Continual Leakage Model Research Articles

Leakage-Resilient Anonymous Multi-Recipient Signcryption Under a Continual Leakage Model

A multi-recipient signcryption (MRSC) scheme possesses the functionalities of both multi-recipient public-key encryption and digital signature to ensure both integrity and confidentiality of transmitted messages. Moreover, an anonymous MRSC (AMRSC) scheme retains the functionalities of an MRSC scheme while offering privacy-preserving, namely, a recipient’s identity or public key being hidden to other recipients. In the past, numerous MRSC and AMRSC schemes based on various public-key cryptographies (i.e., public key infrastructure (PKI)-based, identity (ID)-based and certificateless (CL)) were proposed. Recently, an attacker can realize side-channel attacks to acquire partial bits of private keys participated in cryptographic computations. However, up to date, no MRSC or AMRSC scheme can resist side-channel attacks so that these schemes might suffer from such attacks and could be broken. To resist such attacks under a continual leakage model, we propose the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">first</i> PKI-based leakage-resilient AMRSC (PKI-LR-AMRSC) scheme in this paper. In the proposed scheme, an attacker is permitted to continually acquire partial bits of private keys partook in computations of the PKI-LR-AMRSC scheme, and formal security proofs are given to show that the proposed scheme still retains the original security of AMRSC schemes. As compared with the relevant AMRSC schemes, our PKI-LR-AMRSC scheme not only resists side-channel attacks but also reduces the cost of executing the multi-signcryption and unsigncryption algorithms. In particular, the point is that the computational complexities of our scheme respectively require only <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i> ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i> ) and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i> (1) in executing the Multi-signcryption algorithm and the Unsigncryption algorithm, where t is the number of recipients.

Continual Leakage-Resilient Hedged Public-Key Encryption

Abstract Hedged public-key encryption (HPKE), introduced by Bellare et al. (ASIACRYPT 2009), provides useful security when the per-message randomness fails to be uniform due to faulty implementations or adversarial actions. The HPKE scheme achieves IND-CPA (chosen plaintext attack) security when the randomness they used is of high quality, but, when the randomness is poor quality, rather than breaking completely, it achieves a weaker but a useful notion of security called IND-CDA (chosen distribution attack) as long as the message and randomness together have sufficient min-entropy. However, little research on HPKE in the presence of key leakage was done. In this paper, we study HPKE featuring key leakage-resilience and formulate appropriate security notion for key leakage-resilient HPKE. We work in the continual key leakage model where the secret key is refreshed periodically and an adversary can learn arbitrary but bounded leakage on the secret key between the updates. We present two generic constructions of continual leakage-resilient HPKE in the standard model by using a continual leakage-resilient all-but-one lossy trapdoor function. Finally, we give an instantiation of leakage-resilient HPKE under the linear assumption in bilinear groups.

Updatable Lossy Trapdoor Functions Under Consecutive Leakage

Abstract Lossy trapdoor functions (LTFs), introduced by Peikert and Waters (STOC’08), have already been found to be a very useful tool in constructing complex cryptographic primitives in a black-box manner, such as one-way trapdoor functions, deterministic public-key encryption, CCA-secure public-key encryption, etc. Due to the existence of the side-channel attack, the leakage of trapdoor information in lossy trapdoor function systems can lead to the impossibility of provable security. Recently, Zhang et al. introduced a model of consecutive and continual leakage-resilient and updatable lossy trapdoor functions (ULTFs) and provided a concrete construction to achieve the security. Meanwhile, they proposed a consecutive and continual leakage-resilient public-key encryption scheme. However, in this paper, we demonstrate that the correctness of injective function can not be satisfied. Furthermore, the attacker can easily distinguish the evaluation key of ULTFs generated by the challenger according to the security model. Finally, we show two new constructions based on the continual leakage-resilient public-key encryption scheme of Brakerski et al. (FOCS 2010) and demonstrate the security of our scheme in the consecutive and continual leakage model.

Updatable Identity-Based Hash Proof System Based on Lattices and Its Application to Leakage-Resilient Public-Key Encryption Schemes

Identity-based hash proof system is a basic and important primitive. It is widely utilized to construct cryptographic schemes and protocols that are secure against key-leakage attacks. In this paper, we introduce the concept of updatable identity-based hash proof system, in which the related master secret key and the identity secret key can be updated securely. Then, we instantiate this primitive based on lattices in the standard model. Moreover, we introduce an application of this new primitive by giving a generic construction of leakage-resilient public-key encryption schemes with anonymity. This construction can be considered as the integration of the bounded-retrieval model and the continual leakage model. Compared with the existing leakage-resilient schemes, our construction not only is more efficient but also can resist much more key leakage.

Leakage-Resilient Certificateless Signature Under Continual Leakage Model

In the past, the security notions of cryptography were modeled under the assumption that private (or secret) keys are completely hidden to adversaries. Nowadays, these security notions could be insufficient due to a new kind of threat, called “side-channel attacks”, by which an adversary obtains partial information of private (or secret) keys via employing specific properties resulting from physical implementations of cryptographic schemes. In order to resist such side-channel attacks, numerous leakage-resilient cryptographic schemes have been proposed. However, there is little work on studying leakage-resilient certificateless cryptographic schemes. In this article, we propose the first leakage-resilient certificateless signature (LR-CLS) scheme under the continual leakage model. In the generic bilinear group model, we demonstrate that our scheme possesses existential unforgeability against adaptive chosen-message attacks for both Type I and Type II adversaries. Finally, performance analysis is made to demonstrate that the proposed LR-CLS scheme is suitable for resource-constrained devices.DOI: http://dx.doi.org/10.5755/j01.itc.47.2.17847

Continuous leakage–resilient IBE in cloud computing

SummaryCloud computing is an efficient tool in which cloud storage shares plenty of encrypted data with other data owners. In existing cloud computing scenarios, it may suffer from some new attacks like side channel attacks. Therefore, we are eager to introduce a new cryptographic scheme that can resist these new attacks. In this work, we exploit a new technique to build leakage‐resilient identity‐based encryption and use the stronger existing partial leakage model, such as continual leakage model. More specifically, our proposal is based on the underlying decisional bilinear Diffie‐Hellman assumption, but proven adaptively secure against adaptive chosen ciphertext attack in the standard model. Above all, a continuous leakage–resilient IBE scheme with adaptive security meets cloud computing with stronger security.

Leakage Resilience from Program Obfuscation

The literature on leakage-resilient cryptography contains various leakage models that provide different levels of security. In the bounded leakage model (Akavia et al.—TCC 2009), it is assumed that there is a fixed upper bound L on the number of bits the attacker may leak on the secret key in the entire lifetime of the scheme. Alternatively, in the continual leakage model (Brakerski et al.—FOCS 2010, Dodis et al.—FOCS 2010), the lifetime of a cryptographic scheme is divided into “time periods” between which the scheme’s secret key is updated. Furthermore, in its attack the adversary is allowed to obtain some bounded amount of leakage on the current secret key during each time period. In the continual leakage model, a challenging problem has been to provide security against leakage on key updates, that is, leakage that is a function of not only the current secret key but also the randomness used to update it. We propose a modular approach to overcome this problem based on program obfuscation. Namely, we present a compiler that transforms any public key encryption or signature scheme that achieves a slight strengthening of continual leakage resilience, which we call consecutive continual leakage resilience, to one that is continual leakage resilient with leakage on key updates, assuming indistinguishability obfuscation (Barak et al.—CRYPTO 2001, Garg et al.—FOCS 2013). Under stronger forms of obfuscation, the leakage rate tolerated by our compiled scheme is essentially as good as that of the starting scheme. Our compiler is derived by making a connection between the problems of leakage on key updates and so-called sender-deniable encryption (Canetti et al.—CRYPTO 1997), which was recently constructed based on indistinguishability obfuscation by Sahai and Waters (STOC 2014). In the bounded leakage model, we give an approach to constructing leakage-resilient public key encryption from program obfuscation based on the public key encryption scheme of Sahai and Waters (STOC 2014). In particular, we achieve leakage-resilient public key encryption tolerating L bits of leakage for any L from $${\mathsf {iO}} $$ and one-way functions. We build on this to achieve leakage-resilient public key encryption with optimal leakage rate of $$1-o(1)$$ based on stronger forms of obfuscation and collision-resistant hash functions. Such a leakage rate is not known to be achievable in a generic way based on public key encryption alone. We then develop additional techniques to construct public key encryption that is (consecutive) continual leakage resilient under appropriate assumptions, which we believe is of independent interest.

Efficient leakage-resilient blind and partially blind signatures

The techniques of the blind and partially blind signatures play an important role in numerous applications, most prominently in electronic voting and electronic cash. In this paper, we first present formal definitions of leakage-resilient blind and partially blind signatures. Subsequently, we propose an efficient leakage-resilient blind signature scheme and an efficient leakage-resilient partially blind signature scheme in the continual leakage model. The proposed leakage-resilient blind signature scheme is the first protocol which is secure even in a setting where the adversary may obtain leakage information on the signer's or user's internal state, including secret key and the randomness. However, in the only known leakage-resilient blind signature scheme which was proposed by Rückert, the adversary is given the leakage information only about the signer's secret key. The proposed partially blind signature scheme is the first leakage-resilient partially blind signature scheme. Also, we analyse their security and efficiency in the generic bilinear group model.

Efficient leakage-resilient blind and partially blind signatures

The techniques of the blind and partially blind signatures play an important role in numerous applications, most prominently in electronic voting and electronic cash. In this paper, we first present formal definitions of leakage-resilient blind and partially blind signatures. Subsequently, we propose an efficient leakage-resilient blind signature scheme and an efficient leakage-resilient partially blind signature scheme in the continual leakage model. The proposed leakage-resilient blind signature scheme is the first protocol which is secure even in a setting where the adversary may obtain leakage information on the signer's or user's internal state, including secret key and the randomness. However, in the only known leakage-resilient blind signature scheme which was proposed by Ruckert, the adversary is given the leakage information only about the signer's secret key. The proposed partially blind signature scheme is the first leakage-resilient partially blind signature scheme. Also, we analyse their security and efficiency in the generic bilinear group model.

Leakage-resilient attribute based encryption in prime-order groups via predicate encodings

Recently, leakage-resilient cryptography has become a hot research topic. It seeks to build more robust models of adversarial access to cryptographic algorithms. The main goal is to design a scheme that remains secure even when arbitrary, yet bounded, information about secret key is leaked. In this paper, we present a modular framework for designing leakage-resilient attribute-based encryption (ABE) schemes based on extended predicate encoding. We first extend the predicate encoding to the leakage-resilient predicate encoding; and then, design several leakage-resilient predicate encodings, and finally give a generic construction of leakage-resilient ABE based on the newly proposed encodings. Moreover, we can instantiate our framework in prime order bilinear groups to obtain concrete constructions, and prove their full security under the standard k-Lin assumption in the continual memory leakage model.

Towards leakage-resilient fine-grained access control in fog computing

Fog Computing, a technology that takes advantage of both the paradigms of Cloud Computing and the Internet of Things, has a great advantage in reducing the communication cost. Since its introduction, fog computing has found a lot of applications, including, for instance, connected vehicles, wireless sensors, smart cities and etc. One prominent problem in fog computing is how fine-grained access control can be imposed. Functional encryption, a new cryptographic primitive, is known to support fine-grained access control. However, when it comes to some new threats in the fog computing scenario, such as side channel attacks, functional encryption cannot maintain its security. Therefore, we need new cryptographic primitives that not only provide a way to securely share data with a fine-grained access control but also are able to resist those new threats.In this paper, we consider how to construct functional encryption schemes (FEs) adaptively secure in continual memory leakage model (CML), which is one of the strongest models that allows continuous leakage on both user and master secret keys. Besides providing privacy and fine-grained access control in fog computing, our scheme can also guarantee security against side channel attacks. More concretely, we propose a generic framework for constructing fully secure leakage-resilient FEs (LR-FEs) in the CML model results from leakage-resilient pair encoding, which is an extension of pair encoding presented in the recent work of Attrapadung. In this way, our framework simplifies the design and analysis of LR-FEs into the design and analysis of predicate encodings. Moreover, we discover new adaptively secure LR-FEs, including FE for regular languages, attribute-based encryption (ABE) for large universe and ABE with short ciphertext. Above all, leakage-resilient adaptively secure functional encryption schemes can equip fog computing with higher security and fine-grained access control.

Anonymous and leakage resilient IBE and IPE

We construct identity-based encryption and inner product encryption schemes under the decision linear assumption. Their private user keys are leakage-resilient in several scenarios. In particular, In the bounded memory leakage model (Akavia et al., TCC, vol. 5444, pp. 474–495, 2009), our basic schemes reach the maximum-possible leakage rate \(1-o(1)\). In the continual memory leakage model (Brakerski et al., Overcoming the hole in the bucket: public-key cryptography resilient to continual memory leakage, 2010; Dodis et al., Cryptography against continuous memory attacks, 2010), variants of the above schemes enjoy leakage rate at least \(\frac{1}{2} -o(1)\). Among the results, we improve upon the work of Brakerski et al. by presenting adaptively secure IBE schemes. In addition, we prove that our IBE schemes are anonymous under the DLIN assumption, so that ciphertexts leaks no information on the corresponding identities. Similarly, attributes in IPE are proved computationally hidden in the corresponding ciphertexts.

Leakage‐resilient ID‐based signature scheme in the generic bilinear group model

AbstractSecurity mechanisms in the traditional cryptography have been modeled under the assumption that secret values (keys) are completely hidden to an adversary. Indeed, a number of side‐channel attacks (e.g., timing, power, fault, etc.) have been demonstrated to obtain partial information about secret keys. Leakage‐resilient cryptography is a countermeasure to withstand side‐channel attacks. Recently, a large number of leakage‐resilient cryptographic schemes or protocols have been proposed to resist various side‐channel attacks. Up to now, no work has been done on leakage‐resilient identity‐based signature (LR‐IBS). In this article, we propose the first LR‐IBS scheme based on Galindo and Vivek's leakage‐resilient signature. In the generic bilinear group model, we formally prove that our LR‐IBS scheme possesses existential unforgeability against identity and adaptive chosen message attacks under the continual leakage model. Copyright © 2016 John Wiley &amp; Sons, Ltd.

Threshold public key encryption scheme resilient against continual leakage without random oracles

Threshold public key encryption allows a set of servers to decrypt a ciphertext if a given threshold of authorized servers cooperate. In the setting of threshold public key encryption, we consider the question of how to correctly decrypt a ciphertext where all servers continually leak information about their secret keys to an external attacker. Dodis et al. and Akavia et al. show two concrete schemes on how to store secrets on continually leaky servers. However, their constructions are only interactive between two servers. To achieve continual leakage security among more than two servers, we give the first threshold public key encryption scheme against adaptively chosen ciphertext attack in the continual leakage model under three static assumptions. In our model, the servers update their keys individually and asynchronously, without any communication between two servers. Moreover, the update procedure is re-randomized and the randomness can leak as well.