Chosen Ciphertext Attack Secure Research Articles

Possibility of decryption speed-up by parallel processing in CCA secure hashed ElGamal.

In order to prove the ElGamal CCA(Chosen Ciphertext Attack) security in the random oracle model, it is necessary to use the group where ICDH(Interactive Computational Diffie Hellman) assumption holds. Until now, only bilinear group with complex algebraic structure has been known as the ICDH group. In this paper, we introduce the ICDH group with simple algebraic structure. In other words, we prove that ICDH assumption holds in the integer group with composite modulus. On the basis of this, we propose the CCA secure hashed ElGamal and its fast variant to speed up decryption by parallel processing. Our parallel scheme has the fastest decryption among all CCA secure PKE(Public Key Encryption) schemes implemented in integer group and gives the possibility that ElGamal protocol could be practical when the big modulus numbers are used to resist the quantum attack.

Lightweight Privacy-Preserving Distributed Recommender System Using Tag-Based Multikey Fully Homomorphic Data Encapsulation

Recommender systems facilitate personalized service provision through the statistical analysis and model training of user historical data (e.g. user profile based on keyword searches, browsing behavior, travel history, etc). To address the underpinning privacy implications associated with such systems, a number of privacy-preserving recommendation approaches have been presented in the literature. There are, however, limitations in many of these approaches. For example, approaches that apply public key (fully) homomorphic encryption (FHE) on different users' historical rating records under a unique public key (i.e. the public key of a predefined target user requesting recommendation) incur significant computational overheads on resource-constrained local users and may not be scalable. On the other hand, approaches without utilizing public key FHE can neither resist chosen ciphertext attack (CCA), nor be straightforwardly applied to the setting of distributed servers. In this paper, a lightweight privacy-preserving distributed recommender system is proposed. Specifically, we present a new cryptographic primitive (i.e. tag-based multikey fully homomorphic data encapsulation mechanism; TMFH-DEM) designed to achieve CCA security for both input privacy and result privacy. TMFH-DEM enables a set of distributed servers to collaboratively execute efficient privacy-preserving outsourced computation on multiple inputs encrypted under different secret keys from different data owners, without using public key FHE. The authorized receiver can successfully decrypt the plaintext of the function evaluation result. Building on TMFH-DEM, we propose a lightweight privacy-preserving distributed recommender system, which flexibly returns all the recommended items with certain predicted ratings for all target users. Formal security proof shows that our proposal achieves both user historical rating data privacy and recommendation result privacy. Findings from our evaluations demonstrate its practicability in terms of scalability, recommendation accuracy, computational and communication efficiency.

A quantum resistant multi-user signcryption scheme featuring key invisibility for Internet of Things

With the advent of ubiquitous computing, multiple heterogeneous devices have evolved with increased connectivity, yielding the Internet of Things (IoT). For establishing secure communication, IoT has effectively become a primary security concern. The massive connectivity of the resource-constrained devices in IoT and enormous data on the air have made information vulnerable to several types of attacks. Although several resource-intensive cryptographic algorithms have been proposed to combat this security threat, signcryption has been identified as a sound solution for such an application.In this work, we propose an isogeny-based signcryption scheme by integrating HyPKE, an isogeny-based encryption scheme with an isogeny-based signature SeaSign based on Fiat Shamir with aborts. Apart from confidentiality and authenticity requirements, our scheme also achieves ciphertext anonymity and key invisibility, unlike the existing signcryption schemes in the post-quantum world. More positively, our security model considers insider attacks, supports multi-users setting and offers non-repudiation. Our work also studies the key privacy notion of the isogeny-based encryption scheme Hashed-PKE, which can be of independent interest in designing several anonymous channels or privacy-preserving protocols. More precisely, we showed Hashed-PKE achieves indistinguishability of keys against chosen-plaintext attack. This leads to the indistinguishability of keys against chosen-ciphertext attack security of HyPKE, a hybrid encryption scheme that is obtained by applying the Fujisaki Okamoto transformation to Hashed-PKE. We have proved our result in the standard model assuming the hardness of the Commutative Supersingular Decisional Diffie–Hellman assumption.

Indistinguishability under adaptive chosen-ciphertext attack secure double-NTRU-based key encapsulation mechanism.

In this article, we propose a double-NTRU (D-NTRU)-based key encapsulation mechanism (KEM) for the key agreement requirement of the post-quantum world. The proposed KEM is obtained by combining one-way D-NTRU encryption and Dent's KEM design method. The main contribution of this article is to construct a D-NTRU-based KEM that provides indistinguishability under adaptive chosen-ciphertext attack (IND-CCA2) security. The IND-CCA2 analysis and primal/dual attack resistance of the proposed D-NTRU KEM are examined in detail. A comparison with similar protocols is provided regarding parameters, public/secret keys, and ciphertext sizes. The proposed scheme presents arithmetic simplicity and IND-CCA2 security that does not require any padding mechanism.

An Anonymous and Outsourcing-Supported Multiauthority Access Control Scheme With Revocation for Edge-Enabled IIoT System

With the application of the Internet of Things and intelligent technologies in industrial systems, the manufacturing efficiency and product quality have been improved, leading to the development of the Industrial Internet of Things (IIoT). Uploading private data to the cloud may lead to data leakage without security protection. Thus, attribute-based encryption (ABE) is widely used to ensure data security and implement data access control, and some multiauthority ABE schemes are proposed to meet the requirement of attributes from different authorities, such as factory and government, which is more suitable for the IIoT system. However, the current multiauthority ABE schemes are with privacy leakage problems on attributes and low-efficiency issues. To address these problems, we propose a multiauthority ABE scheme, which protects users’ privacy by anonymizing attributes in authentication, reduces the computing burden of IIoT devices by adapting online/offline technique and outsourcing decryption to edge devices, and realizes effective attribute revocation. A formal security proof is presented that our scheme is replayable chosen ciphertext attack secure. Finally, we implement the proposed scheme, and experimental results show that our scheme is more efficient than the existing schemes.

Public-key encryption scheme with optimal continuous leakage resilience

In real-world applications, adversaries can launch leakage attacks, such as side-channel attacks, to obtain some information of the secret states (e.g. secret key, random value, etc.) in cryptographic protocols, compromising their security. Moreover, adversaries can obtain more leakage information by performing leakage attacks continuously, and the leakage attacks can be performed at any time by the adversary. Therefore, when designing public-key encryption (PKE) schemes, one should consider the continuous leakage setting. And it is desirable that the designed schemes can resist the leakage attacks. In this paper, to achieve better continuous leakage resilience, a novel construction of continuous leakage-resilient PKE scheme is proposed. The chosen-ciphertext attacks security of our proposed scheme can be proved based on the hardness of the decisional Diffie-Hellman assumption. Our construction tolerates a large key leakage rate, which is one of the best among existing PKE schemes. Moreover, the level of leakage resilience can be adjusted based on the specific requirements in real-world applications. The analyses demonstrate that our proposal also enjoys low computational overheads, outperforming the existing leakage-resilient PKE schemes.

A direct construction of continuous leakage-resilient (H)IBE scheme with CCA security from dual system encryption

Continuous leakage resilient semantically secure Identity-based Encryption (IBE) schemes created with dual system encryption technique were presented by Lewko et al. at TCC 2011 and Yuen et al. at Eurocrypt 2012, respectively. It has been a research challenge to achieve the security against chosen-ciphertext attacks (CCA). The previous attempts toward the CCA security rely on q-type assumptions, which are referred as non-static assumptions causing loose reduction in security proofs. In this paper, we provide a complete solution to the problem and show how to construct the continuous leakage-resilient IBE with weaker CCA security based on the dual system encryption technique, where the adversary is allowed to make continuous leakage queries. We are able to prove its security with static assumptions in the standard model. As a feature of our scheme, we allow leakage of multiple keys, i.e., leakage of the master secret key and the private key of user. Our scheme also enjoys better computational performance, since the round leakage parameter is independent of the plaintext space and has a constant size. Furthermore, our scheme can be easily extended to give the weaker CCA secure continuous leakage-resilient hierarchical identity-based encryption scheme with a short ciphertext length.

Identity-Based Encryption With Continuous Leakage-Resilient CCA Security From Static Complexity Assumption

Abstract Although a large number of provably secure cryptographic primitives have been proposed in the literature, many of these schemes might be broken in practice because of various leakage attacks. Therefore, the leakage resilience should be considered in designing these primitives. However, in identity-based cryptography, most of the existing leakage-resilient identity-based encryption (IBE) schemes suffer some limitations: they either resist the leakage attacks in the selective identity security model or achieve the chosen-ciphertext attack (CCA) security based on a non-static assumption. In this paper, an IBE scheme with adaptive leakage-resilient CCA security is proposed, and its security is rigorously proved in the random oracle model under a classic static complexity assumption, e.g. decisional bilinear Diffie–Hellman assumption. In our construction, all elements of ciphertext are randomly distributed in the adversary’s view. Hence, the adversary cannot obtain any useful information of the user’s private key from the given ciphertexts. Moreover, a unique property of our construction is that the leakage parameter is independent of the plaintext space, which contributes a better leakage rate.

Proxy Re-Encryption Scheme for Decentralized Storage Networks

Storage is a promising application for permission-less blockchains. Before blockchain, cloud storage was hosted by a trusted service provider. The centralized system controls the permission of the data access. In web3, users own their data. Data must be encrypted in a permission-less decentralized storage network, and the permission control should be pure cryptographic. Proxy re-encryption (PRE) is ideal for cryptographic access control, which allows a proxy to transfer Alice’s ciphertext to Bob with Alice’s authorization. The encrypted data are stored in several copies for redundancy in a permission-less decentralized storage network. The redundancy suffers from the outsourcing attack. The malicious resource provider may fetch the content from others and respond to the verifiers. This harms data integrity security. Thus, proof-of-replication (PoRep) must be applied to convince the user that the storage provider is using dedicated storage. PoRep is an expensive operation that encodes the original content into a replication. Existing PRE schemes cannot satisfy PoRep, as the cryptographic permission granting generates an extra ciphertext. A new ciphertext would result in several expensive replication operations. We searched most of the PRE schemes for the combination of the cryptographic methods to avoid transforming the ciphertext. Therefore, we propose a new PRE scheme. The proposed scheme does not require the proxy to transfer the ciphertext into a new one. It reduces the computation and operation time when allowing a new user to access a file. Furthermore, the PRE scheme is CCA (chosen-ciphertext attack) security and only needs one key pair.

New constructions of equality test scheme for cloud-assisted wireless sensor networks.

Public key encryption with equality test enables the user to determine whether two ciphertexts contain the same information without decryption. Therefore, it may serve as promising cryptographic technique for cloud-assisted wireless sensor networks (CWSNs) to maintain data privacy. In this paper, an efficient RSA with equality test algorithm is proposed. The presented scheme also handles the attackers based on their authorization ability. Precisely, the proposed scheme is proved to be one-way against chosen-ciphertext attack security and indistinguishable against chosen ciphertext attacks. Moreover, the experimental evaluations depict that the underlying scheme is efficient in terms of encryption, decryption, and equality testing. Thus, this scheme may be used as a practical solution in context of CWSNs, where the users may compare two ciphertexts without decryption.

A new construction of leakage-resilient CCA secure IBE scheme

Leakage of private information has become a threat to the security of cryptography systems. It has become a common security requirement that a cryptography scheme should withstand various leakage attacks. The non-interactive zero-knowledge (NIZK) argument system, one-time lossy filter (OT-LF) and one-time signature were widely used to create the generic constructions of leakage-resilient identity-based encryption (IBE) scheme with chosen-ciphertext attack (CCA) security. However, the computational efficiency of the corresponding generic construction is low because the underlying cryptographic tool is low. Thus, to solve the above problem, a new cryptographic primitive, called identity-based hash proof system with two encapsulated-key (T-IB-HPS), is proposed. The new generic constructions of leakage resilient IBE scheme with CCA security is created from the T-IB-HPS and message authentication code (MAC), and the security of the above proposed scheme is proved from the security of the underlying cryptographic tool. To further show the practicability, an instantiation of T-IB-HPS is constructed, and the formal security proof of the above instantiation is shown based on the decisional bilinear Diffie-Hellman (DBDH) assumption. Compared with the previous generic constructions of leakage resilient IBE scheme with CCA security, since the underlying cryptographic tools with low computational efficiency are not used, our generic construction has high computational efficiency.

Breaking the hardness assumption and IND‐CPA security of HQC submitted to NIST PQC project

Hamming quasi-cyclic (HQC) cryptosystem, proposed by Aguilar Melchor et al. , is a code-based key encapsulation mechanism (KEM) submitted for the NIST standardisation process of post-quantum cryptography (PQC). Under the assumption that the s -decision quasi-cyclic syndrome decoding ( s -DQCSD) problem is hard for s = 2 and 3, HQC, viewed as a public-key encryption scheme, is proven to be indistinguishability under chosen plaintext attack (IND-CPA) secure, and can be transformed into an IND-Adaptive chosen ciphertext attack secure KEM. However, the authors will show that the s -DQCSD problem is actually not intractable and HQC cannot attain IND-CPA security with all the proposed parameter sets. As HQC was selected as one of the second-round candidates by NIST, it was also updated to resist attack. The underlying s -DQCSD problem was replaced by the s -DQCSD with a parity problem and they claimed that the updated HQC could attain IND-CPA security under the hardness of the new problem. However, they find that there is some flaw in their security proof and the updated HQC is still vulnerable to attack. To fix it, they define a new problem called s -DQCSD with variable weight and present revised scheme HQC- β , which finally attains the IND-CPA security under the hardness assumption of the new problem.

Practical continuous leakage-resilient CCA secure identity-based encryption

Leakage of private information including private keys of user has become a threat to the security of computing systems. It has become a common security requirement that a cryptographic scheme should withstand various leakage attacks. In the real life, an adversary can break the security of cryptography primitive by performing continuous leakage attacks. Although, some research on the leakage-resilient cryptography had been made, there are still some remaining issued in previous attempts. The identity-based encryption (IBE) constructions were designed in the bounded-leakage model, and might not be able to meet their claimed security under the continuous-leakage attacks. In the real applications, the leakage is unbounded. That is, a practical cryptography scheme should keep its original security in the continuous leakage setting. The previous continuous leakage-resilient IBE schemes either only achieve chosen-plaintext attacks security or the chosen-ciphertext attacks (CCA) security is proved in the selective identity model. Aiming to solve these problems, in this paper, we show how to construct the continuous leakage-resilient IBE scheme, and the scheme’s adaptive CCA security is proved in the standard model based on the hardness of decisional bilinear Diffie-Hellman exponent assumption. For any adversary, all elements in the ciphertext are random, and an adversary cannot obtain any leakage on the private key of user from the corresponding given ciphertext. Moreover, the leakage parameter of our proposal is independent of the plaintext space and has a constant size.

Analysis of Error Dependencies on Newhope

Among many submissions to the NIST post-quantum cryptography (PQC) project, NewHope is a promising key encapsulation mechanism (KEM) based on the Ring-Learning with errors (Ring-LWE) problem. Since NewHope is an indistinguishability (IND)-chosen ciphertext attack secure KEM by applying the Fujisaki-Okamoto transform to an IND-chosen plaintext attack secure public key encryption, accurate calculation of decryption failure rate (DFR) is required to guarantee resilience against attacks that exploit decryption failures. However, the current upper bound of DFR on NewHope is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and the approximation effect of centered binomial distribution are not fully considered. Furthermore, since NewHope is a Ring-LWE based cryptosystem, there is a problem of error dependency among error coefficients, which makes accurate DFR calculation difficult. In this paper, we derive much tighter upper bound on DFR than the current upper bound using constraint relaxation and union bound. Especially, the above-mentioned factors are all considered in derivation of new upper bound and the centered binomial distribution is not approximated to subgaussian distribution. In addition, since the error dependency is considered, the new upper bound is much closer to the real DFR than the previous upper bound. Furthermore, the new upper bound is parameterized by using Chernoff-Cramer bound in order to facilitate calculation of new upper bound for the parameters of NewHope. Since the new upper bound is much lower than the DFR requirement of PQC, this DFR margin is used to improve the security and bandwidth efficiency of NewHope. As a result, the security level of NewHope is improved by 7.2 % or bandwidth efficiency is improved by 5.9 %.

Identity-based encryption with leakage-amplified chosen-ciphertext attacks security

Alwen et al. (EUROCRYPT 2010) proposed the formal definition of identity-based hash proof system (IB-HPS). As an independent interest, they showed that a leakage-resilient identity-based encryption (LR-IBE) scheme can be created based on an IB-HPS. That is, a generic construction of LR-IBE scheme with the chosen-plaintext attacks (CPA) security be designed from the IB-HPS. However, in order to further improve the practicability of identity-based encryption (IBE) system, an IBE scheme must have the chosen-ciphertext attacks (CCA) security. Hence, in this paper, a generic construction of LR-IBE scheme with the CCA security is proposed from the IB-HPS. In additional, to design an LR-IBE schemes with an arbitrarily length leakage parameter, we design a novel generic construction of leakage amplified IBE scheme with CCA security, where we only increase the size of private key proportionally, while do not change all other parameters, and the upper bound of permitted leakage can be flexibly controlled by changing the leakage-size parameter. In other words, the length of allowed leakage of our generic construction is determined by the leakage requirements of actual applications.

Continuous Leakage-Resilient Certificate-Based Encryption Scheme Without Bilinear Pairings

Abstract Recently, much attention has been focused on designing provably secure cryptographic primitives in the presence of key leakage, even the continuous leakage attacks. However, several constructions on the (continuous) leakage-resilient certificate-based encryption (CBE) scheme were proposed based on the bilinear pairings, and the corresponding computational efficiency is lower. Also, the leakage on the master secret key is omitted in the previous constructions. In this paper, to further achieve the better performance, a new construction method of continuous leakage-resilient CBE scheme without bilinear pairings is proposed, and the chosen-ciphertext attacks security of designed scheme is proved based on the hardness of the classic decisional Diffie–Hellman assumption. The performance analysis shows that our method not only can obtain higher computational efficiency but also enjoys better security performances, such as the leakage parameter of secret key of user has the constant size, and an adversary cannot obtain any leakage on the secret key of user from the corresponding given ciphertext etc. The advantage is that our proposal allows leakage attacks of multiple keys, i.e. continuous leakage resilience of the secret key of user and bounded leakage resilience of the master secret key. Additionally, to provide the leakage resilience for the cloud computing, a novel data access control scheme for cloud storage service is proposed from our continuous leakage-resilient CBE scheme, which can keep its claimed security in the leakage seting.

CCA Secure Public Key Encryption against After-the-Fact Leakage without NIZK Proofs

In leakage resilient cryptography, there is a seemingly inherent restraint on the ability of the adversary that it cannot get access to the leakage oracle after the challenge. Recently, a series of works made a breakthrough to consider a postchallenge leakage. They presented achievable public key encryption (PKE) schemes which are semantically secure against after-the-fact leakage in the split-state model. This model puts a more acceptable constraint on adversary’s ability that the adversary cannot query the leakage of secret states as a whole but the functions of several parts separately instead of prechallenge query only. To obtain security against chosen ciphertext attack (CCA) for PKE schemes against after-the-fact leakage attack (AFL), existing works followed the paradigm of “double encryption” which needs noninteractive zero knowledge (NIZK) proofs in the encryption algorithm. We present an alternative way to achieve AFL-CCA security via lossy trapdoor functions (LTFs) without NIZK proofs. First, we formalize the definition of LTFs secure against AFL (AFLR-LTFs) and all-but-one variants (ABO). Then, we show how to realize this primitive in the split-state model. This primitive can be used to construct AFLR-CCA secure PKE scheme in the same way as the method of “CCA from LTFs” in traditional sense.

A generic construction of CCA-secure deterministic encryption

Deterministic public-key encryption (D-PKE), introduced by Bellare, Boldyreva, and O'Neill (CRYPTO'07), encrypts every plaintext into a unique ciphertext without using any randomness. Compared with the traditional randomized public-key encryptions, D-PKE has advantages in searching encrypted values across the database thanks to its lower computational overheads. In the literature, Bellare et al. gave the “strongest possible” notion of security for this primitive, called PRIV, and they also showed how this notion can be achieved in the random oracle model. Afterwards, Boldyreva, Fehr, and O'Neill (CRYPTO'08), followed by many other researchers, designed chosen ciphertext attack (CCA) secure D-PKE schemes in the standard model. These works are all based on lossy trapdoor functions and all-but-one trapdoor functions. In this paper, we present an alternative paradigm to design CCA-secure D-PKE. Our approach is a generic construction based on the identity-based lossy trapdoor functions (IB-LTDF), and it also can be extended to design CCA secure deterministic identity-based encryption schemes (D-IBE). To the best of our knowledge, this gives the first efficient construction of CCA-secure D-IBE schemes. Moreover, our approach can be considered as another application of the CHK transformation.

Identity‐based encryption resilient to continuous key leakage

Leakage of private information has become a threat to the security of computing systems. It has become a common security requirement that a cryptography scheme should withstand various leakage attacks, even the continuous leakage attacks. However, in the current constructions on the (continuous) leakage-resilient identity-based encryption (CLR-IBE) scheme, the leakage parameter is a fixed value. Aiming to solve these problems, in this study, the authors show how to construct the CLR-IBE scheme, and the adaptive chosen-ciphertext attacks security of proposed construction can be proved in the standard model. To further improve the practicability of CLR-IBE scheme, they design an improved IBE scheme with continuous leakage amplified property, and the leakage parameter has an arbitrary length.

Continuous Leakage-Resilient Identity-Based Encryption Scheme with CCA Security

Leakage of private information including private key has become a threat to the security of computing systems. It has become a common security requirement that a cryptographic scheme should withstand various leakage attacks, including continuous leakage attacks. In order to obtain an Identity-based encryption (IBE) scheme which can keep its original security in the continuous leakage setting, we propose a new construction method of IBE scheme with Chosen-ciphertext attacks (CCA) security, which can tolerate continuous leakage attacks on many private keys of each identity, and whose security is proved based on the hardness of the classical Decisional bilinear Diffie-Hellman (DBDH) assumption in the standard model. The leakage parameter is independent of the plaintext space and has the constant size.