature scheme requires the signatures can not be malleable, and CCA secure publicly verifiable public key encryption also require the ciphertexts can not be malleable; 3 public key encryption and digital signature schemes can be viewed as dual of each other. By utilising these facts, we try to give a new way to construct signature scheme in the standard model.

Efficient chosen‐ciphertext secure public‐key encryption scheme with high leakage‐resilience

A leakage-resilient public-key encryption (PKE) scheme provides security even if an adversary obtains some information on the secret key. In recent years, much attention has been focused on designing provably secure PKE in the presence of key-leakage and almost all the constructions rely on an important building block namely hash proof system (HPS). However, in the setting of adaptive chosen-ciphertext attacks (CCA2), there are not many HPS-based leakage-resilient PKE schemes available. Moreover, most of them have an unsatisfactory leakage rate. In this study, the authors propose a new method of constructing leakage-resilient CCA2-secure PKE scheme from any tag-based strongly universal 2 HPS. The striking advantage of the authors scheme is the leakage rate, which is the best one among all known HPS-based indistinguishability key leakage CCA2-secure constructions. In particular, they present an instantiation under the n -linear assumption. In the cases of n = 1 (resp. n = 2), they actually obtain a decisional Diffie-Hellman (DDH)-based [resp. decisional linear (DLIN)-based] PKE scheme, where the leakage rate can be made to 1/4 (resp. 1/6). The authors DDH-based scheme achieves the best leakage rate among all known DDH-based (Cramer-Shoup-type) schemes. Their DLIN-based scheme is the first one that can achieve leakage of L /6 bits without pairing, where L is the length of the secret key.

Weak leakage resilient extractable hash proof system and construction for weak leakage resilient CCA-secure public-key encryption

Public-key encryption can be used in cloud systems to protect data in data sharing, identity authentication, etc. However, traditional public-key encryption does not capture the side-channel attacks. Inspired by this, the model of key-leakage attacks is formalised. However, constructing schemes in this model seems somewhat difficult and most key-leakage attacks in reality may be weak. In this paper, we consider the model of weak key-leakage attacks and focus on how to construct a weak leakage-resilient CCA-secure key encapsulation scheme. To this end, we present the new definitions of weak leakage-resilient extractable hash proofs and weak leakage-resilient partial ABO-extractable hash proofs and propose generic transformations to construct them from extractable hash proof. Then we show how to derive a weak leakage-resilient CCA-secure key encapsulation scheme based on them. We also give a concrete instantiation in a group of prime order and design an experiment to show the leakage-resilience in reality.

Generic constructions of integrated PKE and PEKS

In this paper we investigate the topic of integrated public-key encryption (PKE) and public-key encryption with keyword search (PEKS) schemes (PKE---PEKS as shorthand). We first formalize the strongest security notion to date for PKE---PEKS schemes, named joint CCA-security. We then propose two simple constructions of jointly CCA-secure PKE---PEKS schemes from anonymous (hierarchical) identity-based encryption schemes. Besides, we also define the notion of consistency for PKE---PEKS schemes, as well as revisit its related notions (including consistency of PEKS schemes, robustness and collision-freeness of IBE schemes), which may be of independent interest.